No traffic being sent between VLANs

I created a number of VLANs but I can't route traffic between them.

Setup:

I have created 5 VLANs, but for this post I am focusing on two in the hopes that the resolution will apply to all of them.

Setup:

VLAN NAME IPs
101 DIENSTE 10.1.101.1/24
102 HOMELAB 10.1.102.1/24

In VLAN 101 I have a pihole (10.1.101.2) that is supposed to be the DNS server for my whole setup, but I can't get servers in 102 to connect to it even though I have defined (very lax, for the moment) firewall rules.

From a server in 102:

dnstester:~# /sbin/ifconfig eth102 | grep 'inet addr' | cut -d: -f2 | awk '{print $1}'
10.1.102.31
dnstester:~# nslookup google.com 10.1.101.2
;; connection timed out; no servers could be reached

OpenWrt is set up this way:

Firewall->General Settings


Generally I don't want every server in HOMELAB to be able to reach every server in DIENSTE.

Firewall->Traffic Rules


This goes against my last sentence, but I wanted to see whether my issue is the strict traffic rule I came up with so I allowed everything (that's the way I understand this rule at least), but still, I can't connect the Pihole.

Any ideas what I am doing wrong?

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

You allow HOMELAB to reach wan and you allow DIENSTE to reach wan, but you don't allow HOMELAB to allow DIENSTE and vice versa.

Start with adding allow rules for those and start closing up step by step once this works.

Get yourself acquainted to tcpdump and follow a ping through your interfaces.

1 Like

Lack of forwardings for the new zones is the reason for the no-reachability.
Either create forwardings, you'll need a pair if you need to allow traffic initiated from both zones, or if you need more refined access choose the traffic rules.

This router is behind another router, that's why there is no public IP.

Network:

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.178.1'
        list dns '192.168.178.11'
        option delegate '0'
        option ipv6 '0'

config device
        option name 'eth0.2'
        option macaddr 'XX'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option peerdns '0'
        list dns '192.168.178.11'
        option ipv6 '0'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option description 'LAN'
        option ports '0t 2 3 4 5'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 1'
        option vid '2'
        option description 'WAN'

config interface 'guest'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.179.1'
        option netmask '255.255.255.0'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '103'
        option name 'eth0.103'
        option mtu '1500'
        option macaddr 'XX'

config interface 'IOT'
        option proto 'static'
        option type 'bridge'
        list ipaddr '10.1.103.1/24'
        option device 'br-iot'

config bridge-vlan
        option device 'br-vlans'
        option vlan '103'
        list ports 'eth0.103:t'
        list ports 'eth0.2'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '103'
        option description 'IOT'
        option ports '0t 4t'

config device
        option type 'bridge'
        option name 'br-iot'
        list ports 'eth0.103'
        option mtu '1500'
        option macaddr 'XX'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '101'
        option name 'eth0.101'
        option ipv6 '0'

config device
        option type 'bridge'
        option name 'br-dienste'
        list ports 'eth0.101'
        option ipv6 '0'

config interface 'DIENSTE'
        option proto 'static'
        option device 'br-dienste'
        option ipaddr '10.1.101.1'
        option netmask '255.255.255.0'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option ports '0t 4t'
        option vid '101'
        option description 'DIENSTE'

config device
        option type 'bridge'
        option name 'br-homelab'
        list ports 'eth0.102'
        option ipv6 '0'
        option mtu '1500'
        option macaddr 'XX'

config interface 'HOMELAB'
        option proto 'static'
        option device 'br-homelab'
        option ipaddr '10.1.102.1'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'br-nonet'
        list ports 'eth0.104'
        option mtu '1500'
        option ipv6 '0'
        option macaddr 'XX'

config interface 'NONET'
        option proto 'static'
        option device 'br-nonet'
        option ipaddr '10.1.104.1'
        option netmask '255.255.255.0'

config device
        option name 'eth0.102'
        option type '8021q'
        option ifname 'eth0'
        option vid '102'
        option ipv6 '0'

config device
        option name 'eth0.104'
        option type '8021q'
        option ifname 'eth0'
        option vid '104'
        option ipv6 '0'

config switch_vlan
        option device 'switch0'
        option vlan '5'
        option ports '0t 4t'
        option vid '102'
        option description 'HOMELAB'

config switch_vlan
        option device 'switch0'
        option vlan '6'
        option ports '0t 4t'
        option vid '104'
        option description 'NONET'

Wireless

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11a'
        option path 'pci0000:00/0000:00:00.0'
        option htmode 'VHT80'
        option channel 'auto'
        option cell_density '0'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option hwmode '11g'
        option path 'platform/ahb/18100000.wmac'
        option cell_density '0'
        option channel '1'
        option htmode 'HT20'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'XX'
        option encryption 'psk2'
        option key 'XX'

config wifi-iface 'guest'
        option device 'radio1'
        option mode 'ap'
        option network 'guest'
        option encryption 'psk2'
        option key 'XX'
        option ssid 'XX'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'lowdatarates'
        option encryption 'psk2'
        option key 'XX'
        option network 'lan'
        option hidden '1'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option network 'IOT'
        option encryption 'psk2'
        option key 'XX'
        option ssid 'IOT'
        option hidden '1'

config wifi-iface 'wifinet5'
        option device 'radio1'
        option mode 'ap'
        option ssid 'PVE'
        option key 'pvetestnetwork'
        option encryption 'psk2'
        option network 'HOMELAB'

root@OpenWrt:~#

DHCP

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option leasetime '12h'
        option dhcpv4 'server'
        option limit '200'
        list dhcp_option '6,192.168.178.11'
        list ra_flags 'none'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'
        list ra_flags 'none'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '10h'
        list dhcp_option '6,10.1.101.2,10.1.101.3'
        list ra_flags 'none'

config host
        option mac 'XX'
        option ip '192.168.178.247'
        option name 'Toniebox'
        option dns '1'

config host
        option name 'XX'
        option dns '1'
        option mac 'XX'
        option ip '192.168.178.193'
        option leasetime '3w'

config host
        option name 'rpi4'
        option dns '1'
        option mac 'XX'
        option ip '192.168.178.11'
        option leasetime '3w'

config host
        option name 'wohnzimmerGrLampeTasmota'
        option dns '1'
        option mac 'XX'
        option ip '192.168.178.106'
        option leasetime '3w'

config host
        option name 'XX'
        option dns '1'
        option mac 'XX'
        option ip '192.168.178.57'
        option leasetime '3w'

config host
        option name 'KuecheDeckenlampe'
        option dns '1'
        option mac 'XXE'
        option ip '192.168.178.194'
        option leasetime '3w'

config host
        option name 'KinderzimmerDeckenlampe'
        option dns '1'
        option mac 'XX'
        option leasetime '3w'
        option ip '192.168.178.195'

config host
        option name 'XX'
        option dns '1'
        option mac 'XX'
        option ip '192.168.178.235'
        option leasetime '3w'

config host
        option name 'XX'
        option dns '1'
        option ip '192.168.178.210'
        option leasetime '3w'

config dhcp 'IOT'
        option interface 'IOT'
        option limit '200'
        option leasetime '6h'
        list dhcp_option '6,10.1.101.2,10.1.101.3'
        option start '21'
        list ra_flags 'none'

config dhcp 'DIENSTE'
        option interface 'DIENSTE'
        option limit '200'
        option leasetime '24h'
        list dhcp_option '6,10.1.101.2,10.1.101.3'
        option start '21'
        list ra_flags 'none'

config dhcp 'HOMELAB'
        option interface 'HOMELAB'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '6,10.1.101.2,10.1.101.3'
        option start '21'
        list ra_flags 'none'

config dhcp 'NONET'
        option interface 'NONET'
        option limit '150'
        option leasetime '24h'
        list dhcp_option '6,10.1.101.2,10.1.101.3'
        option start '21'
        list ra_flags 'none'

config host
        option name 'nginx'
        option dns '1'
        option mac 'XX'
        option ip '10.1.101.20'
        option leasetime '24h'

root@OpenWrt:~#

Firewall

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule 'reject_toniebox'
        option name 'RejectToniebox'
        option dest 'wan'
        option target 'REJECT'
        option src 'lan'
        list proto 'all'
        list src_ip '192.168.178.247'
        option enabled '0'

config redirect
        option target 'DNAT'
        option name 'Wireguard'
        option src 'wan'
        option src_dport '140'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option dest_port '51900'
        list proto 'tcp'
        list proto 'udp'

config rule
        option name 'NoInternet'
        option src 'lan'
        option dest 'wan'
        option target 'REJECT'
        list proto 'all'
        list src_ip '192.168.178.194'
        list src_ip '192.168.178.195'
        list src_ip '192.168.178.210'
        list src_ip 'fe80::2618:c6ff:fe14:1828'
        list src_ip 'fe80::6cf:8cff:fe84:287e'

config redirect
        option target 'DNAT'
        option name 'Telegram Bot'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option src_dport '8443'
        option dest_port '1443'

config redirect
        option target 'DNAT'
        option name 'Telegram Bot Debug'
        option src 'lan'
        option src_dport '1555'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option dest_port '1443'

config redirect
        option target 'DNAT'
        option name 'Ssh pi'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option dest_port '3422'
        option src_dport '3422'

config redirect
        option target 'DNAT'
        option name 'Make ha accessible from world'
        option src 'wan'
        option src_dport '8123'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option dest_port '8123'
        option enabled '0'

config redirect
        option target 'DNAT'
        option name 'Make nginx world accessible'
        option src 'wan'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option dest_port '443'
        option src_dport '443'

config redirect
        option target 'DNAT'
        option name 'Jupyter'
        list proto 'tcp'
        option src 'wan'
        option src_dport '8899'
        option dest 'lan'
        option dest_ip '192.168.178.11'
        option dest_port '8899'

config redirect
        option target 'DNAT'
        option name 'Proxmox World accessible '
        option src 'wan'
        option src_dport '8006'
        option dest 'lan'
        option dest_ip '192.168.178.12'
        option dest_port '8006'

config zone
        option name 'IOT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'IOT'

config rule
        option name 'Allow admin '
        list proto 'tcp'
        option src 'wan'
        option dest_port '80'
        option target 'ACCEPT'

config zone
        option name 'DIENSTE'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'DIENSTE'
        option forward 'REJECT'

config forwarding
        option src 'DIENSTE'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'DIENSTE'

config zone
        option name 'HOMELAB'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'HOMELAB'
        option forward 'REJECT'

config forwarding
        option src 'lan'
        option dest 'HOMELAB'

config forwarding
        option src 'HOMELAB'
        option dest 'wan'

config forwarding
        option src 'IOT'
        option dest 'wan'

config zone
        option name 'NONET'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'NONET'

config rule
        option name 'Pihole'
        option src 'HOMELAB'
        option target 'ACCEPT'
        option dest '*'

root@OpenWrt:~#

I probably misunderstood the settings, but isn't that what Traffic Rules are for? Generally I don't want HOMELAB to reach DIENSTE, with the exception of the DNS server, so I have to use Traffic Rules to do the forwarding?

You're 50% of the way there, but the 'rule' you've added isn't going to achieve that. Change

config rule
        option name 'Pihole'
        option src 'HOMELAB'
        option target 'ACCEPT'
        option dest '*'

to

config rule
        option name 'Pihole'
        option src 'HOMELAB'
        option dest 'DIENSTE '
        option dest_ip '10.1.101.2'
        option target 'ACCEPT'

and restart the firewall (/etc/init.d/firewall restart).

1 Like

Thanks,
that brought me on the right track. It seems the firewall restart was mandatory (didn't change anything else) and not it works :slight_smile:

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.