Issues setting up guest WLAN on Zyxel NWA50AX Pro – No DHCP or internet access

Installing and Using OpenWrt
1

Hi,
I have a Zyxel NWA50AX Pro access point that is connected to my home router (lan interface). This interface is configured as a DHCP client so that the AP obtains an IP address from the router (192.168.0.0/24). I also have another interface, vpnlan, which establishes a Wireguard tunnel to a VPN provider. Each of the interfaces is assigned a WLAN.

This all works without any problems.

Now I would like to set up an additional guest WLAN, but I am unable to do so because the clients cannot obtain an IP address via DHCP and cannot access the Internet even with static IP addressing.

But first things first: I created a bridge device br-guest and an interface guest. I configured a DHCP pool in this interface. Then I configured a firewall zone called guest. Traffic from the guest network should be forwarded to the home router without the clients in the guest network being able to communicate with clients in the other networks.

Finally, I created a WLAN that uses the guest network.

But somehow I can't get it to work and I'm not sure why, so I'm hoping for answers from the collective intelligence of the community.

I am providing the configuration of my AP. I hope I have shared all the relevant configurations.

Thanks in advance for your support!

cat /etc/config/dhcp 

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '4096'
	option noresolv '1'
	list interface 'vpnlan'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piofolder '/tmp/odhcpd-piofolder'

config dhcp 'vpnlan'
	option interface 'vpnlan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,192.168.100.1'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '1h'
	list dhcp_option '6,49.12.67.122,91.99.154.175'

cat /etc/config/firewall 

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'vpnlan'

config zone
	option name 'wg'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'WGINTERFACE'

config rule
	option src 'vpn'
	option dest 'lan'
	option name 'Block DNS outside VPN'
	option dest_port '53'
	option target 'REJECT'

config forwarding
	option src 'vpn'
	option dest 'wg'

config forwarding
	option src 'vpn'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'vpn'

config zone
	option name 'guest'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'
	option masq '1'

config forwarding
	option src 'guest'
	option dest 'lan'

config rule
	option src 'guest'
	option dest 'lan'
	option name 'Disable Guest LAN Access'
	list dest_ip '192.168.0.0/24'
	list dest_ip '192.168.100.0/24'
	option target 'REJECT'
	list proto 'all'

config rule
	option src 'guest'
	option dest 'lan'
	option name 'Allow-Guest-Internet'
	list proto 'all'
	option target 'ACCEPT'

config rule
	option src 'guest'
	option name 'Disable Guest AP HTTP Access'
	option dest_port '80'
	option target 'REJECT'

config rule
	option src 'guest'
	option name 'Disable Guest AP SSH Access'
	option dest_port '22'
	option target 'REJECT'

config rule
	option src 'guest'
	option name 'Guest DHCP'
	list proto 'udp'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option src 'guest'
	option name 'Guest DNS'
	option dest_port '53'
	option target 'ACCEPT'

cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdb2:b33b:f358::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'dhcp'

config interface 'WGINTERFACE'
	option proto 'wireguard'
	option private_key '<privateKey>'
	list addresses '<address>'
	list addresses '<address>'
	list dns '<address>'
	option force_link '1'
	option defaultroute '0'

config wireguard_WGINTERFACE
	option description 'Imported peer configuration'
	option public_key '<publicKey>'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option endpoint_host '<address>'
	option endpoint_port '51820'
	option persistent_keepalive '25'
	option route_allowed_ips '1'

config interface 'vpnlan'
	option proto 'static'
	option ipaddr '192.168.100.1'
	option netmask '255.255.255.0'
	option device 'br-vpn'

config route
	option interface 'WGINTERFACE'
	option target '0.0.0.0/0'

config device
	option type 'bridge'
	option name 'br-vpn'
	option bridge_empty '1'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.255.1'
	option netmask '255.255.255.0'
	list dns '49.12.67.122'
	list dns '91.99.154.175'
	list dns '176.9.93.198'
	list dns '176.9.1.117'
	option delegate '0'
	option device 'br-guest'

config device
	option type 'bridge'
	option name 'br-guest'
	option ipv6 '0'

cat /etc/config/wireless 

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option channel 'auto'
	option htmode 'HT40'
	option country 'DE'
	option cell_density '0'
	option noscan '1'
	option disabled '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel '112'
	option htmode 'HE160'
	option country 'DE'
	option cell_density '0'

config wifi-iface 'wifinet0'
	option device 'radio1'
	option mode 'ap'
	option ssid '<ssidWireguard>'
	option encryption 'sae'
	option dtim_period '3'
	option key '<psk>'
	option wpa_disable_eapol_key_retries '1'
	option network 'vpnlan'
	option ocv '1'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid '<ssidLan>'
	option encryption 'sae'
	option dtim_period '3'
	option key '<psk>'
	option ocv '1'
	option wpa_disable_eapol_key_retries '1'
	option network 'lan'

config wifi-iface 'wifinet6'
	option device 'radio1'
	option mode 'ap'
	option ssid '<ssidGuest>'
	option encryption 'sae-mixed'
	option multicast_to_unicast_all '1'
	option isolate '1'
	option dtim_period '3'
	option key '<psk>'
	option ocv '0'
	option wpa_disable_eapol_key_retries '1'
	option network 'guest'
2

Remove the masquerading line and set input to REJECT:

Delete this:

Delete this:

Delete all of the DNS lines and the delegate line:

Use WPA2 (psk2) or WPA3 (sae) only; don't use mixed mode. Also, remove the multicast_to_unicast_all line:

Reboot and test again.

I expect that DHCP will work, but internet probably will not because of the wireguard connection. To fix that, you will disable route_allowed_ips and instead setup policies using Policy Based Routing.

3

Thank you, I will give it a try!