PPPoE WAN (IPv4) --> NAT disabled --> LAN

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello all!

Here's another PPPoE question I cannot answer by myself.

This is my current setup:

ISP ONT (fully bridged) --> OpenWRT PPPoE WAN client (working OK) --> 172.168.0.1/24 LAN with NAT --> DMZ 172.168.0.2 DHCP --> OPNsense WAN --> 192.168.0.1/24 LAN with NAT

With this config, despite having double NAT, everything works fine, as I seted up DMZ with all traffic redirected to OPNsense.

Now, I'm trying to do it without NAT enabled in Openwrt main router, but i'm unable to find the correct static route to pass traffic from WAN lo LAN.

Here's my current config:

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdb6:667c:e307::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '172.16.0.1/12'

config device
        option type '8021q'
        option ifname 'wan'
        option vid '20'
        option name 'wan.20'

config interface 'wan'
        option device 'wan.20'
        option proto 'pppoe'
        option username 'xxxxx'
        option password 'xxxxx'
        option ipv6 'auto'
        option mtu '1508'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
        option disabled '1'
        option reqaddress 'try'
        option reqprefix 'auto'
        option mtu '1508'

config device
        option name 'eth0'
        option mtu '1600'

config device
        option name 'pppoe-wan'
        option mtu '1500'

config device
        option name 'wan'
        option mtu '1508'
        option mtu6 '1508'

/etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        option masq '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'
        option enabled '0'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
        option enabled '0'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'DMZ'
        option src 'wan'
        option dest_ip '172.16.0.2'
        list proto 'all'

config forwarding
        option src 'wan'
        option dest 'lan'

Can anybody help me setting the right static IPv4 route to make it woks?
Thank you!

2

why the double NAT ?

3

I suspect it is better to put opnsense on a pc to do nat and pppoe then use openwrt just as antenna, printserver and other intranet things besides quite normal wifi bridge.
Just in case post ubus call system board if your openwrt is ultrastrong or super weak, that mau change weights.

4

Because the second router is where I want it working (OPNsense).
I'm using Openwrt only as PPPoE connection to ISP.

5

Yes, OPNsense is a VM just doing all the hard work (NAT, IPS, firewalling, port forwarding...).

The OpenWRT is fast enough for bring up PPPoE link at ISP speeds (500/500), and is in fact faster than OPNsense doing this job.

I just need PPPoE stuff being done before OPNsense due to IPS (it cant inspect PPPoE traffic in search for intrusion prevention due OPNsese PPP implementation).

So, any idea on the static routes?

6

Just define them in luci/network/route

7

Yep, I know where, the thing I'm trying to deal with is, which route may I set to get this work without NAT?