Port forwarding with VLANs

Installing and Using OpenWrt Network and Wireless Configuration
1

I have been trying to set up openWRT on my FritzBox 7530 with 4 VLANs, 1 per port on the switch.
The intention is to have the device replace my router, and the VLANs are to isolate certain devices from the internet and other devices in the household.

There is no WAN port on the device, so I have setup an interface on one of the ports as PPPoE and associated it to the WAN firewall zone, however I may have made some mistakes here, or in the firewall configuration.
I have also read that VLAN 1 and 2 are used by the device in some way, so I have use other VIDs (5, 10, 15, 20).

I have things setup like so:

  • port 1 has VLAN 5 and is hooked up to my modem
    • firewall zone - wan
  • port 2 has VLAN 10 and is attached to another old router acting as a switch/AP, this is to act as my old router, providing internet to the household.
    • firewall zone - lan
  • port 3 has VLAN 15 and is attached to a ubuntu server where I am hosting various services (it's not so important for this to be isolated, but I was just trying to understand VLANs and firewalls)
    • firewall zone - server
  • port 4 has VLAN 20 and is attached to some IP cameras (these were the priority to isolate from the network)
    • firewall zone - cameras

I have set up a webserver on 192.168.15.10:80 and have setup what I believe to be the correct port forwarding rules to access from the internet, as I have had those same port forwarding rules working for a webserver hosted on 192.168.10.X.

The problem I am encountering is that I can get the port forwarding rules to work for the webserver on 192.168.15.10 only if I set the destination zone in the port forwarding rule to be the lan firewall zone (192.168.10.X), not the server firewall zone (192.168.15.X).
This is strange because I have made the firewall rules for both zones to be identical to see if it was a difference in their configuration, and I am lost as to what other configurations could be responsible for this.

I will post below the various config files I believe are related, let me know if I should include any more.

Any help is greatly appreciated, thanks!

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fde1:05f5:5815::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'


config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0t'
        option description 'Management'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '5'
        option ports '0t 1'
        option description 'WAN'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '10'
        option ports '0t 2'
        option description 'LAN'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option vid '15'
        option ports '0t 3'
        option description 'Server'

config switch_vlan
        option device 'switch0'
        option vlan '5'
        option ports '0t 4'
        option vid '20'
        option description 'Cameras'


config interface 'VLAN5'
        option device 'eth0.5'
        option proto 'pppoe'
        option username 'secret'
        option password 'secret'
        option ipv6 'auto'
        option peerdns '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config interface 'VLAN10'
        option proto 'static'
        option device 'eth0.10'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'

config interface 'VLAN15'
        option proto 'static'
        option device 'eth0.15'
        option ipaddr '192.168.15.1'
        option netmask '255.255.255.0'

config interface 'VLAN20'
        option proto 'static'
        option device 'eth0.20'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config device
        option name 'eth0.5'
        option type '8021q'
        option ifname 'eth0'
        option vid '5'

config device
        option name 'eth0.10'
        option type '8021q'
        option ifname 'eth0'
        option vid '10'

config device
        option name 'eth0.15'
        option type '8021q'
        option ifname 'eth0'
        option vid '15'

config device
        option name 'eth0.20'
        option type '8021q'
        option ifname 'eth0'
        option vid '20'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option name 'mgmt'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        list network 'VLAN5'
        option mtu_fix '1'

config zone
        option output 'ACCEPT'
        option name 'lan'
        option input 'ACCEPT'
        option forward 'ACCEPT'
        list network 'VLAN10'

config rule
        option name 'Allow-DHCP-Renew'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'
        option src 'wan'

config rule
        option name 'Allow-Ping'
        option proto 'icmp'
        option family 'ipv4'
        option target 'ACCEPT'
        list icmp_type 'echo-request'
        option src 'wan'

config rule
        option name 'Allow-IGMP'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option src 'wan'

config rule
        option name 'Allow-DHCPv6'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option src 'wan'

config rule
        option name 'Allow-MLD'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option src 'wan'

config rule
        option name 'Allow-ICMPv6-Input'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option src 'wan'

config rule
        option name 'Allow-ICMPv6-Forward'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option src 'wan'

config rule
        option name 'Allow-IPSec-ESP'
        option proto 'esp'
        option target 'ACCEPT'
        option dest 'mgmt'
        option src 'wan'

config rule
        option name 'Allow-ISAKMP'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option dest 'mgmt'
        option src 'wan'

config zone
        option name 'server'
        list network 'VLAN15'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'cameras'
        option input 'REJECT'
        option output 'REJECT'
        option forward 'REJECT'
        list network 'VLAN20'

config forwarding
        option src 'server'
        option dest 'cameras'

config forwarding
        option src 'lan'
        option dest 'server'

config forwarding
        option src 'lan'
        option dest 'wan'

config forwarding
        option src 'server'
        option dest 'wan'

config redirect
        option target 'DNAT'
        list proto 'tcp'
        option src 'wan'
        option src_dport '80'
        option dest_port '80'
        option name 'HTTP'
        option dest_ip '192.168.15.10'
        option dest 'server'

config rule
        option name 'Allow-DNS'
        option src 'server'
        option dest_port '53'
        option target 'ACCEPT'

config redirect
        option target 'DNAT'
        option name 'HTTPS'
        list proto 'tcp'
        option src 'wan'
        option src_dport '443'
        option dest_port '443'
        option dest_ip '192.168.15.10'
        option dest 'server'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'VLAN10'
        option interface 'VLAN10'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'VLAN15'
        option interface 'VLAN15'
        option start '100'
        option limit '150'
        option leasetime '12h'
2

Are you testing the port forward from the internet or from an internal zone?

3

I was testing it by trying to visit my public IP address from a machine inside the LAN zone (192.168.10.X).

I could test it instead using my mobile device not connected to the local network, would that make a difference?

4

A huge difference. The initial packet is expected from the wan zone, not the lan. What you achieved with changing the destination zone was to create a hairpin nat rule to allow access from that zone to the IP of the server using the public IP.

2 Likes
5

Thank you so much, I was going mad trying to figure out what I had done wrong.

I have tested it now and confirmed that the port forward works from my mobile not connected to the local wifi.

If I wanted to be able to access the machine by the external IP or domain name associated to that IP, would it be the configuration of the port forwarding that needs adjusting, specifically saying that it should also expect packets from the lan?
Or, as I have seen mentioned is a possibility somewhere, would it be wiser to set up a domain name that is for internal use only?

1 Like
6

For ipq40xx devices such as this, I'd always recommend to run a current master snapshot with dsa based switch drivers and configuration.

1 Like
7

I installed openWRT quite recently, taking what the website suggested was the most up to date version:
OpenWrt 22.03.3 r20028-43d71ad93e / LuCI openwrt-22.03 branch git-22.361.69894-438c598
Is that what you meant?
edit: as per this page https://openwrt.org/toh/avm/avm_fritz_box_7530

I have seen some videos about DSA, is that where you configure VLANs inside the network device's Bridge VLAN Filtering tab?

If so, when I looked into this I noticed that the 4 ports were not visible, and was under the assumption it hadn't properly been implemented for this device yet, but it's quite likely I'm just missing something!

image
image927×449 19 KB

8

Performance wise, it is advised to use internal IP or hostname.
If you insist on the wan IP or the ddns hostname, then you'd need to add a redirection rule pointing to the lan destination zone.

1 Like
9

Thanks again!

10

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.