Physical port no DHCP when added to bridge

Today I was testing with separating one of my physical ports and all worked well.

My problems started when I created a bridge (br-isolated). Now the physical port does not get an IP address anymore. Funny enough, the wireless network attached to the bridge works as expected. At this point I am a bit lost.

So my question is, why does my setup work if eth1.2 is added directly to the interface, but not when added to the bridge?

Full network config, relevant part for isolated bridge at the bottom:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd6b:0cc3:89a6::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1.1'
        option promisc '1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.0.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list dns '8.8.8.8'
        list dns '8.8.4.4'

config interface 'wan'
        option device 'eth0.32'
        option proto 'pppoe'
        option username ''
        option password ''
        option ipv6 '0'
        option peerdns '0'
        list dns '8.8.8.8'
        list dns '8.8.4.4'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 4 3 2'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '32'
        option ports '0t 5t'
        option vid '32'
        option description 'internet'

config interface 'isolated'
        option proto 'static'
        option device 'br-isolated'
        option ipaddr '192.168.99.1'
        option netmask '255.255.255.0'
        option type 'bridge'

config device
        option type 'bridge'
        option name 'br-isolated'
        list ports 'eth1.2'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 1'
        option vid '2'
        option description 'isolated'

Firewall config:

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        list network 'wan'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'nss_ecm'
        option type 'script'
        option path '/etc/firewall.d/qca-nss-ecm'
        option family 'any'
        option reload '1'

config rule
        option name 'Allow-https-nuc'
        list proto 'tcp'
        option src 'wan'
        option dest 'lan'
        list dest_ip '192.168.0.214'
        option dest_port '443'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Https to NUC'
        option family 'ipv4'
        list proto 'tcp'
        option src 'wan'
        option src_dport '443'
        option dest_ip '192.168.0.214'
        option dest_port '443'

config zone
        option name 'isolated'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'isolated'

config forwarding
        option src 'isolated'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Isolated'
        option src 'isolated'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '67-68'
        option family 'ipv4'

config rule
        option name 'Allow-DNS-Isolated'
        option src 'isolated'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53'
        option family 'ipv4'

config rule
        option name 'Block-Web-Access-Isolated'
        option src 'isolated'
        option dest_port '80-4430'
        option proto 'tcp'
        option target 'REJECT'
        list dest_ip '192.168.99.1'

config forwarding
        option src 'lan'
        option dest 'isolated'

And for good measure the dhcp config:

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'isolated'
        option interface 'isolated'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

        option path '/etc/firewall.d/qca-nss-ecm'

please post to nss thread or repeat with normal OpenWRT.

Remove the bridge line below (that will break the interface):

2 Likes

Thanks again for your help! This instantly solved my problem :smile:

Kinda new to NSS, only recently got a build from @ACwifidude to get my R7800 router up to Gigabit speed.

Out of curiosity, what makes NSSbuilds so different that the issues should be debugged with normal builds?

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.