Ping my router from wan side not working

Installing and Using OpenWrt
1

Hi folks!

Beginner question just for interest....my device is behind my ISP router connected to its lan port (192.168.0.1). I connect a client to the isp lan ports and try to ping the OpenWrt device (192.168.1.1)
Ping is not working, but I guess it should? Pinging the wan interface (192.168.0.171) is fine.

Here are my firewall settings:

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan'
	option log '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'
	option enabled '0'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src 'lan'
	option dest 'wan'
	option target 'DROP'
	option src_port '623 664 5900 16992-16995'
	option name 'IntelME'
	list proto 'tcp'
	list proto 'udp'
	list proto 'icmp'
	list proto 'igmp'
	list proto 'esp'

config rule
	option dest_port '53'
	option src 'lan'
	option name 'DNS'
	option dest 'wan'
	option target 'ACCEPT'
	option family 'ipv4'
	option enabled '0'

config rule
	option dest_port '80 443'
	option src 'lan'
	option name 'HTTP, HTTPS'
	option dest 'wan'
	option target 'ACCEPT'
	list proto 'tcp'
	option family 'ipv4'

config rule
	option dest_port '465 993'
	option src 'lan'
	option name 'IMAPS, SMTP'
	option dest 'wan'
	option target 'ACCEPT'
	list proto 'tcp'
	option family 'ipv4'

config rule
	option dest_port '123'
	option src 'lan'
	option name 'NTP'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest 'wan'
	list proto 'udp'

config rule
	option dest_port '21'
	option src 'lan'
	option name 'FTP'
	option family 'ipv4'
	option target 'ACCEPT'
	option dest 'wan'
	list proto 'tcp'
	option enabled '0'

config rule
	option dest_port '5001'
	option src 'lan'
	option name 'iperf'
	option dest 'wan'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Block all'
	option target 'REJECT'
	option dest 'wan'
	option src 'lan'
	list proto 'all'
2

The ISP router has to be configured to route traffic with a 192.168.1.x address through the OpenWrt router. Then, the OpenWrt router must be configured to enable traffic to enter through the WAN interface, and forward it to the LAN interface.

Are you sure you want a double-NAT setup? Perhaps you would rather configure it as a dumb access point?

3

I start with the easy one:

yes :slight_smile:

Sorry, I have very little network knowledge....you mean the ISP router doesn't know what to do because it doesn't "see" the 192.168.1.1 network? So with the standard settings I doesn't work, but why I have the "allow-ping" rule on OpenWrt firewall?

Edit: You mean I have to "tell" my ISP router to route all traffic with 192.168.1.x to the OpenWrt wan (that input is allowed because of the "Allow-Ping" rule) and the OpenWrt device routes the echo back to wan and therefore back to the "pinging" client, correct?

4

The ISP router sees only the wan interface of your Openwrt router, which is correct. The lan 192.168.1.1 interface is not visible because of network address translation (NAT). The translation happens inside the kernel of Openwrt router and it is not visible. The router interface should be accessible from lan only (ideal case). When pinging the router from outside, the ping to the wan port is the right way to check the node is up.

2 Likes
5

Thank you @kukulo , it's clear now!

6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.