Folks:
My internet is working fine but occasionally, I have some links rejected and not opened. One such link is this found during a google search:
OPENS ONLY WITH MY MOBILE HOTSPOT
Any pointers? What to check?
I have a vanilla implementation. No Unbound, stubby, adguard, adblock or any such thing either on browser or on myopenwrt gateway.
Thanks.
Can you show us the specific issues that you're seeing?
And let's also see your configuration.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
The link I provided was one of the google search results (an ad) that I was keen to examine but it just would not open.
Here are the details you asked:
ubus call system board
root@ONHUB-5A0B:~# ubus call system board
{
"kernel": "5.15.167",
"hostname": "ONHUB-5A0B",
"system": "ARMv7 Processor rev 0 (v7l)",
"model": "TP-Link OnHub",
"board_name": "tplink,onhub",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.5",
"revision": "r24106-10cc5fcd00",
"target": "ipq806x/chromium",
"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
}
}
root@ONHUB-5A0B:~#
cat /etc/config/network
root@ONHUB-5A0B:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd84:a75f:3d3d::/48'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1t 6t'
option vid '1'
option description 'SOS'
config switch_vlan
option device 'switch0'
option vlan '3'
option vid '10'
option description 'WAN'
option ports '0t 2'
config switch_vlan
option device 'switch0'
option vlan '5'
option vid '5'
option description 'LAN'
option ports '1t 6t'
config switch_vlan
option device 'switch0'
option vlan '6'
option vid '6'
option description 'IOT'
option ports '1t 6t'
config device
option type '8021q'
option ifname 'eth0'
option vid '10'
option name 'eth0.10'
option ipv6 '0'
config device
option name 'eth0'
config device
option type 'bridge'
option name 'br-wan'
option multicast_querier '1'
option ipv6 '0'
list ports 'eth0.10'
config interface 'wan'
option proto 'dhcp'
option device 'br-wan'
option delegate '0'
option peerdns '0'
list dns '8.8.8.8'
list dns '9.9.9.9'
config device
option type '8021q'
option ifname 'eth1'
option vid '6'
option name 'eth1.6'
option ipv6 '0'
config device
option type 'bridge'
option name 'br-iot'
option ipv6 '0'
list ports 'eth1.6'
config interface 'iot'
option proto 'static'
option device 'br-iot'
option ipaddr '192.168.116.1'
option netmask '255.255.255.0'
option delegate '0'
config device
option type 'bridge'
option name 'br-lan'
option ipv6 '0'
list ports 'eth1.5'
config interface 'lan'
option proto 'static'
option device 'br-lan'
option ipaddr '192.168.111.1'
option netmask '255.255.255.0'
option delegate '0'
list dns '8.8.8.8'
list dns '9.9.9.9'
config device
option name 'br-sos'
option type 'bridge'
option ipv6 '0'
list ports 'eth1.1'
config interface 'sos'
option proto 'static'
option device 'br-sos'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option delegate '0'
config device
option name 'eth1.1'
option type '8021q'
option ifname 'eth1'
option vid '1'
option ipv6 '0'
config device
option name 'eth1.5'
option type '8021q'
option ifname 'eth1'
option vid '5'
option ipv6 '0'
config interface 'wg_sfo'
option proto 'wireguard'
option private_key '<redacted>'
option listen_port '51820'
list addresses '10.100.1.1/24'
config wireguard_wg_sfo
option description 'ag_phone'
option public_key 'tYRWj6s/Mdac/NACLUKQvdeyH64fqr6PNpY5WOyuISw='
option private_key '<redacted>'
list allowed_ips '10.100.1.3/32'
option persistent_keepalive '25'
option route_allowed_ips '1'
root@ONHUB-5A0B:~#
cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel 'auto'
option band '2g'
option htmode 'HT40'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option mode 'ap'
option ssid '416OBP-IOT'
option encryption 'psk2'
option disabled '0'
option key '<redacted>'
option network 'iot'
option wpa_disable_eapol_key_retries '1'
option ieee80211r '1'
option mobility_domain '4f57'
option ft_over_ds '0'
option ft_psk_generate_local '1'
config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
option channel 'auto'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
config wifi-device 'radio2'
option type 'mac80211'
option path 'soc/1b900000.pci/pci0002:00/0002:00:00.0/0002:01:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
config wifi-iface 'default_radio2'
option device 'radio2'
option mode 'ap'
option ssid '416OBP'
option encryption 'psk2'
option key '<redacted>'
option network 'lan'
option ieee80211r '1'
option mobility_domain '4f57'
option ft_over_ds '0'
option ft_psk_generate_local '1'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option ssid '416OBP'
option encryption 'psk2'
option key '<redacted>'
option network 'lan'
option ieee80211r '1'
option mobility_domain '4f57'
option ft_over_ds '0'
option ft_psk_generate_local '1'
root@ONHUB-5A0B:~#
cat /etc/config/dhcp
root@ONHUB-5A0B:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '8000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'iot'
option interface 'iot'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'sos'
option interface 'sos'
option start '111'
option limit '150'
option leasetime '12h'
cat /etc/config/firewall
root@ONHUB-5A0B:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'wg_sfo'
config forwarding
option src 'lan'
option dest 'wan'
config rule 'wg'
option name 'Allow-WireGuard'
option src 'wan'
option dest_port '51820'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Block NEP Internet'
list src_ip '192.168.116.66'
option dest 'wan'
option target 'DROP'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include 'pbr'
option fw4_compatible '1'
option type 'script'
option path '/usr/share/pbr/firewall.include'
config zone
option name 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'iot'
config zone
option name 'sos'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'sos'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
config forwarding
option src 'lan'
option dest 'iot'
config forwarding
option src 'lan'
option dest 'sos'
config forwarding
option src 'iot'
option dest 'wan'
root@ONHUB-5A0B:~# ^C
root@ONHUB-5A0B:~#
Can you be more specific here? Did your browser throw an error? Or did it partially render but was broken in some other way? A screen grab could tell us a lot.
Also, have you tried opening the same link on other devices (another computer/phone/tablet/etc)? Ideally you'd test this on a different OS and/or browser.
It did not even try to get the content just failed.
Even the ping fails:
agarg@LM5550AG:~$ ping www.googleadservices.com
ping: www.googleadservices.com: Name or service not known
agarg@LM5550AG:~$
Then it would appear to be an upstream issue ?
Even my router can not find this address:
BusyBox v1.36.1 (2024-12-03 11:42:34 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 23.05.5, r24106-10cc5fcd00
-----------------------------------------------------
root@ONHUB-5A0B:~# ping www.googleadservices.com
ping: bad address 'www.googleadservices.com'
root@ONHUB-5A0B:~#
do you mean that the dns servers my gateway goes to fail but the dns servers my 5G hotspot goes to deliver an good ip address?
Thanks.
Do nslookup www.googleadservices.com [DNS.IP], using the DNS IPs from your gw and your 5G hotspot.
Yes it is clearly a dns issue. Probably not related to openwrt, but the tests that @frollic requested will help us understand where it may be failing.
Yes. I have google dns on my wan interface which gets an ip passthrough. Still it does not resolve.
My phone does to IP that also responds to ping
root@ONHUB-5A0B:~# nslookup www.googleadservices.com
Server: 127.0.0.1
Address: 127.0.0.1:53
** server can't find www.googleadservices.com: NXDOMAIN
** server can't find www.googleadservices.com: NXDOMAIN
root@ONHUB-5A0B:~# ping 142.251.46.162
PING 142.251.46.162 (142.251.46.162): 56 data bytes
64 bytes from 142.251.46.162: seq=0 ttl=58 time=20.798 ms
64 bytes from 142.251.46.162: seq=1 ttl=58 time=20.399 ms
64 bytes from 142.251.46.162: seq=2 ttl=58 time=20.195 ms
64 bytes from 142.251.46.162: seq=3 ttl=58 time=20.681 ms
64 bytes from 142.251.46.162: seq=4 ttl=58 time=20.052 ms
^C
--- 142.251.46.162 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 20.052/20.425/20.798 ms
root@ONHUB-5A0B:~#
Try this from the router:
nslookup www.googleadservices.com 8.8.8.8
nslookup www.googleadservices.com 9.9.9.9
By the way, this is invalid. If you have a start of 111, the limit must be <=144
OMG. Yes. Thanks. I just changed the start and let the limit number be what it was. Will change that. Thanks!
Also, I changed the DNS to 1.1.1.1 and restarted dnsmasq and it worked fine.
Shouldn't the default be querying the upstream DNS, not the one on the router ?
No. The router will self-reference and then dnsmasq will query the upstream.
i think it goes to dnsmasq.
I made this inference reading about unbound+adguard where they want to change dns port of dnsmasq to something else so that it becomes sort of non operative. I am not 100% sure though.
No what I asked...
sorry, did not understand. pls ask again.
Np, @psherman answered for you...
Also, I figured out why my nslookup could have been better. I was not inputtiing the real dns server ip address within brackets. Suprorisingly when I enter that as 8.8.8.8 or as 1.1.1.1 or 9.9.9.9 each time after dnsmasq restart, it does resolve correctly.
So this behavior is not clear.
root@ONHUB-5A0B:~# nslookup www.googleadservices.com [8.8.8.8]
Server: [8.8.8.8]
Address: 8.8.8.8:53
Non-authoritative answer:
Name: www.googleadservices.com
Address: 142.250.191.66
Non-authoritative answer:
root@ONHUB-5A0B:~#