[Solved] OpenVPN client on LAN2 kills connection on LAN

[dramm33]

I do have ISP working on LAN, it only goes down when VPN goes up.
I edited my last reply to make it more clear.

Here's what I did:

• Installed OpenWrt and got LAN working with ISP
• Configured VPN on LAN to test/learn.
• Undid the configurations of the VPN on LAN
• Created LAN2
• LAN and LAN2 working with ISP
• Configured VPN on LAN2
• Behaviour according to my last reply

You have a lot of routes being created on "VPN up"

I just followed the wiki.
Only extra is the configs you suggested.
In my first post you can see the configs and routing with your suggestions.

Perhaps we need to make LAN2 your ISP network instead?

Doesn't make much of a difference to me.
Only reason I used LAN2 for VPN was because I want cable ports on the ISP and that was already working with LAN, so I only had to create one wifi and set it to LAN2.
It seemed easier than changing the ports to LAN2.

If so, please respond and we'll proceed.

Just let me know what you want me to do.

[lleachii]

@dramm33

I do have ISP working on LAN, it only goes down when VPN goes up.

I understand that. That's the issue. To be honest, I'm not familiar with how OpenVPN creates routes; but since they're created on LAN (using the main routing table), I'm now advising that you setup LAN2 as the network that stays ISP-only (i.e. no VPN), using routing table No. 2.

@dramm33

Doesn't make much of a difference to me.

OK, cool.

You will now change the /etc/config/network rules above to change LAN2 to regular WAN:

config route
	option interface 'wan'
	option target '0.0.0.0'
	option netmask '0.0.0.0'
	option gateway '100.64.192.1'
	option table '2'

config rule                                           
        option in 'lan2'          
        option dest '0.0.0.0/0'  
        option priority '2'                                            
        option lookup '2'

config rule                                    
	option src '192.168.10.0/24'
	option priority '3'
	option lookup '2'

• In /etc/config/firewall change rule to:

config forwarding
	option src 'lan2'
	option dest 'wan'

Hope this works.

---

Add this so LAN2 can reach LAN (as LAN2 now uses routing table No. 2.), you would still need to make a firewall rule to permit it:

config rule                                    
	option src '192.168.10.0/24'
	option dest '192.168.1.0/24'
	option priority '4'
	option lookup 'main'

[dramm33]

All done!
It's working (kinda off).
Browsing is really slow, I can't even use speedtest.net, I get a "latency error".
That is happening because connections on LAN2 (ISP) are using LAN (VPN) DNS, I tried manually setting the DNS on LAN2 but DNS leak test (on LAN2) still shows my VPN IP.
Edit: Added what happens to DNS in the table below

I switched the subnets, so:

LAN	Subnet	Connection	DNS
br-lan	192.168.10.0/24	VPN	VPN
br-lan2	192.168.1.0/24	ISP	VPN (should be ISP)

For some weird reason I can't ping 192.168.1.1 when on br-lan2, I have to access to router using 192.168.10.1
Is it because of these?

config rule                                    
	option src '192.168.1.0/24'
	option dest '192.168.10.0/24'

Since I switched the subnets, I also switched src/dest.

---

route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         xx.xx.0.102     128.0.0.0       UG    0      0        0 tun0
default         xxx.xx.192.1    0.0.0.0         UG    0      0        0 eth0.2
xx.xx.0.1       xx.xx.0.102     255.255.255.255 UGH   0      0        0 tun0
xx.xx.0.102     *               255.255.255.255 UH    0      0        0 tun0
xx.xxx.143.250  xxx.xx.192.1    255.255.255.255 UGH   0      0        0 eth0.2
xxx.xx.192.0    *               255.255.192.0   U     0      0        0 eth0.2
128.0.0.0       xx.xx.0.102     128.0.0.0       UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 br-lan2
192.168.10.0    *               255.255.255.0   U     0      0        0 br-lan

ip route

0.0.0.0/1 via xx.xx.0.102 dev tun0 
default via xxx.xx.192.1 dev eth0.2 proto static src xxx.xx.196.32 
xx.xx.0.1 via xx.xx.0.102 dev tun0 
xx.xx.0.102 dev tun0 proto kernel scope link src xx.xx.0.101 
xx.xxx.xxx.250 via xxx.xx.192.1 dev eth0.2 
xxx.xx.192.0/18 dev eth0.2 proto kernel scope link src xxx.xx.196.32 
128.0.0.0/1 via 10.21.0.102 dev tun0 
192.168.1.0/24 dev br-lan2 proto kernel scope link src 192.168.1.1 
192.168.10.0/24 dev br-lan proto kernel scope link src 192.168.10.1 

ip rule

0:	from all lookup local 
2:	from all iif br-lan2 lookup 2 
3:	from 192.168.1.0/24 lookup 2 
32766:	from all lookup main 
32767:	from all lookup default 

etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd32:c7d2:6fa8::/48'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'
	option dns '10.21.0.1'
	option ip6assign '60'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '2 3 4 5 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 0t'

config interface 'vpn'
	option proto 'none'
	option ifname 'tun0'

config interface 'lan2'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option dns '201.31.0.19 201.31.0.20'

config route
	option interface 'wan'
	option target '0.0.0.0'
	option netmask '0.0.0.0'
	option gateway '100.64.192.1'
	option table '2'

config rule
	option in 'lan2'
	option dest '0.0.0.0/0'
	option priority '2'
	option lookup '2'

config rule
	option src '192.168.1.0/24'
	option priority '3'
	option lookup '2'

/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	option name 'lan2'
	option forward 'ACCEPT'
	option network 'lan2'

config forwarding
	option dest 'wan'
	option src 'lan2'

config zone
	option name 'vpnclient'
	option network 'vpn'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'vpnclient'

config forwarding
	option dest 'wan'
	option src 'lan'

config forwarding
	option src 'lan'
	option dest 'lan2'

config forwarding
	option src 'lan2'
	option dest 'lan'

config rule                                    
	option src '192.168.1.0/24'
	option dest '192.168.10.0/24'
	option priority '4'
	option lookup 'main'

[lleachii]

OK, I understand you have 2 issues:

@dramm33

That is happening because connections on LAN2 (ISP) are using LAN (VPN) DNS

• That shouldn't cause a speedtest delay, just lookup in the hostname of the server. Try: dslreports.com/speedtest
• Question: I'm assuming you configure it this way (or the VPN did it)?
• You can force your DNS by adding this to LAN2 DHCP config:

@dramm33

For some weird reason I can't ping 192.168. 1 .1 when on br-lan2, I have to access to router using 192.168. 10 .1
Is it because of these?

No, that should permit the traffic - ALSO, YOU PASTED AN INCOMPLETE RULE, IT DOESN'T APPEAR ON THE ROUTING RULES!. Also, did you follow my instructions:

@lleachii

you would still need to make a firewall rule to permit it

(this is if they are not in the same firewall zone, if they are you must allow forwarding in the same zone)

Here is the complete rule again:

config rule                                    
	option src '192.168.10.0/24'
	option dest '192.168.1.0/24'
	option priority '4'
	option lookup 'main'

@dramm33

Since I switched the subnets, I also switched src/dest.

You're confusing me. You'll have to figure out the correct src/dest yourself, then.

• src should be the network using table 2
• dest should be network using table main

EDIT: also show results of ip route show table 2

[dramm33]

@lleachii

That shouldn't cause a speedtest delay, just lookup in the hostname of the server. Try: dslreports.com/speedtest

Different error than speedtest.net but still... Anyway, maybe that will be fixed with proper DNS/rules.

@lleachii

• Question: I'm assuming you configure it this way (or the VPN did it)?
• You can force your DNS by adding this to LAN2 DHCP config:

I set it under Network > Interfaces > LAN > Common Configuration > General Setup > Use custom DNS servers

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option dns '10.21.0.1'
        option ip6assign '60'

And for LAN2 (hoping to avoid using the VPN DNS)

config interface 'lan2'          
        option type 'bridge'   
        option ifname 'eth0.1' 
        option proto 'static'  
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option dns '201.31.0.19 201.31.0.20'
        option ip6assign '60'         

Just tried setting under DHCP-Options, ping: google.com: Temporary failure in name resolution
I tried leaving the DNS in both places and just on DHCP-Options, same result ^
Also tried setting only on LAN2, DHCP-Options and/or Custom DNS, same result ^

New info
I noticed that when the VPN is down LAN2 DNS is according to the Custom DNS rule.
When the VPN is up, LAN2 uses de same DNS than the Custom DNS set in LAN (if any). I'm sure of it because the countries are different (VPN/ISP), so it shows easily in the DNS leak test.

@lleachii

No, that should permit the traffic - ALSO, YOU PASTED AN INCOMPLETE RULE, IT DOESN'T APPEAR ON THE ROUTING RULES!.

Yeah, it was incomplete, I thought it would be enough for you to know what rule I was talking about, sorry.
At the bottom of /etc/config/firewall (pasted in the previous reply) you can see the full rule, just like you told me to add it.

@lleachii

Also, did you follow my instructions:

you would still need to make a firewall rule to permit it

(this is if they are not in the same firewall zone, if they are you must allow forwarding in the same zone)

I have forwards betwen LAN and LAN2 in /etc/config/firewall. Is it something else?

config forwarding
	option src 'lan'
	option dest 'lan2'

config forwarding
	option src 'lan2'
	option dest 'lan'

@lleachii

You're confusing me. You'll have to figure out the correct src/dest yourself, then.

• src should be the network using table 2
• dest should be network using table main

LAN2 is using table 2

config route            
        option interface 'wan'                 
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway '100.64.192.1'
        option table '2'     
                                    
config rule                           
        option in 'lan2'      
        option dest '0.0.0.0/0'
        option priority '2'
        option lookup '2'
                              
config rule                
        option src '192.168.1.0/24'
        option priority '3'
        option lookup '2'     

So, LAN2 > table 2 > 192.168.1.0/24 > src

config rule            
        option src '192.168.1.0/24'
        option dest '192.168.10.0/24'
        option priority '4'
        option lookup 'main'

@lleachii

EDIT: also show results of ip route show table 2

ip route show table 2

default via 100.64.192.1 dev eth0.2 proto static

ip route show table main

0.0.0.0/1 via xx.xx.0.102 dev tun0 
default via xxx.xx.192.1 dev eth0.2 proto static src xxx.xx.196.32 
xx.xx.0.1 via xx.xx.0.102 dev tun0 
xx.xx.0.102 dev tun0 proto kernel scope link src xx.xx.0.101 
xx.xxx.143.250 via xxx.xx.192.1 dev eth0.2 
xxx.xx.192.0/18 dev eth0.2 proto kernel scope link src xxx.xx.196.32 
128.0.0.0/1 via 10.21.0.102 dev tun0 
192.168.1.0/24 dev br-lan2 proto kernel scope link src 192.168.1.1 
192.168.10.0/24 dev br-lan proto kernel scope link src 192.168.10.1 

/{etc,tmp}/resolv.conf

search lan
nameserver 127.0.0.1

/tmp/resolv.conf.auto

# Interface lan
nameserver 10.21.0.1
# Interface lan2
nameserver 201.31.0.19
nameserver 201.31.0.20
# Interface wan
nameserver 201.21.192.112
nameserver 201.21.192.117

Oh, and happy new years eve!
(If you follow the Gregorian calendar)

[lleachii]

Again, I'm not sure why you're showing me the speedtest pages. None mention DNS.

@dramm33

I set it under Network > Interfaces > LAN > Common Configuration > General Setup > Use custom DNS servers

You again didn't do what I showed you. I even gave you a picture. The picture you showed me is not the one I showed you.

It's hard to help someone when they are doing something different. Your config is for the router, not the clients.

@dramm33

Yeah, it was incomplete, I thought it would be enough for you to know what rule I was talking about, sorry.

Please follow my full instructions.

@dramm33

Just tried setting under DHCP-Options, ping: google.com: Temporary failure in name resolution
I tried leaving the DNS in both places and just on DHCP-Options, same result ^
Also tried setting only on LAN2, DHCP-Options and/or Custom DNS, same result ^

Does your ISP permit use of other DNS servers???

@dramm33

At the bottom of /etc/config/firewall (pasted in the previous reply) you can see the full rule, just like you told me to add it.

I never gave you a firewall rule!!! I told you to make it! All "config rule" and "config routes" above are to go in /etc/config/network.

WHY DO YOU KEEP PUTTING ROUTING RULES I GIVE TO YOU IN THE FIREWALL!?!?

I'm assisting you with routing, not firewalling.

• When you have properly added it, the command ip rule should have a rule no. 4 listed.
• THEN you make a firewall rule to permit traffic.

[dramm33]

@lleachii

You again didn't do what I showed you. I even gave you a picture. The picture you showed me is not the one I showed you.

It's hard to help someone when they are doing something different.

How I didn't do what you showed me? I did and the result was no DNS at all.
You even quoted me on this...

@dramm33

Just tried setting under DHCP-Options, ping: google.com: Temporary failure in name resolution
I tried leaving the DNS in both places and just on DHCP-Options, same result ^
Also tried setting only on LAN2, DHCP-Options and/or Custom DNS, same result ^

---

@lleachii

Does your ISP permit use of other DNS servers???

Yes, like I already said, when the VPN is down LAN2 (ISP) DNS is whatever I set in Custom DNS

@dramm33

I noticed that when the VPN is down LAN2 DNS is according to the Custom DNS rule.
When the VPN is up, LAN2 uses de same DNS than the Custom DNS set in LAN (if any). I'm sure of it because the countries are different (VPN/ISP), so it shows easily in the DNS leak test.

---

Moved to /etc/config/network

0:	from all lookup local 
2:	from all iif br-lan2 lookup 2 
3:	from 192.168.1.0/24 lookup 2 
4:	from 192.168.10.0/24 to 192.168.1.0/24 lookup main 
32766:	from all lookup main 
32767:	from all lookup default 

[lleachii]

@dramm33

Moved to /etc/config/network

OK, can you ping now?

[dramm33]

Nope.

From LAN2 (192.168.1.3) I can't ping 192.168.1.1

DNS still the same thing, when VPN is up on LAN, LAN2 uses the same DNS.

However I only have this firewall rule... Maybe I need to add something else?

config forwarding
	option src 'lan'
	option dest 'lan2'

config forwarding
	option src 'lan2'
	option dest 'lan'

Also, in this other thread the guy had the exact same issue (VPN killed other VLAN, which we now have solved) and when he was trying to fix it, he had "DNS issues":

@ess2k

With that all sorted, when I would have the VPN up on VLAN10 I would get no internet on VLAN5. After days and days of searching the interwebs, I found I need to set a default ip route by adding the following commands under the startup section, for my setup:

ip route add default via 192.168.0.1 table 10
ip rule add from 192.168.5.2 table 10

Initially I tried ip rule add from 192.168.5.0/24 table 10 but this would cause DNS issues and I would have to put in google dns servers for the internet to work, another issue I had with 192.168.5.0/24 was I could no longer ping 192.168.5.1 subnet. I am sure the is a perfectly reasonable explanation and may an easier way to do it, but what I did was simply add a rule for each ip address from 2-50 (my DHCP range) and by doing this and leaving out the address 192.168.5.1 I did not any longer need to use the google dns and could also ping both vlans (this is what I wanted).

[lleachii]

@dramm33

and when he was trying to fix it, he had "DNS issues"

Do you use a hostname to reach your VPN provider, or the IP?

[dramm33]

At the moment IP. In my openvpn config file I have something like this:

list remote '12.123.123.123 80'

But I'm thinking about switching to NordVPN next month and I think they use hostname.

These two rules that guy in the other thread used are equivalent to what you told me to do or is it something else entirely?

ip route add default via 192.168.0.1 table 10
ip rule add from 192.168.5.2 table 10

---

Something to occurred to me. Does it matter that the OpenWrt router is connected to my ISP modem/router which is configured in bridge mode (to avoid double NAT)?

---

I reading all I can find on routes to actually understand what in happening with all those rules/routes and actually be able to troubleshoot this situation. If there is any material you recommend let me know.

[lleachii]

@dramm33

These two rules that guy in the other thread used are equivalent to what you told me to do or is it something else entirely?

Yes, those commands are similar (default = 0.0.0.0/0). You enter those commands at the system prompt when not using the UCI/web GUI. Please be advised, it's just one route, and one routing rule. You keep mixing terms.

@dramm33

Something to occurred to me. Does it matter that the OpenWrt router is connected to my ISP modem/router which is configured in bridge mode (to avoid double NAT)?

It shouldn't. You should be getting a public IP from the modem.

@dramm33

If there is any material you recommend let me know.

Perhaps: https://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.rpdb.html

[dramm33]

After studying the material @lleachii recommend and doing some more research I ended up finding another thread about the same thing, which had the solution.

Final Solution

I did what @trendy recommended in this post:

Issue with Guest SSID behind a VPN [Solved]

Thank you for the response. So after performing the ip route add default via x.x.16.1 table lan command, I was disconnected from the router/ no internet access. I did a soft reset to regain access to the router and did it one more time to verify. Same results :o

I added the following to Network > Firewall > Custom Rules

ip route add 192.168.1.0/24 dev br-lan table lan
ip route add default via xxx.xx.192.1 src 100.64.196.32 table lan
ip route add 192.168.10.0/24 dev br-lan2 table vpn
ip route add default via xx.xx.0.102 src xx.xx.0.101 table vpn
ip rule add from 192.168.10.0/24 to default lookup vpn prio 16000
ip rule add from 192.168.1.0/24 to default lookup lan prio 16010
ip rule add iif lo to default lookup lan prio 16020

Added vpn and lan tables to /etc/iproute2/rt_tables

#
# reserved values
#
128     prelocal
255     local
254     main
253     default
250     vpn
240     lan
0       unspec
#
# local
#
#1      inr.ruhep

Config files for reference

/etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd32:c7d2:6fa8::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ifname 'eth0.1'
        option ipaddr '192.168.1.1'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 0t'

config interface 'vpn'
        option proto 'none'
        option ifname 'tun0'

config interface 'lan2'
        option _orig_bridge 'false'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option type 'bridge'          
        option ip6assign '60' 

/etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'               
        option proto 'udp'             
        option src_ip 'fc00::/6'       
        option dest_ip 'fc00::/6'      
        option dest_port '546'         
        option family 'ipv6'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-MLD'        
        option src 'wan'               
        option proto 'icmp'            
        option src_ip 'fe80::/10'      
        list icmp_type '130/0'         
        list icmp_type '131/0'         
        list icmp_type '132/0'         
        list icmp_type '143/0'         
        option family 'ipv6'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-ICMPv6-Input'
        option src 'wan'                
        option proto 'icmp'             
        list icmp_type 'echo-request'   
        list icmp_type 'echo-reply'     
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        list icmp_type 'router-solicitation'    
        list icmp_type 'neighbour-solicitation' 
        list icmp_type 'router-advertisement'   
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-ICMPv6-Forward'      
        option src 'wan'                        
        option dest '*'                         
        option proto 'icmp'                     
        list icmp_type 'echo-request'           
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-IPSec-ESP'           
        option src 'wan'                        
        option dest 'lan'                       
        option proto 'esp'                      
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-ISAKMP'              
        option src 'wan'                        
        option dest 'lan'                       
        option dest_port '500'                  
        option proto 'udp'                      
        option target 'ACCEPT'                  
                                                
config include                                  
        option path '/etc/firewall.user'        
                                                
config zone                                     
        option name 'vpnclient'                 
        option network 'vpn'                    
        option input 'REJECT'                   
        option output 'ACCEPT'                  
        option forward 'REJECT'                 
        option masq '1'                         
        option mtu_fix '1'                      
                                                
config zone                                     
        option name 'lan2'                      
        option input 'REJECT'                   
        option forward 'REJECT'                 
        option output 'ACCEPT'                  
        option network 'lan2'                   
                                                
config forwarding                               
        option dest 'wan'                       
        option src 'lan'                                    
                                                
config forwarding                               
        option dest 'vpnclient'                 
        option src 'lan2'

PS1: For some reason DHCP on LAN2 isn't working, it's not a issue to me, but be aware of it in case you copy the configs.
PS2: I can't ping from one LAN to the other. Tried adding the forwarding rules without success.

[lleachii]

@dramm33

I added the following to Network > Firewall > Custom Rules

Please understand that this file is reloaded any time the firewall is.

This may not lead to major issues in your config, but may to others.

Glad you got it working!

[trendy]

@dramm33

PS2: I can't ping from one LAN to the other. Tried adding the forwarding rules without success.

I suggest adding them in the same firewall zone LAN.

@dramm33

PS1: For some reason DHCP on LAN2 isn't working, it's not a issue to me, but be aware of it in case you copy the configs.

Have you enabled it? Post also the /etc/config/dhcp

[dramm33]

@trendy

I suggest adding them in the same firewall zone LAN.

Network > Firewall > Zones

/etc/config/firewall (just the added forwardings)

config forwarding
	option dest 'lan'
	option src 'lan2'

config forwarding
	option dest 'lan2'
	option src 'lan'

@trendy

Have you enabled it? Post also the /etc/config/dhcp

Not sure what you mean by enabling it. Ignore interface on Network > Interfaces > LAN2 > DHCP Server is unchecked.

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'DCH-Arch'
	option dns '1'
	option mac 'XX:XX:XX:XX:6B:B4'
	option ip '192.168.1.3'

config domain
	option ip '192.168.1.3'
	option name 'desktop'

config host
	option name 'DMWC-Arch'
	option dns '1'
	option mac 'xx:xx:xx:xx:B9:F5'
	option ip '192.168.1.4'

config domain
	option ip '192.168.1.4'
	option name 'laptop'

config host
	option name 'OP2'
	option dns '1'
	option mac 'xx:xx:xx:xx:3E:F6'
	option ip '192.168.1.5'

config dhcp 'lan2'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'lan2'
	option ra 'server'
	option dhcpv6 'server'
	option ra_management '1'

[trendy]

@dramm33

Not sure what you mean by enabling it. Ignore interface on Network > Interfaces > LAN2 > DHCP Server is unchecked.

Still, you are rejecting INPUT from zone LAN2, so the DHCP packets from the hosts in LAN2 will never reach the router, as you don't specifically allow port 67.

I had a closer look in the rules you added. Since you want to have intra-LAN traffic, you must add a route for the other network in the new routing tables. Otherwise packets to the other LAN go to the internet gateway.

ip route add 192.168.10.0/24 dev br-lan2 table lan
ip route add 192.168.1.0/24 dev br-lan table vpn

[dramm33]

@trendy

ip route add 192.168.10.0/24 dev br-lan2 table lan
ip route add 192.168.1.0/24 dev br-lan table vpn

By adding these two rules I can ping between LANs!
Edit: I just notice that I got really weird ping timings

➜  ~ ping 192.168.10.172
PING 192.168.10.172 (192.168.10.172) 56(84) bytes of data.
64 bytes from 192.168.10.172: icmp_seq=1 ttl=63 time=4.01 ms
64 bytes from 192.168.10.172: icmp_seq=2 ttl=63 time=5.81 ms
64 bytes from 192.168.10.172: icmp_seq=3 ttl=63 time=3.44 ms
64 bytes from 192.168.10.172: icmp_seq=4 ttl=63 time=80.10 ms
64 bytes from 192.168.10.172: icmp_seq=5 ttl=63 time=105 ms
64 bytes from 192.168.10.172: icmp_seq=6 ttl=63 time=129 ms
64 bytes from 192.168.10.172: icmp_seq=7 ttl=63 time=153 ms
64 bytes from 192.168.10.172: icmp_seq=8 ttl=63 time=173 ms
64 bytes from 192.168.10.172: icmp_seq=9 ttl=63 time=196 ms
64 bytes from 192.168.10.172: icmp_seq=10 ttl=63 time=48.8 ms
64 bytes from 192.168.10.172: icmp_seq=11 ttl=63 time=41.2 ms
64 bytes from 192.168.10.172: icmp_seq=12 ttl=63 time=675 ms
64 bytes from 192.168.10.172: icmp_seq=13 ttl=63 time=5.50 ms
64 bytes from 192.168.10.172: icmp_seq=14 ttl=63 time=412 ms
64 bytes from 192.168.10.172: icmp_seq=15 ttl=63 time=950 ms
64 bytes from 192.168.10.172: icmp_seq=16 ttl=63 time=7.11 ms
^C
--- 192.168.10.172 ping statistics ---
16 packets transmitted, 16 received, 0% packet loss, time 31ms
rtt min/avg/max/mdev = 3.438/186.983/950.424/262.211 ms

That's way to much for just going to the router and back.
(I'm pinging from a cabled connection on LAN to my phone on LAN2 wifi)

By allowing INPUT and FORWARD in zone lan2 DCHP works, however I get a DNS leak.
I tried setting the VPN DNS in Network > Interfaces > LAN2 > Common Configuration > Use custom DNS servers and in Network > Interfaces > LAN2 > DHCP Server > Advanced Settings > DHCP-Options but I still get the leak.

Setting manual IP and rejecting INPUT/FORWARD in zone lan2 allows ping between LANs (because of those two routes) and I don't get leaks.
I'm just not sure there will be any undesired behaviours because of the reject (besides DCHP not working).

[vgaetera]

@dramm33

I get a DNS leak

https://openwrt.org/docs/guide-user/base-system/dhcp_configuration#upstream_dns_provider