OpenWrt Guest Wireless with AdGuardHome DNS?

FrankWard · September 11, 2022, 4:33am

I've got my R7800 enabled with two guest WIFI networks on 2.4 and 5ghz. They are using the subnet 192.168.3.1 while my main network uses 192.168.1.1. I use OpenWRT for DHCP on each interface and use AdGuardHome on 192.168.1.1:8080 for DNS. My guest networks get addresses from DHCP fine, but the clients do not get DNS. If I input DNS manually as 192.168.1.1 they still cannot connect to the internet. Setting them manually to 8.8.8.8 allows them to connect. I've tried setting "custom DNS" but they still don't populate DNS via DHCP. What could I be missing to give these guest networks DNS access to my AdGuardHome setup?

R7800 w/latest Hnyman build

Wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
	option band '5g'
	option country 'US'
	option cell_density '0'
	option channel '153'
	option htmode 'VHT80'
	option disabled '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'wifi5'
	option network 'lan wan'
	option encryption 'psk2'
	option key 'password'
	option hidden '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
	option band '2g'
	option htmode 'HT20'
	option channel '11'
	option cell_density '0'
	option country 'US'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option mode 'ap'
	option ssid 'wifi2'
	option encryption 'psk2'
	option key 'password'
	option network 'lan wan'
	option hidden '1'
	option wps_pushbutton '1'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option encryption 'psk2'
	option ssid 'guest5'
	option network 'Guest'
	option isolate '1'
	option key 'password'
	option hidden '1'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'guest2'
	option encryption 'psk2'
	option key 'password'
	option isolate '1'
	option network 'Guest'
	option hidden '1'

config guest 'network'

Network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd61:4904:dcb1::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1.1'
	option ipv6 '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'
	option type 'bridge'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'

config device 'guest_dev'
	option type 'bridge'
	option name 'br-guest'
	option ipv6 '0'

config static 'proto'

config br-guest 'device'

config 192.168.3.1 'ipaddr'

config 255.255.255.0 'netmask'

config interface 'Guest'
	option proto 'static'
	option device 'br-guest'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'
	option type 'bridge'

Firewall

config rule
	option name '[IPv6] [ANY] to [DEVICE] - ALL - DROP'
	option family 'ipv6'
	option src '*'
	list proto 'all'
	option target 'DROP'

config rule
	option name '[IPv6] [ANY] to [ANY] - ALL - DROP'
	option family 'ipv6'
	option src '*'
	option dest '*'
	list proto 'all'
	option target 'DROP'

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'lan'
	option forward 'REJECT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled '0'

config include
	option path '/etc/firewall.user'

config include 'miniupnpd'
	option type 'script'
	option path '/usr/share/miniupnpd/firewall.include'
	option family 'any'
	option reload '1'

config include 'bcp38'
	option type 'script'
	option path '/usr/lib/bcp38/run.sh'
	option family 'IPv4'
	option reload '1'

config zone
	option name 'guest'
	option output 'ACCEPT'
	list network 'Guest'
	option input 'REJECT'
	option forward 'REJECT'

config rule
	option name 'Guest-DHCP'
	list proto 'udp'
	option src 'guest'
	option target 'ACCEPT'
	option family 'ipv4'
	option dest_port '67-68'

config rule
	option name 'Guest-DNS'
	option src 'guest'
	option target 'ACCEPT'
	option dest_port '53'
	list proto 'tcp'
	list proto 'udp'
	option family 'ipv4'

config forwarding
	option src 'guest'
	option dest 'wan'

Barney · September 11, 2022, 7:04pm

Please post the content of the following files:

/etc/config/network
/etc/config/wireless
/etc/config/firewall

FrankWard · September 11, 2022, 7:09pm

I just noticed this in the log. As per the guide, the guest network is isolated from the LAN, so would this prevent it from communicating with the AdGuard server running on 192.168.1.1?

daemon.err odhcpd[20807]: Failed to send to ff02::1%lan@br-lan (Network unreachable)

I'll post logs in a bit.

Barney · September 11, 2022, 7:21pm

Yes.

You must create a firewall rule to give the clients in your guest network access to the DNS (AdGuard) in your lan zone:

config rule
        option name 'GUEST-DNS'
        option src 'guest'
        option target 'ACCEPT'
        list proto 'tcp'
        list proto 'udp'
        option dest_port '53'

FrankWard · September 11, 2022, 7:29pm

I've had that rule in place since the start. I belive it's part of the guide. It has no problem issuing DHCP addresses to the client, but they aren't getting the DNS servers along with it, so I never have internet access unless I set them manually on the device. I'm trying to figure out why it isn't populating the DNS server via DHCP.

Also.. if I populate DNS as 192.168.1.1 manually on the client it can communicate and I can see enrtries being blocked in AdGuardHome from the client IP (192.168.3.xxx). So it's able to communicate with the router and DNS server. It's just not populating the DNS when it fetches DHCP.

Barney · September 11, 2022, 7:45pm

Please post the necessary information.

FrankWard · September 11, 2022, 7:47pm

Added it to the first post. Thanks! This issue was resolved in a different thread.

system · September 21, 2022, 7:47pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.