Lost Internet Access after making strict firewall rules

Installing and Using OpenWrt Network and Wireless Configuration
1

I am making a Guest Wifi for my network and I really do not want the Guest to see my management services. Therefore I made really strict firewall rules however I lost internet access from phone devices not PC devices and now I am scratching my head and really cant figure out why. I removed some firewall rules such as Allow-IPSec-ESP option name 'Allow-IPSec-IKE' as it seemed unnecessary and I don't need my guests using VPNS. Does anyone see any red flags with this firewall rule I have serious concerns of breach into LAN. Thank you.

N
Firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-HTTP'
        option src 'lan'
        option target 'ACCEPT'
        option proto 'tcp'
        option dest_port '80'

config rule
        option name 'Allow-HTTP-8080'
        option src 'lan'
        option target 'ACCEPT'
        option proto 'tcp'
        option dest_port '8080'

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option src 'guest'
        option src_dport '53'
        option proto 'tcp udp'
        option family 'any'
        option target 'DNAT'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule 'lan_dns'
        option name 'Allow-DNS-LAN'
        option src 'lan'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'lan_dhcp'
        option name 'Allow-DHCP-LAN'
        option src 'lan'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule 'allow_ssh'
        option name 'Allow-SSH'
        option src 'lan'
        option dest_port '2022'
        option proto 'tcp'
        option target 'ACCEPT'

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd86:e8c8:7c0f::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr 'x'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device 'guest_dev'
        option type 'bridge'
        option name 'br-guest'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.7.1'
        option netmask '255.255.255.0'

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel 'auto'
        option htmode 'HE80'
        option country 'CA'
        option cell_density '0'

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'my-Guest-Wi-Fi'
        option encryption 'sae-mixed'
        option key 'x'
        option ocv '0'
        option network 'guest'

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.35",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Mi Router AX3000T",
        "board_name": "xiaomi,mi-router-ax3000t",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r26812-75081235b8",
                "target": "mediatek/filogic",
                "description": "OpenWrt SNAPSHOT r26812-75081235b8"
        }
}



config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '0'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option noresolv '0'
        option port '54'
        list server '192.168.1.1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        list dhcp_option '6,192.168.1.1'
        list dhcp_option '3,192.168.1.1'
        list dns 'fd86:e8c8:7c0f::1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '1h'
2

You have to permit lan and guest forward to access internets. You can drop safely wan side input and forward.
Boot failsafe, mount_root, edit one line, reboot.

1 Like
3

Thank you Brada4 , I do not want LAN and Guest to talk with each other , that is the reason I put on drop if I allow it is this risk still viable.

4

If that means that wifi connected clients do not work but wired connections do, then please also show wifi settings:
cat /etc/config/wireless

1 Like
5

no it works via wireless and it connects. Just no Internet on Android / IOS device's.

6

You need explicit zone to zone forward rule to talk eachother, like LAN->WAN by default.

7

which is the one line I edit?

8

One that drops forwarded traffic from br-lan.

9

Thank you brada4 I have internet access , so does it seem seem safe after I edit the line in terms of isolation. Nothing shows up on NMAP scan.

10

Often you have to examine firewall rules like Status/Firewall or nft list ruleset.

11

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.