My openwrt router firewall forwards unauthorized traffic

[zakaria-ahmd20]

There is a major problem on my OPENWRT router that is very shocking. Our privileged users or regular users use the ISP router and our guests use the openwrt router for segmentation and network filtering. For some odd reason , requests to the ISP web-server on 192.168.2.1/24 made by users in the guest network on 192.168.7.0/24 are actually being forwarded successfully with out any issues and similar to pings. In other words users in the guest network can reach the ISP which is a not what I want for segemenation purposes and security. I am not too skilled when it comes to OPENWRT firewall however I understand that the forward is on ACCEPT , the reason i had set it to accept was to allow for internet traffic. This is very frustrating because if i set the forwading to DROP i lose all internet access , how can i simply give guest users only access to internet , thank you very much

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'


config rule
        option name 'Allow-HTTP'
        option src 'lan'
        option target 'ACCEPT'
        option proto 'tcp'
        option dest_port '80'

config rule
        option name 'Allow-HTTP-8080'
        option src 'lan'
        option target 'ACCEPT'
        option proto 'tcp'
        option dest_port '8080'

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option src 'guest'
        option src_dport '53'
        option proto 'tcp udp'
        option family 'any'
        option target 'DNAT'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule 'lan_dns'
        option name 'Allow-DNS-LAN'
        option src 'lan'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'lan_dhcp'
        option name 'Allow-DHCP-LAN'
        option src 'lan'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule 'allow_ssh'
        option name 'Allow-SSH'
        option src 'lan'
        option dest_port '2022'
        option proto 'tcp'
        option target 'ACCEPT'

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd86:e8c8:7c0f::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr 'x'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device 'guest_dev'
        option type 'bridge'
        option name 'br-guest'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.7.1'
        option netmask '255.255.255.0'

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel 'auto'
        option htmode 'HE80'
        option country 'CA'
        option cell_density '0'

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'my-Guest-Wi-Fi'
        option encryption 'sae-mixed'
        option key 'x'
        option ocv '0'
        option network 'guest'

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.35",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Mi Router AX3000T",
        "board_name": "xiaomi,mi-router-ax3000t",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r26812-75081235b8",
                "target": "mediatek/filogic",
                "description": "OpenWrt SNAPSHOT r26812-75081235b8"
        }
}

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '0'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option noresolv '0'
        option port '54'
        list server '192.168.1.1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        list dhcp_option '6,192.168.1.1'
        list dhcp_option '3,192.168.1.1'
        list dns 'fd86:e8c8:7c0f::1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '1h'

[krazeh]

@zakaria-ahmd20

how can i simply give guest users only access to internet , thank you very much

Prevent access to anything else on the ISP router. The OpenWRT router isn't forwarding 'unauthorised' traffic. It's doing exactly what you've told it to do, which is allow traffic from the guest LAN out of the WAN interface. What happens after that is for upstream routers.

[brada4]

Option A - switch provider route to passthrough
Option B - add forwarding rule dropping or rejecting guest -> CPE network(S)

Double NAT is not encouraged by OpenWRT anywhere.

[egc]

@zakaria-ahmd20

There is a major problem on my OPENWRT router that is very shocking

Yes doing things you do not fully understand can lead to shocking results

A simple traffic rule, blocking access to 192.168.2.0/24 will do what you want

[thedukesd]

I assume that 1 of the ISP device lan ports is connected to the wan port of the OPENWRT with ADGUARD device. So you basicaly have double NAT there. And that you want that everyone in 192.168.7.x range (guest) be denied access to the ISP device that has the ip 192.168.2.1

You can read this and adjust a bit the things there:
https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_config_examples#block_lan-side_access_to_a_specific_site

src in your case should be guest
dest_ip in your case should be 192.168.2.1

[psherman]

As has been stated in this thread (by both @egc and @thedukesd), the solution is a traffic rule in the firewall. This is not a bug or oversight within OpenWrt, but rather an application specific firewall rule that needs to be added to achieve the desired goal based on the topology of this network.

@zakaria-ahmd20 - please add the firewall rule as recommended and then run the test again. If you still have issues, please post your updated firewall file for review.

[zakaria-ahmd20]

Thank you , yea I am still learning and more used to traditional firewalls however it seems to be working well as pings to gw dont work and cant access the routers admin web server. However something quite odd happened after applying the firewall rules stated at the bottom. I was hoping there was nothing to show at all yet one ip made it pass the nmap scan

nmap 192.168.2.0/24

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-30 10:32 EDT
Stats: 0:01:42 elapsed; 0 hosts completed (0 up), 256 undergoing Ping Scan
Ping Scan Timing: About 49.80% done; ETC: 10:36 (0:01:44 remaining)
Nmap scan report for 192.168.2.173
Host is up (0.0023s latency).
All 1000 scanned ports on 192.168.2.173 are in ignored states.
Not shown: 1000 closed tcp ports (reset)

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'
config  rule
        option  src             'guest'
        option  dest            'wan'
        option  dest_ip         '192.168.2.0/24'
        option  target          'REJECT'
        option  name            'REJECT-LAN-SITE-HTTP'
        option  enabled         '1'

config rule
    option name         'Block-Ping-WAN'
    option src          'guest'
    option dest         'wan'
    option family       'ipv4'
    option proto        'icmp'
    option dest_ip      '192.168.2.0/24'
    option target       'REJECT'
    option enabled      '1'


config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option proto 'tcp udp'
        option family 'any'

[zakaria-ahmd20]

Thank you , yea I am still learning and more used to traditional firewalls however it seems to be working well as pings to gw dont work and cant access the routers admin web server. However something quite odd happened after applying the firewall rules stated at the bottom. I was hoping there was nothing to show at all yet one ip made it pass the nmap scan

nmap 192.168.2.0/24

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-30 10:32 EDT
Stats: 0:01:42 elapsed; 0 hosts completed (0 up), 256 undergoing Ping Scan
Ping Scan Timing: About 49.80% done; ETC: 10:36 (0:01:44 remaining)
Nmap scan report for 192.168.2.173
Host is up (0.0023s latency).
All 1000 scanned ports on 192.168.2.173 are in ignored states.
Not shown: 1000 closed tcp ports (reset)

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config  rule
        option  src             'guest'
        option  dest            'wan'
        option  dest_ip         '192.168.2.0/24'
        option  family          'ipv4'
        option  target          'DROP'
        option  name            'REJECT-LAN-SITE-HTTP'
        option  enabled         '1'

config rule
    option name         'Block-Ping-WAN'
    option src          'guest'
    option dest         'wan'
    option family       'ipv4'
    option proto        'icmp'
    option dest_ip      '192.168.2.0/24'
    option target       'REJECT'
    option enabled      '1'


config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option proto 'tcp udp'
        option family 'any'
        option target 'DNAT'

root@OpenWrt:~#