Is relayd the correct setup for this situation? (IP camera)

Notanitexpert · November 5, 2020, 8:30pm

Hi all,

I am looking to plug my wired IP cameras into a network device which allows them to wirelessly connect to my network. (ie: a "wireless bridge"?). I set up an extra router to run openwrt and relayd as per this link (https://openwrt.org/docs/guide-user/network/wifi/relay_configuration). Currently, If I connect a PC to the ethernet port of the openwrt router, it gets assigned an IP by the main router and receives internet access so I thought this was set up correctly. However, when I plug in the camera it is not accessible by any local machine. When I try to ping the ip of the camera, it automatically changes the ping address to the openwrt router ip address and times out. My camera software does not automatically find the camera ip as it does when the camera/poe switch is plugged into the main router (when plugged into the main router everything works perfect) . Am I running into issues because the openwrt router is operating on a different subnet? (ie 192.168.2.1 while the main router is on 192.168.1.1?) Is relayd even the right method for what I want to do?

This is the "path" :

PoE IP Camera - > plugged into an unmanaged poe switch - > switch plugged into openwrt running relayd setup per link above - > openwrt router connects to wireless network broadcasted by "main" router - > ip cameras are connected to "main" router and network. (And then accessible on all local devices on the main router)

Netgear R6220 router (running openwrt). AFAIK, not WDS compatible?

trendy · November 5, 2020, 9:46pm

Try to connect the camera directly on the router, without intermediate switch.

No, if you followed the guide properly, the 192.168.2.X addresses are used to access the relay router when you are connected to the latter.

Yes, that should not be a problem.

A few more things to check is if the camera gets proper settings from the main router dhcp server.

I am not sure I understood that, maybe you can paste here the console output?

Notanitexpert · November 5, 2020, 9:55pm

The camera works perfectly fine when switch and camera is attached to the "main" router.

When I plug into the openwrt relayd router (no other changes), it no longer responds and cannot be found via the camera software as it did on the main router.

To answer your question regarding the ping. If the openwrt relayd router is 192.168.1.YYY and the camera ip 192.168.1.XXX.

I can see both on my main router client page, however when I "ping 192.168.1.XXX" in cmd prompt, the returning result is "Pinging 192.168.1.YYY with 32 bytes of data" (notice the result is not XXX as I've specifically specified in my ping command). I will post a screenshot shortly. Are there any settings pages in openwrt I can post that would be helpful?

trendy · November 5, 2020, 10:19pm

Let's have a look at your configs:

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
iptables-save -c; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

Notanitexpert · November 6, 2020, 1:51am

Here is the output, desktop hooked up to access it via ethernet port 1, switch/camera in by ethernet port 2. I've gone through twice to make sure to redact anything sensitive, if you see something I missed please tell me ASAP

In addition to the OpenWRT output I pasted my ping experience below it in quote format as well.

Just FYI - I use to have it broadcasting out it's own wifi signal as well, I disabled that and just want to have it setup for the means of this post (hooking up wired devices to my wireless).

BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------
root@OpenWrt:~# bus call system board; \
> uci export network; uci export wireless; \
> uci export dhcp; uci export firewall; \
> head -n -0 /etc/firewall.user; \
> iptables-save -c; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
-ash: bus: not found
package network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd12:a49c:6f20::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.1'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.2.1'

config device 'lan_eth0_1_dev'
        option name 'eth0.1'
        option macaddr 'xx:xx:xx:xx:xx:b0'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config device 'wan_eth0_2_dev'
        option name 'eth0.2'
        option macaddr 'xx:xx:xx:xx:xx:b1'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6t'

config interface 'wwan'
        option proto 'dhcp'

config interface 'repeater_bridge'
        option proto 'relay'
        list network 'lan'
        list network 'wwan'
        option ipaddr '192.168.1.2'

package wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'pci0000:00/0000:00:01.0/0000:02:00.0'
        option htmode 'HT20'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option channel '36'
        option hwmode '11a'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option htmode 'VHT80'

config wifi-iface 'wifinet2'
        option ssid 'redacted'
        option device 'radio1'
        option mode 'sta'
        option key 'redacted'
        option network 'wwan'
        option encryption 'psk2'

config wifi-iface 'wifinet3'
        option encryption 'psk2'
        option device 'radio1'
        option mode 'ap'
        option network 'lan'
        option key 'redacted'
        option ssid 'redacted'
        option disabled '1'

config wifi-iface 'wifinet4'
        option ssid 'redacted'
        option device 'radio0'
        option mode 'ap'
        option network 'lan'
        option key 'redacted'
        option encryption 'psk2'
        option disabled '1'

package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option dhcpv6 'server'
        option ra 'server'
        option ra_management '1'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

package firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan repeater_bridge'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
# Generated by iptables-save v1.8.3 on Fri Nov  6 02:20:42 2020
*nat
:PREROUTING ACCEPT [1898:274997]
:INPUT ACCEPT [19:2474]
:OUTPUT ACCEPT [444:31436]
:POSTROUTING ACCEPT [3:204]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[1898:274997] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[786:73047] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[0:0] -A PREROUTING -i eth0.2 -m comment --comment "!fw3" -j zone_wan_prerouting
[1112:201950] -A PREROUTING -i wlan1 -m comment --comment "!fw3" -j zone_wan_prerouting
[859:57021] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[0:0] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[0:0] -A POSTROUTING -o eth0.2 -m comment --comment "!fw3" -j zone_wan_postrouting
[856:56817] -A POSTROUTING -o wlan1 -m comment --comment "!fw3" -j zone_wan_postrouting
[0:0] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[786:73047] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[856:56817] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[856:56817] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[1112:201950] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
COMMIT
# Completed on Fri Nov  6 02:20:42 2020
# Generated by iptables-save v1.8.3 on Fri Nov  6 02:20:42 2020
*mangle
:PREROUTING ACCEPT [18063:15394751]
:INPUT ACCEPT [1968:186463]
:FORWARD ACCEPT [14675:14977605]
:OUTPUT ACCEPT [1585:180631]
:POSTROUTING ACCEPT [16184:15140885]
[0:0] -A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[303:15780] -A FORWARD -o wlan1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Fri Nov  6 02:20:42 2020
# Generated by iptables-save v1.8.3 on Fri Nov  6 02:20:42 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
[16:1621] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
[1954:184922] -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
[1426:151252] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[2:104] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
[498:31638] -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
[0:0] -A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
[30:2032] -A INPUT -i wlan1 -m comment --comment "!fw3" -j zone_wan_input
[14675:14977605] -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
[14161:14928733] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[449:31961] -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
[0:0] -A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
[65:16911] -A FORWARD -i wlan1 -m comment --comment "!fw3" -j zone_wan_forward
[65:16911] -A FORWARD -m comment --comment "!fw3" -j reject
[16:1621] -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
[1572:179882] -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
[1099:146273] -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[0:0] -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
[0:0] -A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
[473:33609] -A OUTPUT -o wlan1 -m comment --comment "!fw3" -j zone_wan_output
[20:1360] -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
[49:16169] -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
[2:104] -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
[0:0] -A syn_flood -m comment --comment "!fw3" -j DROP
[0:0] -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
[449:31961] -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
[449:31961] -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[498:31638] -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
[0:0] -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[498:31638] -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
[0:0] -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
[0:0] -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[498:31638] -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[0:0] -A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
[11:440] -A zone_wan_dest_ACCEPT -o wlan1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[911:65130] -A zone_wan_dest_ACCEPT -o wlan1 -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_dest_REJECT -o wlan1 -m comment --comment "!fw3" -j reject
[65:16911] -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
[0:0] -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[65:16911] -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
[30:2032] -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
[2:742] -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
[0:0] -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
[24:672] -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
[0:0] -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[4:618] -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
[473:33609] -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
[473:33609] -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
[0:0] -A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
[4:618] -A zone_wan_src_REJECT -i wlan1 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Fri Nov  6 02:20:42 2020
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 192.168.2.1/24 brd 192.168.2.255 scope global br-lan
       valid_lft forever preferred_lft forever
8: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 192.168.1.127/24 brd 192.168.1.255 scope global wlan1
       valid_lft forever preferred_lft forever
192.168.1.147 dev br-lan table 16801 scope link
192.168.2.2 dev br-lan table 16801 scope link
default via 192.168.1.1 dev wlan1 table 16802
192.168.1.1 dev wlan1 table 16802 scope link
192.168.1.117 dev wlan1 table 16802 scope link
192.168.1.133 dev wlan1 table 16802 scope link
192.168.1.134 dev wlan1 table 16802 scope link
192.168.1.146 dev wlan1 table 16802 scope link
default via 192.168.1.1 dev wlan1  src 192.168.1.127
192.168.1.0/24 dev wlan1 scope link  src 192.168.1.127
192.168.2.0/24 dev br-lan scope link  src 192.168.2.1
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.1.0 dev wlan1 table local scope link  src 192.168.1.127
local 192.168.1.127 dev wlan1 table local scope host  src 192.168.1.127
broadcast 192.168.1.255 dev wlan1 table local scope link  src 192.168.1.127
broadcast 192.168.2.0 dev br-lan table local scope link  src 192.168.2.1
local 192.168.2.1 dev br-lan table local scope host  src 192.168.2.1
broadcast 192.168.2.255 dev br-lan table local scope link  src 192.168.2.1
0:      from all lookup local
2:      from all iif lo lookup 16800
2:      from all iif wlan1 lookup 16801
2:      from all iif br-lan lookup 16802
32766:  from all lookup main
32767:  from all lookup default
ls: /tmp/resolv.*/*: No such file or directory
lrwxrwxrwx    1 root     root            16 May 16 18:32 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            32 Nov  5 02:49 /tmp/resolv.conf
-rw-r--r--    1 root     root            67 Nov  5 02:50 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface wwan
nameserver 192.168.1.1
search redacted
head: /tmp/resolv.*/*: No such file or directory
root@OpenWrt:~#

C:\Users\user>ping 192.168.1.147

Pinging 192.168.1.147 with 32 bytes of data:
Reply from 192.168.1.127: Destination port unreachable.
Reply from 192.168.1.127: Destination port unreachable.
Reply from 192.168.1.127: Destination port unreachable.
Reply from 192.168.1.127: Destination port unreachable.

Ping statistics for 192.168.1.147:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

C:\Users\user>ping 192.168.1.127

Pinging 192.168.1.127 with 32 bytes of data:
Reply from 192.168.1.127: bytes=32 time=1ms TTL=64
Reply from 192.168.1.127: bytes=32 time=1ms TTL=64
Reply from 192.168.1.127: bytes=32 time=1ms TTL=64
Reply from 192.168.1.127: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.1.127:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

C:\Users\user>

192.168.1.147 - camera ip
192.168.1.127 - openwrt router with relayd

trendy · November 6, 2020, 12:20pm

wwan must also be part of lan firewall zone. You have it in wan (hence the rejected pings).

Notanitexpert · November 6, 2020, 9:14pm

This solved the issue! Thank you very much trendy.

trendy · November 6, 2020, 10:26pm

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.