Newbie help please

Razza30 · August 7, 2026, 2:11pm

I am new to OpenWRT, and I have been struggling with a basic setup. Some help with my config problem would be much appreciated.
I am running a Pi3. I have two wifi radios, one connects to my home network (RNetA, interface name wwan) and connects fine. It is in the wan firewall zone. The second (SSID = RNetB) is in the bridged lan, in the lan firewall zone.
I do have ethernet ports also, but not used in this config (at least at the moment).

I have the firewall set to accept, accept, accept for both wan and lan zones, to aid faulting. OpenWRT sits behind my home router, so no security concern.
IPv4 Masquerading is ticked for lan=>wan. I don't need it on this interface, but I will later.

I have mwan3 installed, and that appears to be fine too. It shows my wwan interface up.

When I test from the Luci interface in MultiWAN Manager - Diagnostics, I can ping the tracking IP (1.0.0.1) fine.

I can connect fine to RNetB, obtain IP from the OpenWRT DHCP server, which has the DG of the Pi (192.168.9.1), and DNS ok (8.8.8.8). I cannot access the internet.

psherman · August 7, 2026, 4:18pm

Let's pause here...

The Pi is a terrible option for anything related to wifi. External usb-wifi adapters aren't generally much of an improvement, either.

Let's start with your goals... what is your goal for this device? How will you be using it, what does it need to do on your/other networks?

Razza30 · August 7, 2026, 9:22pm

The Pi is a lab/concept machine. I am using it as it's spare. I understand the throughput etc. is suboptimal. If I get on with OpenWRT, I'll buy a suitable device.
I will have two wan interfaces PPPoE over fibre and backup 5G over WiFi (using mwan3).
I will have OpenVPN tunnels to my parents' house (for backup) also running OpenWRT. I will also want to [Open]VPN from my laptop when out and about.

Any idea about the routing issue?

LilRedDog · August 7, 2026, 9:56pm

Put eth0 into the br-lan and talk to the pie that way.
Can you ping 8.8.8.8?

Even if you got your ip from DHCP, you may not have gotten a DNS address; please check and tell us.

Razza30 · August 8, 2026, 8:11am

Hi yes, dns is allocated by the DHCP server on the OpenWRT.
I tried with "br-lan" and "eth0" in the lan zone. br-lan doesn't allocate an IP. eth0 does and it includes a dns server.

From ipconfig-all:

Ethernet adapter Ethernet:

Connection-specific DNS Suffix  . : lan
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (13) I219-LM
Physical Address. . . . . . . . . : 84-A9-38-92-E9-F1
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : fd02:316d:af9::f8a(Preferred)
Lease Obtained. . . . . . . . . . : 08 August 2026 08:47:47
Lease Expires . . . . . . . . . . : 08 August 2026 20:47:47
IPv6 Address. . . . . . . . . . . : fd02:316d:af9:0:28ab:ded8:ef9b:ed65(Preferred)
Temporary IPv6 Address. . . . . . : fd02:316d:af9:0:19ad:6378:7efb:2164(Preferred)
Link-local IPv6 Address . . . . . : fe80::7db9:677f:eb74:ac4e%10(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.9.199(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 08 August 2026 08:45:11
Lease Expires . . . . . . . . . . : 08 August 2026 20:47:45
Default Gateway . . . . . . . . . : 192.168.9.1
DHCP Server . . . . . . . . . . . : 192.168.9.1
DHCPv6 IAID . . . . . . . . . . . : 176466232
DHCPv6 Client DUID. . . . . . . . : 00-01-01-00-30-DB-60-71-84-A9-38-92-E9-F1
DNS Servers . . . . . . . . . . . : fd02:316d:af9::1
8.8.8.8
fd02:316d:af9::1
NetBIOS over Tcpip. . . . . . . . : Enabled

/etc/config/network when eth0 in the lan zone:

config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'

config globals 'globals'
option dhcp_default_duid '0004b3b3b40c3770496e823dc53ef0e60faf'
option ula_prefix 'fd02:316d:af9::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'

config interface 'lan'
option device 'eth0'
option proto 'static'
option ip6assign '60'
option multipath 'off'
list ipaddr '192.168.9.1/24'

config device
option name 'eth0'

config interface 'WAN1'
option proto 'pppoe'
option device 'eth1'
option username 'bthomehub@btbroadband.com'
option password 'BT'
option ipv6 'auto'
option norelease '1'
option multipath 'off'
option type 'bridge'
option metric '1'

config interface 'wwan'
option proto 'dhcp'
option multipath 'off'
option metric '2'
option device 'phy1-sta0'

/etc/config/network when br-lan in the lan zone:

config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'

config globals 'globals'
option dhcp_default_duid '0004b3b3b40c3770496e823dc53ef0e60faf'
option ula_prefix 'fd02:316d:af9::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ip6assign '60'
option multipath 'off'
list ipaddr '192.168.9.1/24'

config device
option name 'eth0'

config interface 'WAN1'
option proto 'pppoe'
option device 'eth1'
option username 'bthomehub@btbroadband.com'
option password 'BT'
option ipv6 'auto'
option norelease '1'
option multipath 'off'
option type 'bridge'
option metric '1'

config interface 'wwan'
option proto 'dhcp'
option multipath 'off'
option metric '2'
option device 'phy1-sta0'

LilRedDog · August 9, 2026, 7:34am

I think I just got it:

You just want a repeater. You do not need a firewall.

Put everything in the LAN (both radios) bridge. Now you have two radios on the same subnet and just make one the AP and the other the client. They will just look at the switch as a common interface. The interface will tie it together.

Razza30 · August 9, 2026, 7:55am

Hi thanks for your help. No, I don't want a repeater.
I want eth0 and Radio0 (ssid: RNetB) in a bridged LAN. I also want two WAN ports, one using eth1 (with PPPoE) to my broadband provider. The second WAN port is radio1 (wwan), which at the moment connects to my home network (ssid: RNetA).
All I am trying to achieve at the moment is getting my pc connected to RNetB to access the internet via Radio 1 (wwan).

LilRedDog · August 9, 2026, 10:54am

Can you find some stick and figure diagram software, or better, and map that out?

I imagined the Pi secure and now I have no idea what is going where.

Razza30 · August 9, 2026, 11:28am

Surely this is a pretty standard set-up and I have misconfigured something?

rmduran29 · August 9, 2026, 4:37pm

I recently tried OpenWrt on my Pi4B and had a similar experience to yours.
Suppose that the address assigned by RnetA to wwan is 192.168.61.18/24.
Network > DNS > Forwards
DNS Forwards 192.168.61.1
Save & Apply
router restart

Set the PC or smartphone connected to RnetB or eth0 to automatic (DHCP).
In my case, this connects me to the internet.

Razza30 · August 9, 2026, 7:26pm

Thanks, I did have 8.8.8.8 in there, I must have borrowed it from a tutorial. While looking at that I did find a config error in mwan3. I now have it in a mostly working state. Some sites like the BBC error "ERR_NETWORK_CHANGED". I have disabled IPv6 and put various dns servers in (as suggested by other posts and AI).
I have done a fresh build with all interfaces working but not yet installed mwan3. I will go play with OpenVPN and come back to mwan3 later.
Thanks

LilRedDog · August 9, 2026, 10:35pm

Maybe misunderstood.

Not standard, if I read it right.

You want to cloister and firewall two devices, from your main LAN , using radios. Virtually VLAN.

We can rewrite the config; but if there is a reason to isolate those two devices, please share.
There has to be a better way.