OpenWrt-DHCP not giving out IP address for vlan

Installing and Using OpenWrt Network and Wireless Configuration
1

I notice on my Proxmox and its VMs that I have been having to manly input IP addresses for the systems. Plus notice a few other problems like trying to forward port 80/443 not working. Along with not being able to update Ubuntu VM. After going into Openwrt -> Firewall and turning the "input" to accept for "servers->wan", my problems seem to have gone away. But I understand this is bad practice to have this enable.

So I like to see if maybe someone could guild me on setting up Traffic Rules.

I am guessing that when I tried to setup DNS and DHCP for vlan 30 that I messed up somewhere.

Vlan 20 is meant for home
Vlan 30 is meant for anything that directly connected to the internet (?)
As in website/game servers and other random things.

Network diagram below.

cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config forwarding
        option src 'Servers'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'Servers'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'vlan20'

config zone
        option name 'Servers'
        list network 'vlan30'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option input 'ACCEPT'

config rule
        option name 'Allow-DHCP'
        list proto 'udp'
        option src 'Servers'
        option dest_port '68'
        option target 'ACCEPT'

config rule
        option name 'allow-DNS'
        list proto 'udp'
        option src 'Servers'
        option dest_port '53'
        option target 'ACCEPT'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'vlan20'
        option interface 'vlan20'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

config dhcp 'vlan30'
        option interface 'vlan30'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

config host
        option name 'truenas'
        option ip 'xxxxxxxxx'
        option mac 'xxxxxxxxxx'

config host
        option name 'truenas'
        option duid '0001000125DD1083B42E9931F471'
        option mac 'xxxxxxxx'

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxxxxx'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config device
        option name 'lan1'
        option macaddr 'xxxxxxxxxxxx'

config device
        option name 'lan2'
        option macaddr 'xxxxx'

config device
        option name 'lan3'
        option macaddr 'xxxxxxxx'

config device
        option name 'lan4'
        option macaddr 'xxxxxxx'

config interface 'lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option device 'br-lan.1'

config device
        option name 'wan'
        option macaddr 'xxxxxxxxxxx'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan4:u*'

config interface 'vlan20'
        option device 'br-lan.20'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan3:u*'

config interface 'vlan30'
        option device 'br-lan.30'
        option proto 'static'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'

Capttesture
Capttesture1436×743 124 KB

2

The DHCP problem is caused by a misconfigured destination port in the Allow-DHCP rule - it must be 67.

Тhe rest of the problems you had before changing the default policy for the input chain to accept may have been caused by errors in the static IP configuration.

2 Likes
3

wanted to say thank you for the reply sorry this is late coming, the port 67 was correct that you said, I also had a problem after doing some more digging as it still wasn't working. I found out from setting up, that I had the destination zone messed up. It wasn't pointing to the router.

Was looking wikid page seeing how guest network was setup, figure it had to be somewhat the same at that point.

Source zone is the network vlan
Destination zone is the router(device)

4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.