The defaults apply only to networks not assigned to a zone. The zone assignments take precedence.
Give it a shot and let me know if I'm wrong here.
EDIT: I was wrong here, too.
I feel good about my assertion. Changing the default forward policy changes the policy on the forward chain hook policy. Without a lan forwarding rule to wan, nothing will be added in the forward_lan chain. The traffic will return from forward_lan to forward where the default accept policy will let the lan traffic through to wan.
The lan zone definition is passive without any forwarding or any other blocking traffic rules.
I stand corrected! I just tried it and it turns out I was wrong earlier. Thanks for challenging my (incorrect) assertion. (I'll correct the above, too)
Let's see if any of it helps @Hausmarke. 
The testsetup is at my workplace at the University - i will be there tomorrow again. What should i try now? i mean - the only thing on my production setup which is not working is the dhcp - but i can go arround it manualy…
btw - my testsetup is a FriendlyElec NanoPi R5C OpenWRT 24.10.4 and my working production setup is a FriendlyElec NanoPi R2S also under OpenWRT 24.10.4.
Can you get the configs as requested earlier? If we see your complete config, we can help figure out what is wrong.
My Testsystem was complete new installed friday! I only tried to make the same settings i have on my production system.
Here is the config of the production system - where
*my lan has no connection to my wan and *my portforwards to some ftp server in wan are running fine… but - problem - DHCP is not working on the LAN side…
….
root@name:~# ubus call system board
{
"kernel": "6.6.119",
"hostname": "name",
"system": "ARMv8 Processor rev 4",
"model": "FriendlyElec NanoPi R2S",
"board_name": "friendlyarm,nanopi-r2s",
"rootfs_type": "ext4",
"release": {
"distribution": "OpenWrt",
"version": "24.10.5",
"revision": "r29087-d9c5716d1d",
"target": "rockchip/armv8",
"description": "OpenWrt 24.10.5 r29087-d9c5716d1d",
"builddate": "1766005702"
}
}
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'aaaa:bbbb:cccc::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'
config device
option name 'eth1'
option macaddr 'cc:ff:gg:rr:tt:zz:ww'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option delegate '0'
config device
option name 'eth0'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0'
option proto 'dhcpv6'
cat /etc/config/wireless
-> no wireless
cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piofolder '/tmp/odhcpd-piofolder'
config host
option name 'Clientname'
list mac '45:35:3E:89:35:92'
option ip '192.168.1.217'
option leasetime 'infinite'
cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'REJECT'
option output 'REJECT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'Internal-Webconfig-LAN'
option src 'wan'
option src_dport '1612'
option dest_ip '192.168.1.1'
option dest_port '80'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'Internal-Webconfig-LAN'
option src 'lan'
option src_dport '1612'
option dest_ip '192.168.1.1'
option dest_port '80'
config rule
option src 'lan'
option dest 'wan'
option name 'Server1'
list src_ip '192.168.1.146'
option src_port '21'
list dest_ip 'IP1'
option dest_port '21'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'external SCP'
option src 'wan'
option src_dport '2222'
option dest_ip '192.168.1.1'
option dest_port '22'
config rule
option src 'lan'
option dest 'wan'
option name 'Server2'
option src_port '21'
list dest_ip 'IP2'
option dest_port '21'
option target 'ACCEPT'
list src_ip '192.168.1.146'
The problem is here:
The zone input rule is what governs the ability to connect to the router itself -- including DHCP. This should be set to ACCEPT. Normally, output should also be set to ACCEPT.
If you goal is to simply prevent the lan from reaching the internet, remove this:
It is highly recommended that you avoid ever allowing access to the router from the wan (assuming that the wan is internet or otherwise untrusted). This is related to the redirect rule below (also, a redirect is not the correct method to achieve this anyway):
All of the above comments apply to this redirect, too:
This redirect
This rule doesn't do anything and can be deleted:
This rule seems like it's backwards... what's the intent here?
This one also seems backwards...
The WAN in this case is a Network behind a Firewall!!
Ok... in that case, you can leave the rules in place.
What is the subnet of the upstream firewall?
This is the forward from my LAN to some specific Server in the WAN… remember - my goal was to disable the lan to wan connection completly besides a few 1:1 connections to specific ports on specific servers in the WAN.
Why? Its complete irrelevant - the DHCP inside the LAN, inside the Openwrt is not working - and thats my problem - not anything outside in my WAN Firewall…
It is extremely relevant.
Currently, you have rules that allow lan > wan to a specific address (192.168.1.146). The problem is that if this exists on the upstream network, you have another conflict:
The lan of you OpenWrt router is 192.168.1.0/24 -- if this is the same as (or overlapping with) the upstream network, the routing will not work at all.
Maybe somebody could try to solve this easy problem on their testsyst
Its not overlapping! Trust me… we actually have only real IP addresses in our network! No private ones! This is why i dont post it - besides - my Forward Rule is working fine! The Problem is - once again - my client in the LAN can get no IP Adr! There seems to be no DHCP server in my LAN on the OpenWRT!
Ok... good.
The problem with these two rules is the source port... only the destination port should be specified (the source port is randomly assigned at the originating host):
Remove the src_port lines from above.
Did you fix the input rule I described earlier?
You may be getting confused by the visual representation of the lan zone in LuCI. The "Input", "Output" columns next to the "lan ==> wan" forward are not related to the forwarding to wan, they are related to the lan zone behavior itself. So Input and Output should be changed from "reject" to "accept" then your DHCP will work. LAN clients will still be able to reach the WAN until you edit the LAN zone and remove the forward there.
The LuCI layout confuses many users in this regard. I may assume wrongly in your case, but there is no other reason to reject input and output on the LAN zone, based on your responses to the previous questions.