I've been pulling my hair out for WEEKS trying to get this to work, and I'm so confused. I would appreciate any help.
There's a lot of conflicting information out there, only made harder by the apparent change in how bridging is handled in a recent update.
I've read the documentation on the OpenWRT guest network pages, and read countless guides and YouTube videos.
The problem:
I've created a separate network for IOT devices which shouldn't be connected to the internet (because I use TuyaLocal and LocalTuya on Home-Assistant) which are connected to a seperate WiFi device / network.
Everything seems to work;
- My IOT devices are assigned an IP from 192.168.2.*
- I can access my IOT devices from my server/Home-Assistant (which are connected to my LAN network at 192.168.1.*)
- When I connect to the IOT network with my phone or TV, I am unable to access the internet (good).
Except; If I log into the Tuya Cloud Platform, I am able to control my devices from the Tuya web portal (this isn't intended, it should only be accessable from Home-Assistant).
My devices:
Basically, my home network consists of:
- One router with OpenWRT, no extra access points.
- One home-server, which is connected to my LAN network via WiFi.
- IOT devices (lights, fans, smart-TV), which are connected to my IOT network via WiFi.
- My home-server runs Home-Assistant with LocalTuya and TuyaLocal, and is able to control my devices.
- My home-server also runs Jellyfin, and I am able to access it, but I need to set my IOT firewall zone to allow access from (and to) my LAN network (not sure why, but it works - currently disabled for diagnosing the Tuya Cloud issue)
My Current OpenWRT setup:
Ideally, someone can tell me the correct way of doing things and I can just delete everything and start again.
Basic Summary
All settings are stock from the 23.05.5 branch, except for the settings below.
Devices:
- Device Name: br-iot
- Bring up empty bridge: True
Interfaces:
- Interface Name: IOT
- Device: br-iot
- Protocol: Static addresses
- IPv4 addresses: 192.168.2.1 (my LAN network is at 192.168.1.1)
- IPv4 netmask: 255.255.255.0
- Firewall: IOTfirewall
- Dynamic DHCP: enabled
Firewall:
- Name: IOTfirewall
- Covered networks: IOT
- Allow forward to destination zones: unspecified (currently disabled for diagnosing the Tuya issue, but I need to set it to LAN to access Jellyfin)
- Allow forward from source zones: LAN (so I can control my devices from Home Assistant)
Traffic Rules:
- Name: IOT-DHCP
- Source zone: IOTfirewall
- Destination zone: device
- Destination port: 67
Wireless:
- Name: IOT-WIFI
- Network: IOT
Firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'internet'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'https'
list proto 'tcp'
option src 'wan'
option src_dport '443'
option dest_ip '192.168.1.157'
option dest_port '443'
config zone
option name 'IOTfirewall'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'IOT'
config forwarding
option src 'lan'
option dest 'IOTfirewall'
config rule
option name 'IOT-DHCP'
option src 'IOTfirewall'
option dest_port '67'
option target 'ACCEPT'
Network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd1f:0c95:1acd::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config device
option name 'lan1'
option macaddr '***'
config device
option name 'lan2'
option macaddr '***'
config device
option name 'lan3'
option macaddr '***'
config device
option name 'lan4'
option macaddr '***'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth1'
option macaddr '***'
config interface 'internet'
option proto 'pppoe'
option device 'eth1'
option username '***'
option ipv6 '0'
config interface 'IOT'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option type 'bridge'
option delegate '0'
option device 'br-iot'
config device
option type 'bridge'
option name 'br-iot'
option bridge_empty '1'
Wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/18000000.wifi'
option channel '1'
option band '2g'
option htmode 'HE20'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid '***'
option encryption 'sae-mixed'
option key '***'
list maclist '***'
list maclist '***'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/18000000.wifi+1'
option channel '36'
option band '5g'
option htmode 'HE80'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid '***'
option encryption 'sae-mixed'
option key '***'
list maclist '***'
list maclist '***'
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'IOT-WIFI'
option encryption 'sae-mixed'
option key 'iotdevice'
option network 'IOT'
list maclist '***'
list maclist '***'
uhttpd
config uhttpd 'main'
list listen_http '0.0.0.0:80'
list listen_http '[::]:80'
list listen_https '0.0.0.0:443'
list listen_https '[::]:443'
option redirect_https '0'
option home '/www'
option rfc1918_filter '1'
option max_requests '3'
option max_connections '100'
option cert '/etc/uhttpd.crt'
option key '/etc/uhttpd.key'
option cgi_prefix '/cgi-bin'
list lua_prefix '/cgi-bin/luci=/usr/lib/lua/luci/sgi/uhttpd.lua'
option script_timeout '60'
option network_timeout '30'
option http_keepalive '20'
option tcp_keepalive '1'
option ubus_prefix '/ubus'
config cert 'defaults'
option days '730'
option key_type 'ec'
option bits '2048'
option ec_curve 'P-256'
option country 'ZZ'
option state 'Somewhere'
option location 'Unknown'
option commonname 'OpenWrt'