No Internet on the Guest Interface

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

I upgraded my Netgear R6220 with OpenWrt 21.02.0 from 19.07.8 and did the entire router configuration from scratch. After configuring everything, I am unable to browse the internet from my Guest Interface although I am able to get an IP after logging in through my WiFi. Everything works fine on the lan interface.

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fda9:562b:d343::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.100'

config interface 'wan'
        option device 'wan'
        option proto 'static'
        option ipaddr 'x.x.x.x'
        option netmask 'x.x.x.x'
        option gateway 'x.x.x.x'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '3'
        option name 'eth0.3'

config device
        option type 'bridge'
        option name 'br-guest'
        list ports 'eth0.3'

config interface 'Guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.10.100'
        option netmask '255.255.255.0'

root@OpenWrt:~#

My Firewall config is as follows:

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config zone
        option name 'Guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'Guest'

config forwarding
        option src 'Guest'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'Guest'

config redirect
        option target 'DNAT'
        option name 'XboxOne3074'
        option src 'wan'
        option src_dport '3074'
        option dest 'lan'
        option dest_ip '192.168.1.250'
        option dest_port '3074'

config redirect
        option target 'DNAT'
        option name 'XboxOne88'
        list proto 'udp'
        option src 'wan'
        option src_dport '88'
        option dest 'lan'
        option dest_ip '192.168.1.250'
        option dest_port '88'

config redirect
        option target 'DNAT'
        option name 'XboxOne500'
        list proto 'udp'
        option src 'wan'
        option src_dport '500'
        option dest 'lan'
        option dest_ip '192.168.1.250'
        option dest_port '500'

config redirect
        option target 'DNAT'
        option name 'XboxOne3544'
        list proto 'udp'
        option src 'wan'
        option src_dport '3544'
        option dest 'lan'
        option dest_ip '192.168.1.250'
        option dest_port '3544'

config redirect
        option target 'DNAT'
        option name 'XboxOne4500'
        list proto 'udp'
        option src 'wan'
        option src_dport '4500'
        option dest 'lan'
        option dest_ip '192.168.1.250'
        option dest_port '4500'

config rule
        option name 'Guest DHCP and DNS'
        option src 'Guest'
        option src_port '53 67 68'
        option target 'ACCEPT'

root@OpenWrt:~#

My Wireless configuration is as follows:

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11g'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option htmode 'HT40'
        option channel '6'
        option country 'IN'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt-C&C'
        option encryption 'psk2+ccmp'
        option key 'you_bet_this_is_it!'
        option ieee80211r '1'
        option nasid 'Router1CandC'
        option mobility_domain '111a'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option channel '36'
        option hwmode '11a'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option htmode 'VHT80'
        option country 'IN'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt-C&C-5GHz'
        option encryption 'psk2+ccmp'
        option key 'you_bet_this_is_it!'
        option ieee80211r '1'
        option nasid 'Router1CandC5GHz'
        option mobility_domain '555a'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'OpenWrt-Guest'
        option encryption 'psk2+ccmp'
        option key 'you_bet_this_is_it!'
        option network 'Guest'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt-Guest-5GHz'
        option encryption 'psk2+ccmp'
        option key 'you_bet_this_is_it!'
        option network 'Guest'

root@OpenWrt:~#
2

When a device connects to the guest network wifi, does it successfully get a DHCP IP lease? If so, what does the client device report for the IP, subnet mask, router/gateway, and DNS?

Can a client system ping the internet by IP? ping 8.8.8.8 and then google.com and see if either of those work.

3

Yes, the Guest is able to get the DHCP IP Address in the 192.168.10.0 Network. Although the Input is Rejected in the Guest Firewall Zone, I've put in a Traffic Rule on ports 53 67 and 68 from the Guest Zone to the Input Device as Allowed.

When I ping the IP Address 8.8.8.8, it is pingable, but I am not able to ping the FQDN google.com. Looks like a DNS Resolution Problem, how do I fix this?

4

Issue resolved, I had to change my Traffic Rule to Allow Ports 53 67 and 68 on the Destination Port of the Input Device rather than mentioning the port numbers in the Source Port section. Now, I am able to get the DHCP IP Address and able to browse the internet.

Thanks for your help!

5

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.