Problems repeating guest network with WDS

MidnessX · October 7, 2020, 3:08pm

Hi, I have a router configured to provide a guest network as described in the wiki.
Everything works as it should and clients can reach websites while being isolated from the private LAN.

Recently, however, I had the need to extend the coverage of this network further, in a place I cannot reach with a cable. The only real option I have is extending it wirelessly.

I flashed a second router and proceeded to set up WDS, again following a guide. This is where I got stuck because the second router successfully connects to the wireless network as a WDS client, but is unable to talk to the main router.

I cannot ping the first router and clients of the second one cannot receive an IP address via DHCP.
I suspect the problem lies in the firewall configuration for the guest interface on the first router (I tried extending the main private nework and everything works just fine), but I can't think what could be wrong.

My network and firewall configuration is identical to that in the linked guide, so main router has a "guest" interface and IP 192.168.3.1. Only output is allowed for the "guest" zone in the firewall and a forwarding to the WAN is present. Two rules allow DHCP and DNS requests to reach the device.

Any help is welcome.

mpa · October 8, 2020, 11:06am

For testing, you could allow input from the guest zone in the firewall. However, disabling access to the router for guests is usually a good idea, so I suggest we look for a better solution.

Please post the contents of the following files from both devices:

/etc/config/network
/etc/config/wireless
/etc/config/dhcp
/etc/config/firewall

Use the </> tool to mark them as preformatted text, and remember to redact any secrets they contain.

Just to make sure I understand this right, you do not want to extend the LAN network to the second router, only the guest network?
How do you plan to manage the second router when you are connected to the main one?

MidnessX · October 8, 2020, 5:46pm

Main router

/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd30:9c26:53a5::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	list ipaddr '192.168.0.1/24'

config device 'lan_eth0_1_dev'
	option name 'eth0.1'
	option macaddr 'LAN_MAC'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'pppoe'
	option password 'ISP_PASS'
	option username 'ISP_USER'
	option ipv6 '0'
	list dns '127.0.0.1'
	option peerdns '0'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr 'WAN_MAC'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 2 3 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11g'
	option path 'pci0000:00/0000:00:01.0/0000:02:00.0'
	option htmode 'HT20'
	option country 'COUNTRY_CODE'
	option channel '1'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option key 'PRIVATE_PASS'
	option ssid 'PRIVATE_SSID'
	option encryption 'psk2'

config wifi-device 'radio1'
	option type 'mac80211'
	option channel '36'
	option hwmode '11a'
	option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
	option htmode 'VHT80'
	option country 'COUNTRY_CODE'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option key 'PRIVATE_PASS'
	option ssid 'PRIVATE_SSID'
	option encryption 'psk2'
	option disassoc_low_ack '0'

config wifi-iface 'wifinet2'
	option network 'guest'
	option ssid 'GUEST_SSID'
	option encryption 'psk2'
	option device 'radio0'
	option mode 'ap'
	option key 'GUEST_PASS'
	option wds '1'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option localservice '1'
	list server '8.8.8.8'
	list server '8.8.4.4'
	list server '1.1.1.1'
	option expandhosts '1'
	list rebind_domain 'plex.direct'
	list notinterface 'eth0.2'
	option confdir '/tmp/dnsmasq.d'
	option local '/MY_DOMAIN/'
	option domain 'MY_DOMAIN'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '6h'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config rule
	option src 'lan'
	option dest 'wan'
	option target 'REJECT'
	list proto 'all'
	option name 'Block-insecure-devices'
	list src_mac 'INSECURE_DEV_1_MAC'
	list src_mac 'INSECURE_DEV_2_MAC'
	list src_mac 'INSECURE_DEV_3_MAC'

config zone
	option network 'guest'
	option name 'guest'
	option output 'ACCEPT'
	option forward 'REJECT'
	option input 'REJECT'

config forwarding
	option dest 'wan'
	option src 'guest'

config rule
	option src_port '67-68'
	option src 'guest'
	option name 'Allow-guest-DHCP'
	option target 'ACCEPT'
	list proto 'udp'

config rule
	option dest_port '53'
	option src 'guest'
	option name 'Allow-guest-DNS'
	option target 'ACCEPT'

config redirect
[...]

Repeater router

/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd22:b056:3503::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option gateway '192.168.3.1'
	option stp '1'
	option ipaddr '192.168.3.2'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'
	option auto '0'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr 'WAN_MAC'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 6t'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11g'
	option path 'platform/10300000.wmac'
	option htmode 'HT20'
	option country 'COUNTRY_CODE'
	option channel 'auto'

config wifi-iface 'wifinet0'
	option ssid 'GUEST_SSID'
	option device 'radio0'
	option mode 'sta'
	option key 'GUEST_PASS'
	option wds '1'
	option network 'lan'
	option encryption 'psk2'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option localservice '1'
	list server '192.168.3.1'

config dhcp 'lan'
	option interface 'lan'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

Answering questions:

Just to make sure I understand this right, you do not want to extend the LAN network to the second router, only the guest network?

Correct, I am not interested in extending the main private network.

How do you plan to manage the second router when you are connected to the main one?

I was thinking about connecting to the guest wireless network when needed or bringing a laptop and an Ethernet cable to the second router. I don't think I will need to manage this second router too often.

For testing, you could allow input from the guest zone in the firewall

Unfortunately, nothing changed. A client connected via cable to the repeater is still unable to receive an IP through DHCP and any other connection both to the main router and the outside world fails.

mpa · October 8, 2020, 7:22pm

Please add

	option type 'bridge'

to the guest interface.

MidnessX · October 8, 2020, 8:37pm

It worked, thank you!
I am wondering how the guest network could work before, without the bridge option.

A side question: should I need to extend both networks wirelessly in the future, what would be the best option?

mpa · October 9, 2020, 9:34am

A routed AP works without the bridge option, but the option is needed when you are using WDS or bridging to wired ethernet. Log in with SSH and look at the bridge member interfaces. For each WDS client, an additional interface wlanX.staY is created and added to the bridge.

Update: some background information about WDS / 4-address mode

For a small number of networks like in your case (two), just duplicate the guest configuration for the LAN, which means you get two WDS links.

MidnessX · October 9, 2020, 10:51am

Thank you, you have been incredibly helpful!

system · October 19, 2020, 10:51am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.