I recently replaced my former OpenWRT driven TP-Link Archer C7 with a Netgear R7800 running the latest OpenWRT release (20.02.1). After the initial setup, I noticed that I clients connected had no Internet access after the router rebooted:
...
92 bytes from netgear91.lan (192.168.2.1): Destination Port Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 5400 835e 0 0000 3f 01 9352 192.168.2.199 216.58.201.78
Request timeout for icmp_seq 69
92 bytes from netgear91.lan (192.168.2.1): Destination Port Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 5400 f9ed 0 0000 3f 01 1cc3 192.168.2.199 216.58.201.78
Request timeout for icmp_seq 70
...
Internet access works only after I manually restarted the br-lan interface via LuCI.
Adding ifup lan to the startup script seems to fix the issue. Nevertheless, I'd be interested to know what is causing the need to have this in the startup script.
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
config defaults
option syn_flood 1
option input ACCEPT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name wan
list network 'wan'
list network 'wan6'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option src_ip fc00::/6
option dest_ip fc00::/6
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-IPSec-ESP
option src wan
option dest lan
option proto esp
option target ACCEPT
config rule
option name Allow-ISAKMP
option src wan
option dest lan
option dest_port 500
option proto udp
option target ACCEPT
# allow interoperability with traceroute classic
# note that traceroute uses a fixed port range, and depends on getting
# back ICMP Unreachables. if we're operating in DROP mode, it won't
# work so we explicitly REJECT packets on these ports.
config rule
option name Support-UDP-Traceroute
option src wan
option dest_port 33434:33689
option proto udp
option family ipv4
option target REJECT
option enabled false
# include a file with users custom iptables rules
config include
option path /etc/firewall.user
### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
# option src lan
# option src_ip 192.168.45.2
# option dest wan
# option proto tcp
# option target REJECT
# block a specific mac on wan
#config rule
# option dest wan
# option src_mac 00:11:22:33:44:66
# option target REJECT
# block incoming ICMP traffic on a zone
#config rule
# option src lan
# option proto ICMP
# option target DROP
# port redirect port coming in on wan to lan
#config redirect
# option src wan
# option src_dport 80
# option dest lan
# option dest_ip 192.168.16.235
# option dest_port 80
# option proto tcp
# port redirect of remapped ssh port (22001) on wan
#config redirect
# option src wan
# option src_dport 22001
# option dest lan
# option dest_port 22
# option proto tcp
### FULL CONFIG SECTIONS
#config rule
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 80
# option dest wan
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
# option target REJECT
#config redirect
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 1024
# option src_dport 80
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
I have a similar phenotype, no internet for connected devices after a reboot, while the router itself can reach the internet just fine. In my case so far /etc/init.d/firewall restart solved the issue until the next reboot, but I did not even think about trying to restart br-lan instead. Will do the next time around and report back here.
Sounds quite similar, yeah - router seems to have Internet access (so pinging Internet resources works), but I'm not sure if resolving DNS names works. I will try that tomorrow, including restarting the firewall service - thanks for the hint!
Tested manually restarting the firewall service - works as well.
EDIT: tried to put restarting the firewall service in the local startup script, that did not work. I have to put ifup lan in there if I want to have Internet access after rebooting the device.
Funny I tried the same, ifup lan seemed to work once but on the next reboot it failed gain (or I got confused the first time around). Will need to test further (maybe a delay before the ifup is sufficient to get it to work reliably)
root@turris:~# cat /etc/rc.local
# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.
# to deal with the fact that routing does not seem to work out of the box after a reboot
# the next one seems to work
#ifup lan
# the ifup lan replaces the following three lines
/etc/init.d/firewall restart
/etc/init.d/sqm stop
/etc/init.d/sqm start
# ddns fails to come up automatically
# is DDNS still/already running?
#DDNS_PID=$( pgrep -f -a dynamic_dns_updater.sh )
# pgrep returns the PID as first word, get rid of the rest
DDNS_PID=$( pgrep -f -a dynamic_dns_updater.sh | sed 's/ *\([^ ]*\).*/\1/' )
# if yes kill it
[ -z "$DDNS_PID" ] && pkill ${DDNS_PID}
sleep 5
# the stop/start dance will not update a running instance...
/etc/init.d/ddns stop
/etc/init.d/ddns start
exit 0
and the following into /etc/hotplug.d/net/40-iface-synthesizer
root@turris:~# cat /etc/hotplug.d/net/40-iface-synthesizer
#! /bin/sh
# 20210803 since 0725 TOS fails to call the hotplug.d/iface scripts causing issues with among other's sqm, ddns and firewall
# so here we try to synthesize the relevant information and manually call those scripts as a stop-gap measure
# Here are examples of hotplug.g/net events and their information
#Aug 2 23:23:36 turris hotplug_net_logger: USER=root ACTION=remove SHLVL=1 HOME=/ SEQNUM=1477 IFINDEX=32 HOTPLUG_TYPE=net DEVPATH=/d
#evices/virtual/net/pppoe-wan mangled_fs=btrfs LOGNAME=root DEVICENAME=pppoe-wan TERM=linux SUBSYSTEM=net PATH=/usr/sbin:/usr/bin:/sb
#in:/bin INTERFACE=pppoe-wan PWD=/ DEVTYPE=ppp
#
#Aug 2 23:23:46 turris hotplug_net_logger: USER=root ACTION=add SHLVL=1 HOME=/ SEQNUM=1478 IFINDEX=37 HOTPLUG_TYPE=net DEVPATH=/devi
#ces/virtual/net/ppp0 mangled_fs=btrfs LOGNAME=root DEVICENAME=ppp0 TERM=linux SUBSYSTEM=net PATH=/usr/sbin:/usr/bin:/sbin:/bin INTER
#FACE=ppp0 PWD=/ DEVTYPE=ppp
#
#Aug 2 23:23:46 turris hotplug_net_logger: USER=root ACTION=move SHLVL=1 HOME=/ SEQNUM=1481 IFINDEX=37 HOTPLUG_TYPE=net DEVPATH=/dev
#ices/virtual/net/pppoe-wan mangled_fs=btrfs LOGNAME=root DEVICENAME=pppoe-wan TERM=linux SUBSYSTEM=net DEVPATH_OLD=/devices/virtual/
#net/ppp0 PATH=/usr/sbin:/usr/bin:/sbin:/bin INTERFACE=pppoe-wan PWD=/ DEVTYPE=ppp
# here are the variables passed to / expected by iface scripts
#ACTION “ifup”, “ifdown”, “ifupdate”
#INTERFACE Name of the logical interface which went up or down (e.g. “wan” or “ppp0”)
#DEVICE Physical device name which interface went up or down (e.g. “eth0.1” or “br-lan”)
#IFUPDATE_ADDRESSES “1” if address changed
#IFUPDATE_PREFIXES “1” if prefix updated FIXME what constitutes an update?
VERBOSE=0
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "Running 40-iface-synthesizer"
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer $(env)
# 1) generate the required action name
NET_ACTION="$ACTION"
case "$NET_ACTION" in
remove)
IFACE_ACTION="ifdown"
;;
add|move)
IFACE_ACTION="ifup"
;;
*)
# log the environment variable to help figuring out what went wrong
logger -t hotplug_synthesizer "ERROR: Unhandled ACTION ($ACTION) encoutered."
logger -t hotplug_synthesizer $(env)
exit 0
;;
esac
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "NET_ACTION: $NET_ACTION; IFACE_ACTION: $IFACE_ACTION"
# 2) assign the INTERFACE
NET_INTERFACE="$INTERFACE"
IFACE_INTERFACE="$NET_INTERFACE"
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "NET_INTERFACE: $NET_INTERFACE; IFACE_INTERFACE: $IFACE_INTERFACE"
# 3) get the DEVICE
NET_DEVICE="$DEVICE"
case "$NET_INTERFACE" in
TMP_IFB_4_SQM)
# this gets created a lot during SQM scipts execution so silence this
exit 0
;;
eth*)
NET_DEVICE=$NET_INTERFACE
;;
pppoe-wan)
# this needs to get automatically extracted
NET_DEVICE="eth2"
;;
*)
logger -t hotplug_synthesizer "ERROR: Unhandled INTERFACE ($NET_INTERFACE) for DEVICE extraction encountered."
logger -t hotplug_synthesizer $(env)
exit 0
;;
esac
IFACE_DEVICE="$NET_DEVICE"
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "NET_DEVICE: $NET_DEVICE; IFACE_DEVICE: $IFACE_DEVICE"
# 4) deal with IFUPDATE_ADDRESSES
NET_IFUPDATE_ADDRESSES="1"
IFACE_IFUPDATE_ADDRESSES="$NET_IFUPDATE_ADDRESSES"
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "NET_IFUPDATE_ADDRESSES: $NET_IFUPDATE_ADDRESSES; IFACE_IFUPDATE_ADDRESSES: $IFACE_IFUPDATE_ADDRESSES"
# 5) deal with IFUPDATE_PREFIXES
NET_IFUPDATE_PREFIXES="1"
IFACE_IFUPDATE_PREFIXES="$NET_IFUPDATE_PREFIXES"
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "NET_IFUPDATE_PREFIXES: $NET_IFUPDATE_PREFIXES; IFACE_IFUPDATE_PREFIXES: $IFACE_IFUPDATE_PREFIXES"
[ "$VERBOSE" = "1" ] && logger -t hotplug_synthesizer "ACTION=$IFACE_ACTION INTERFACE=$IFACE_INTERFACE DEVICE=$IFACE_DEVICE IFUPDATE_ADDRESSES=$IFACE_IFUPDATE_ADDRESSES IFUPDATE_PREFIXES=$IFACE_IFUPDATE_PREFIXES $IFACE_SCRIPT"
# 6) find all scripts in /etc/hotplug.d/iface and call them with appropirate environment variables
for IFACE_SCRIPT in /etc/hotplug.d/iface/*; do
logger -t hotplug_synthesizer "Calling $IFACE_SCRIPT"
logger -t hotplug_synthesizer "ACTION=$IFACE_ACTION INTERFACE=$IFACE_INTERFACE DEVICE=$IFACE_DEVICE IFUPDATE_ADDRESSES=$IFACE_IFUPDATE_ADDRESSES IFUPDATE_PREFIXES=$IFACE_IFUPDATE_PREFIXES $IFACE_SCRIPT"
ACTION=$IFACE_ACTION INTERFACE=$IFACE_INTERFACE DEVICE=$IFACE_DEVICE IFUPDATE_ADDRESSES=$IFACE_IFUPDATE_ADDRESSES IFUPDATE_PREFIXES=$IFACE_IFUPDATE_PREFIXES $IFACE_SCRIPT
done
And with that things seem to work on reboots again. Not sure what the real root-cause is that makes all of that necessary.
