No wifi access on guest network

Peacefuleight · December 29, 2023, 6:34pm

Hi

someone could help me about that, my network 2.4 and 5 are working ok but my network does not have connection on the guest network.

what you need as info?
thanks

psherman · December 29, 2023, 6:54pm

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Peacefuleight · December 29, 2023, 6:57pm

root@OpenWrt:~# ubus call system board
{
	"kernel": "6.1.64",
	"hostname": "OpenWrt",
	"system": "ARMv7 Processor rev 1 (v7l)",
	"model": "Linksys WRT3200ACM",
	"board_name": "linksys,wrt3200acm",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "SNAPSHOT",
		"revision": "r24550+9-f909059b74",
		"target": "mvebu/cortexa9",
		"description": "Open-WRT SNAPSHOT r24550+9-f909059b74"
	}
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdab:1ddf:xxxx::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'wan'
	option macaddr '62:38:e0:xxxxxx'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option metric '5'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'xxxxxxxxxxxxxxxxxxx'
	list addresses 'xxxxxxxxxxxxxxxxxxx'
	option mtu '1390'
	option metric '10'

config wireguard_wg0
	option description 'mtl'
	option public_key 'xxxxxxxxxxxxxxxxxxxxxxxx'
	list allowed_ips '0.0.0.0/0'
	option route_allowed_ips '1'
	option endpoint_host 'xxxxxxxxxxxxxxxxxx'
	option persistent_keepalive '25'

config device 'guest_dev'
	option type 'bridge'
	option name 'br-guest'

config interface 'guest'
	option proto 'static'
	option device 'br-guest'
	list ipaddr '192.168.3.1/24'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
	option channel '157'
	option band '5g'
	option htmode 'VHT80'
	option country 'CA'
	option txpower '30'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
	option channel '8'
	option band '2g'
	option htmode 'HT40'
	option country 'CA'
	option txpower '30'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'xxxxxx'
	option encryption 'psk2'
	option macaddr '60:38:e0:ca:04:e9'
	option key 'xxxxxxxxxxx'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'xxxxxxxxxxx'
	option encryption 'psk2'
	option key 'xxxxxxxxxxxxxxxx'
	option network 'lan'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'xxxxxxxxxxxxxxx'
	option encryption 'psk2'
	option key 'xxxxxxxxxxxxxxxx'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'
	option confdir '/tmp/dnsmasq.d'
	list server '/mask.icloud.com/'
	list server '/mask-h2.icloud.com/'
	list server '/use-application-dns.net/'
	list server '127.0.0.1#5053'
	list server '127.0.0.1#5054'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '1h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'
	list network 'wg0'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/pbr.firewall.include'

config zone 'guest'
	option name 'guest'
	option network 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding 'guest_wan'
	option src 'guest'
	option dest 'wan'

config rule 'guest_dns'
	option name 'Allow-DNS-Guest'
	option src 'guest'
	option dest_port '53'
	option proto 'tcp udp'
	option target 'ACCEPT'

config rule 'guest_dhcp'
	option name 'Allow-DHCP-Guest'
	option src 'guest'
	option dest_port '67'
	option proto 'udp'
	option family 'ipv4'
	option target 'ACCEPT'

root@OpenWrt:~#

psherman · December 29, 2023, 7:02pm

Unless you have a specific reason for using snapshot, I'd recommend upgrading to a stable release build:
https://firmware-selector.openwrt.org/?version=23.05.2&target=mvebu%2Fcortexa9&id=linksys_wrt3200acm

I see two possible causes for your issues:

VPN + PBR - you've got a wireguard interface that sends all traffic through the tunnel and then policy based routing. Your firewall allows only access to the internet via the wan (and not the VPN). Make sure your PBR is configured appropriately.
DNS (AGH? or DoH/DoT?) - if the DNS isn't resolving for the guest network, it will also break connectivity to the internet for all practical use cases.

To determine which is the issue -- connect a device to the guest network and then issue ping tests:

ping 139.59.210.197
ping forum.openwrt.org

Peacefuleight · December 29, 2023, 7:07pm

the problem is that I can not connect for the moment to my guest network to make that test.

if the DNS isn't resolving for the guest network

how to know that ?
thanks

psherman · December 29, 2023, 7:08pm

What do you mean? Why can you not connect?

by running the ping tests I recommended.

Peacefuleight · December 29, 2023, 7:12pm

... maybe we misunderstood each other ?, I wrote that thread cause I can't connect to my guest network, this is my problem.

psherman · December 29, 2023, 7:20pm

oh... I see...

You redacted the SSIDs, so I have no idea what your guest network is... but is it from this one?

If so, it's missing the network association... add this:

	option network 'guest'

Peacefuleight · December 29, 2023, 7:27pm

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'wan'
	option macaddr '62:38:e0:ca:04:e8'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'
	option metric '5'
	option peerdns '0'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'QDsRGC40HD3R5x6Oxxxxxxxxxxxxxxxxxxxxx='
	list addresses '10.14.x.xx/16'
	option mtu '1390'
	option metric '10'

config wireguard_wg0
	option description 'mtl'
	option public_key 'pB//7qgQ/TxxxxxxxxxxxxEX8='
	list allowed_ips '0.0.0.0/0'
	option route_allowed_ips '1'
	option endpoint_host '146.xx.xx.77'
	option persistent_keepalive '25'

config device 'guest_dev'
	option type 'bridge'
	option name 'br-guest'

config interface 'guest'
	option proto 'static'
	option device 'br-guest'
	option ipaddr '192.168.3.1/24'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option confdir '/tmp/dnsmasq.d'
	list server '127.0.0.1#5053'
	list server '127.0.0.1#5054'
	option doh_backup_noresolv '-1'
	option noresolv '1'
	list doh_backup_server '127.0.0.1#5053'
	list doh_backup_server '127.0.0.1#5054'
	list doh_server '127.0.0.1#5053'
	list doh_server '127.0.0.1#5054'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '1h'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
	option channel '157'
	option band '5g'
	option htmode 'VHT80'
	option country 'CA'
	option txpower '30'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
	option channel '8'
	option band '2g'
	option htmode 'HT40'
	option country 'CA'
	option txpower '30'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'xxxx'
	option encryption 'psk2'
	option macaddr '60:38:e0:ca:04:e9'
	option key ''xxxxx'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid '5_5'
	option encryption 'psk2'
	option key 'xxxxx'
	option network 'lan'
	option macaddr '60:38:e0:ca:04:e9'

config wifi-iface 'guest'
	option device 'radio1'
	option mode 'ap'
	option network 'guest'
	option ssid 'guestN'
	option encryption 'psk2'
	option key 'xxxxx'

root@OpenWrt:~#

option network ''guest'' seems there, I 've put again the infos, cause I had copied and pasted my informations but I had forgotten that I had changed some information

psherman · December 29, 2023, 7:30pm

The channel you are using is not good... you should stick to 1, 6, or 11.

Other than that, does the SSID show up on your computer/phone, or does it not even show up?

Peacefuleight · December 29, 2023, 7:32pm

show up yes.

Peacefuleight · December 29, 2023, 7:33pm

ok, I made the change, the guest was on 8 and the 2.4 on 11, now both on 11, but still no wifi

psherman · December 29, 2023, 7:35pm

Please describe the exact symptom -- you said it shows up. Then what?

Peacefuleight · December 29, 2023, 8:08pm

Show up but impossible to have connection, just searching, and the password is the good one

psherman · December 29, 2023, 8:09pm

What happens when you try to connect? Do you get an error? What kind of device is it (phone/computer, etc.? what OS?)

Have you tried to make the connection with another device?

Peacefuleight · December 29, 2023, 8:15pm

I tried with 2 android phones.
And my Linux PC.
The same thing.
Just searching for connection and after 30.sec, my 5ghz is connected instead of my guest

psherman · December 29, 2023, 8:17pm

Do you have the option to "forget" or remove the network from the wireless connection manager -- I know that Mac OS and iOS have a feature where they can forget a network... then you can try joining again and it will ask for the passphrase as if it is the first time it is trying to make a connection.

Peacefuleight · December 29, 2023, 8:18pm

I have that yeah
I tried earlier but I will test again in the next hour.
Thanks

egc · December 29, 2023, 8:23pm

Try with 20 Mhz channel width.

Reboot afterwards

Peacefuleight · December 29, 2023, 8:32pm

I will try.
But it is working great with those settings before.