OpenWrt can ping the Internet and lan, but lan cannot ping the internet

Installing and Using OpenWrt Network and Wireless Configuration
1

OpenWrt can ping the Internet and lan, but lan cannot ping the internet.
/etc/config/firewall:

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option flow_offloading '1'
	option flow_offloading_hw '1'
	option fullcone '2'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled 'false'

config include
	option path '/etc/firewall.user'

config include 'zerotier'
	option type 'script'
	option path '/etc/zerotier.start'
	option reload '1'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'any'
	option reload '1'

config rule 'linkease'
	option name 'linkease'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '8897'

config include 'adbyby'
	option type 'script'
	option path '/var/etc/adbyby.include'
	option reload '1'

config rule 'adblock'
	option name 'adblock'
	option target 'DROP'
	option src 'wan'
	option proto 'tcp'
	option dest_port '8118'

config include 'luci_app_ipsec_server'
	option type 'script'
	option path '/var/etc/ipsecvpn.include'
	option reload '1'

config include 'socat'
	option type 'script'
	option path '/var/etc/socat.include'
	option reload '1'

config include 'timecontrol'
	option type 'script'
	option path '/var/etc/timecontrol.include'
	option reload '1'

config include 'mia'
	option type 'script'
	option path '/etc/mia.include'
	option reload '1'

config include 'openclash'
	option type 'script'
	option path '/var/etc/openclash.include'
	option reload '1'

config rule 'openvpn'
	option name 'openvpn'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp udp'
	option dest_port '1194'

config zone 'vpn'
	option name 'vpn'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option masq '1'
	option network 'vpn0'

config forwarding 'vpntowan'
	option src 'vpn'
	option dest 'wan'

config forwarding 'vpntolan'
	option src 'vpn'
	option dest 'lan'

config forwarding 'lantovpn'
	option src 'lan'
	option dest 'vpn'

config include 'passwall'
	option type 'script'
	option path '/var/etc/passwall.include'
	option reload '1'

config include 'passwall_server'
	option type 'script'
	option path '/var/etc/passwall_server.include'
	option reload '1'

config include 'pptpd'
	option type 'script'
	option path '/etc/pptpd.include'
	option reload '1'

config rule 'pptp'
	option name 'pptp'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '1723'

config rule 'gre'
	option name 'gre'
	option target 'ACCEPT'
	option src 'wan'
	option proto '47'

config include 'softethervpn'
	option type 'script'
	option path '/usr/share/softethervpn/firewall.include'
	option reload '1'

config include 'shadowsocksr'
	option type 'script'
	option path '/var/etc/shadowsocksr.include'
	option reload '1'

config include 'unblockmusic'
	option type 'script'
	option path '/var/etc/unblockmusic.include'
	option reload '1'

config include 'v2ray_server'
	option type 'script'
	option path '/var/etc/v2ray_server.include'
	option reload '1'

config rule 'kms'
	option name 'kms'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '1688'

config include 'wrtbwmon'
	option type 'script'
	option path '/etc/wrtbwmon.include'
	option reload '1'

config zone 'ipsecserver'
	option name 'ipsecserver'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option network 'ipsec_server'

config zone 'docker'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option name 'docker'
	list network 'docker'

config include 'iptvhelper'
	option type 'script'
	option path '/etc/firewall.iptvhelper'
	option family 'any'
	option reload '1'

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.5.1'
	option netmask '255.255.255.0'
	option delegate '0'
	option ip6assign '64'
	option _orig_ifname 'eth0'
	option _orig_bridge 'true'
	option ifname 'eth0 eth2'

config interface 'wan'
	option ifname 'eth1'
	option _orig_ifname 'eth1'
	option _orig_bridge 'false'
	option proto 'pppoe'
	option username '*********'
	option password '*****'
	option ipv6 'auto'
	option keepalive '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option _orig_ifname 'eth1'
	option _orig_bridge 'false'
	option reqaddress 'try'
	option reqprefix 'auto'
	option ifname '@wan'

config interface 'vpn0'
	option ifname 'tun0'
	option proto 'none'

config interface 'ipsec_server'
	option ifname 'ipsec0'
	option device 'ipsec0'
	option proto 'static'
	option ipaddr '192.168.100.1'
	option netmask '255.255.255.0'

config interface 'docker'
	option ifname 'docker0'
	option proto 'none'
	option auto '0'

config device
	option type 'bridge'
	option name 'docker0'

I reinstalled several times but it didn't work.

2

These aren't the default settings, so I guess you did not only reinstall ?

1 Like
3

yeah, i changed some settings. but after i changed the partition (maybe the reason). i could not visit the internet anymore. The firmware was compiled by someone else.

4

then you need to ask someone else for assistance.

1 Like
5

you mean that i need to asked the one who compiled it for help?

6

yes, that's correct.

1 Like