No Internet on Guest Network having VPN as WAN

thewebmasterp · January 6, 2024, 3:00pm

Hi all, since I managed to set up my WAN connection thankfully to a few members of this awesome community back on New Year's Eve, a week later now I'm trying to set up VPN as WAN only for a guest network.

I've been following this tutorial: VPN as WAN for guest network on OpenWRT - 2021 edition

With two differences:

My router (Asus TUF-AX4200) supports creating interfaces so it didn't seem necessary for me to create VLANs. Instead I assigned interfaces to the raw devices which further simplifies the configuration
Instead of calling the guest "guest", everywhere I was using the string "master" instead

The result is that in the end, I have WAN connection on the LAN interface, but not on the guest interface ("master").

~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
From 192.168.41.1: icmp_seq=1 Destination Port Unreachable
From 192.168.41.1: icmp_seq=2 Destination Port Unreachable
From 192.168.41.1: icmp_seq=3 Destination Port Unreachable
...

Probably the most important trace I could find is this:

root@TUF-AX4200:~# ip rule show table master
32765:	from all iif br-master lookup master
root@TUF-AX4200:~# ip route show table master
Error: ipv4: FIB table does not exist.
Dump terminated

What I tried is tweaking multiple parameters that deemed appropriate, to no avail. I also tried the VPN configuration on another device and it's correct. Tried configuring it exactly as mentioned with VLANs, same problem. Tried to see if /etc/hotplug.d/iface/98-master (alternative to /etc/hotplug.d/iface/99-guest in the tutorial) is executing by logging a message and it replies back, which means it is.

More logs:

$ ubus call system board

{
	"kernel": "5.15.137",
	"hostname": "TUF-AX4200",
	"system": "ARMv8 Processor rev 4",
	"model": "ASUS TUF-AX4200",
	"board_name": "asus,tuf-ax4200",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.2",
		"revision": "xxxxxxxxxxx",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05.2 r23630-842932a63d"
	}
}

$ cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'xxxx::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'

config device
	option name 'lan1'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan2'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan3'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan4'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'eth1'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
	option device 'eth1'
	option proto 'static'
	option ipaddr 'xxx.xxx.xxx.xxx'
	option netmask '255.255.255.0'
	option gateway 'xxx.xxx.xxx.1'
	list dns '8.8.8.8'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config device
	option type 'bridge'
	option name 'br-master'
	list ports 'lan4'
	option bridge_empty '1'

config interface 'master'
	option proto 'static'
	option device 'br-master'
	option ipaddr '192.168.41.1'
	option netmask '255.255.255.0'
	option delegate '0'

config interface 'wan_vpn'
	option proto 'none'
	option device 'tun0'
	option delegate '0'

$ cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	option start '100'
	option limit '150'
	option leasetime '12h'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'master'
	option interface 'master'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,9.9.9.9,149.112.112.112'

cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'wan_vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan_vpn'

config zone
	option name 'master'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'master'

config forwarding
	option src 'master'
	option dest 'wan_vpn'

config rule
	option name 'Allow-Master-Input-DHCPv4'
	option family 'ipv4'
	list proto 'udp'
	option src 'master'
	option src_port '68'
	option dest_port '67'
	option target 'ACCEPT'

Thanks in advance and please let me know if you need any other logs!

egc · January 6, 2024, 5:18pm

I would first check if your guest network has normal WAN access if the VPN is down, for this you have to add firewall rule to allow traffic from guest to wan I think, something like:

config forwarding
	option src 'master'
	option dest 'wan'

Next check if the VPN is working in normal operation so that it will route everything via the VPN if the tunnel is up.

I took a quick peek at the instructions, and it could be that you are victim of the route-up bug

Alternative use the PBR package

thewebmasterp · January 6, 2024, 11:30pm

It seems like I was impacted by the route-up bug you're mentioning

Anyway, it was waay easier to set it up using Policy Based Routing (pbr). I started from scratch, defined all the interfaces and firewall rules and then created a new pbr rule like this:

which essentially routes all my lan traffic through the vpn interface (wan_vpn) which is connected to tun0 device, specified in the openvpn instance config.

egc · January 7, 2024, 7:05am

Glad you solved it.

The route-up has been patched in master so new master builds will be good, I have made a PR to backport it to 23.05, so I hope it will be solved soon but the PBR package is a very good alternative .

system · January 17, 2024, 7:08am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.