So I have about 20 EOL Sophos AP55 Access Points. I want to reconfigure them to use OpenWrt but I don't want the wifi clients to be able to access the lan zone. I have been following this guide to separate the wireless network from the LAN network:
https://openwrt.org/docs/guide-user/network/wifi/routedap
I followed those instructions almost exactly but it doesn't seem to be working. The Access point does give out dhcp in the different range (192.168.2.X, LAN Zone is 192.168.100.X) and I can do an nslookup that works but it doesn't let me access the internet. I wonder if it has to do with the "wan" zone/interface, but this access point has only a single port which is in the "lan" zone.
Are these 20 APs being used on the same network, or are you just setting up one of them?
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
1 Like
I'm just setting up a single one right now. Here is the info:
root@OpenWrt:~# ubus call system board
{
"kernel": "6.6.73",
"hostname": "OpenWrt",
"system": "Qualcomm Atheros QCA9558 ver 1 rev 0",
"model": "Sophos AP55",
"board_name": "sophos,ap55",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.0",
"revision": "r28427-6df0e3d02a",
"target": "ath79/generic",
"description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
"builddate": "1738624177"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fda4:3394:6677::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
config interface 'wifi'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option device 'phy1-ap0'
root@OpenWrt:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option band '5g'
option channel '36'
option htmode 'VHT80'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option band '2g'
option channel '11'
option htmode 'HT20'
option country 'CA'
option cell_density '0'
config wifi-iface 'wifinet0'
option device 'radio1'
option mode 'ap'
option ssid '********'
option encryption 'sae-mixed'
option key '*********'
option ocv '0'
option network 'wifi'
root@OpenWrt:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config 'dhcp' 'wifi'
option 'interface' 'wifi'
option 'start' '100'
option 'limit' '150'
option 'leasetime' '12h'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood 1
option input REJECT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
option masq 1
config zone
option name wan
list network 'wan'
list network 'wan6'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config zone
option name wifi
list network 'wifi'
option input ACCEPT
option output ACCEPT
option forward REJECT
config forwarding
option src wifi
option dest wan
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-IPSec-ESP
option src wan
option dest lan
option proto esp
option target ACCEPT
config rule
option name Allow-ISAKMP
option src wan
option dest lan
option dest_port 500
option proto udp
option target ACCEPT
### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
# option src lan
# option src_ip 192.168.45.2
# option dest wan
# option proto tcp
# option target REJECT
# block a specific mac on wan
#config rule
# option dest wan
# option src_mac 00:11:22:33:44:66
# option target REJECT
# block incoming ICMP traffic on a zone
#config rule
# option src lan
# option proto ICMP
# option target DROP
# port redirect port coming in on wan to lan
#config redirect
# option src wan
# option src_dport 80
# option dest lan
# option dest_ip 192.168.16.235
# option dest_port 80
# option proto tcp
# port redirect of remapped ssh port (22001) on wan
#config redirect
# option src wan
# option src_dport 22001
# option dest lan
# option dest_port 22
# option proto tcp
### FULL CONFIG SECTIONS
#config rule
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 80
# option dest wan
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
# option target REJECT
#config redirect
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 1024
# option src_dport 80
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
There is actually a much more straightforward approach.
- Reset your device to defaults and disconnect it from the upstream network.
- Connect directly to your device via Ethernet.
- Enable wifi
- Disconnect the Ethernet cable and connect via wifi
- Remove the Ethernet port (
eth0) from br-lan
- Create a new interface as follows
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
- Reboot the router
- Connect the Ethernet to the upstream network
That will get your routed client working as expected.
That didn't do anything useful. Now the wifi clients just get 169.254.x.x and I can't even connect to the web UI.
Did you follow my directions exactly, including resetting to defaults first?
Yes, I reset to defaults using the WebUI, seems to have worked.
Here is /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd84:18c4:8235::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
Set this back to static…this was not part of my instructions earlier. The lan interface needs to have an address, as it would with the default configuration (192.168.1.1/24)
Ok, so I can get an IP Address now from the wifi network. (192.168.1.X). However I'm noticing some issues.
- I can't connect to the WebUI anymore from my work computer (my work computer is 192.168.100.99, AP is 192.168.100.140)
- From the WiFi client I can ping devices on the secured lan (i.e. 192.168.100.X) that can be blocked with a simple firewall command, correct?
- I CAN access the WebUI 192.168.100.140 from the Wifi Clients which is good right now but I don't want that to be possible in the future
If you want to allow access to the OpenWrt management (LuCI web interface and/or ssh) from the upstream network, this can be done in part (i.e. only specific IP addresses) or in whole (entire upstream network. What is your preference?
Yes, one quick firewall rule.
This will also be a quick firewall change.
It's fine if the entire 192.168.100.X network can access 192.168.100.140.
Change the wan firewall zone input rule to ACCEPT
note that this is only safe to do when the upstream network is fully trusted.
For the downstream network (lan), change the input rule to REJECT. Then add two rules - ACCEPT destination udp port 67 from source lan zone, and another one for tcp+udp port 53. This is for dhcp and dns.
Thanks but that didn't work. Now the wireless clients can't resolve a dns query using nslookup. From a wireless client I can still ping and connect to a device (192.168.100.10) using both ping and smb.
I'm going to try and paste the screenshots of exactly what I did below:
Those are port forwards, not traffic rules. Delete it and recreate with traffic rules.
Ok, still not getting anywhere. Here are the rules but no change in behavior, still unable to go on the internet and nslookup not resolving any queries:
Destination is to the device itself (input)
So I changed the "Destination zone" to "unspecified" for both rules, then applied and restarted the router but that didn't change anything, nslookup still fails and can't go on the internet. I had tried that before as reflected in the above port forwards screenshot but it didn't work.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
cat /etc/config/network
cat /etc/config/firewall
Sure:
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd84:18c4:8235::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option target 'DNAT'
option name 'DNS Port 53'
option src 'lan'
option src_dport '53'
option dest_port '53'
config redirect
option target 'DNAT'
option name 'UDP Port 67 DHCP'
option src 'lan'
option src_dport '67'
option dest_port '67'
Delete these:
Add:
config rule
option name 'Allow-dhcp'
option src 'lan'
option dest_port '67'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Allow-dns'
option src 'lan'
option dest_port '53'
option target 'ACCEPT'
