Hi,
I actually wanted to forward my PTP packets which are getting receieved in the WAN port to the LAN which are configured in bridge mode. Please let me know, to forward PTP packets do we need to configure any setting in the network file
This PTP you are refering is Precision Time Protocol ?
No, it is the Point to Point Protocol. I thought it was a typo from you. Do you really mean the precision time protocol?
Is lan bridged with wan? Then you don't need anything. If lan is separate from wan, then add a port forwarding rule.
in our case LAN is bridged with WAN. But am able to see the PTP packets in the LAN port. But the same am not able to see in the WAN port.
How to add a port forwarding rule.?
Port forwarding has no effect when lan and wan are bridged.
Show us a capture of the packets you see in lan interface and you don't see on wan interface.
Also,
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru
Is Precision Time Protocol supported or do we need to add any firewall setting to support PTP ?
I don't see why not. Please post the command output I asked you earlier if you need to get some help.
root@OpenWrt:/# uci export network
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'auto'
config switch
option name 'switch0'
config interface 'lan'
option ifname 'eth1'
option force_link '1'
option proto 'dhcp'
option ip6assign '60'
option multicast_querier '0'
option igmp_snooping '0'
root@OpenWrt:/# uci export dhcp
package dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option localservice '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option force '1'
option dhcpv6 'server'
option ra 'server'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
root@OpenWrt:/# uci export firewall
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option disabled '0'
config zone
option name 'lan'
list network 'lan lan1 lan2 lan3'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config forwarding
option src 'wan'
option dest 'lan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'all'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'all'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'all'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'all'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'all'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest 'lan'
option proto 'all'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'any'
option limit '1000/sec'
option family 'any'
option target 'ACCEPT'
config rule
option name 'Allow-PTP'
option src 'wan'
option dest 'lan'
option dest_mac '01:80:C2:00:00:0E'
option proto 'all'
option family 'any'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include 'map'
option type 'script'
option path '/etc/firewall.d/map_firewall'
option family 'any'
option reload '1'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'any'
option reload '1'
root@OpenWrt:/# head -n -0 /etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
root@OpenWrt:/#
root@OpenWrt:/#
root@OpenWrt:/#
root@OpenWrt:/# ip -4 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
root@OpenWrt:/# ip -6 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 fe80::211:22ff:fe33:4456/64 scope link
valid_lft forever preferred_lft forever
18: ath0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP
inet6 fe80::203:7fff:fe12:5050/64 scope link
valid_lft forever preferred_lft forever
19: ath1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP
inet6 fe80::203:7fff:fe12:8585/64 scope link
valid_lft forever preferred_lft forever
root@OpenWrt:/# ip -4 ro li tab all
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
root@OpenWrt:/# ip -6 ro li tab all
unreachable default dev lo table unspec proto kernel metric 4294967295 error -101
fe80::/64 dev eth1 proto kernel metric 256
fe80::/64 dev ath0 proto kernel metric 256
fe80::/64 dev ath1 proto kernel metric 256
unreachable default dev lo table unspec proto kernel metric 4294967295 error -101
local ::1 dev lo table local proto none metric 0
local fe80:: dev lo table local proto none metric 0
local fe80:: dev lo table local proto none metric 0
local fe80:: dev lo table local proto none metric 0
local fe80::203:7fff:fe12:5050 dev lo table local proto none metric 0
local fe80::203:7fff:fe12:8585 dev lo table local proto none metric 0
local fe80::211:22ff:fe33:4456 dev lo table local proto none metric 0
ff00::/8 dev eth1 table local metric 256
ff00::/8 dev ath0 table local metric 256
ff00::/8 dev ath1 table local metric 256
unreachable default dev lo table unspec proto kernel metric 4294967295 error -101
root@OpenWrt:/# ip -4 ru
0: from all lookup 128
1: from all lookup local
32766: from all lookup main
32767: from all lookup default
root@OpenWrt:/# ip -6 ru
0: from all lookup 128
1: from all lookup local
32766: from all lookup main
You missed this one.
I see only one interface there which doesn't have any IP, not sure where is the bridge.
lan interface is configured as dhcp client and you are also running a dhcp server on the same interface.
this is not the proper syntax for list network. Should be:
list network 'lan'
list network 'lan1'
...
root@OpenWrt:/# ubus call system board
{
"kernel": "4.4.60",
"hostname": "OpenWrt",
"system": "ARMv7 Processor rev 4 (v7l)",
"model": "Qualcomm Technologies, Inc. IPQ5018\/AP-MP03.3",
"release": {
"distribution": "OpenWrt",
"version": "Chaos Calmer",
"revision": "eea552a14b76+r49254",
"codename": "chaos_calmer",
"target": "ipq\/ipq50xx",
"description": "OpenWrt Chaos Calmer 15.05.1"
}
}
root@OpenWrt:/# uci export network
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'auto'
config switch
option name 'switch0'
config interface 'lan'
option ifname 'eth1 eth0'
option force_link '1'
option type 'bridge'
option proto 'dhcp'
option ip6assign '60'
option multicast_querier '0'
option igmp_snooping '0'
root@OpenWrt:/# uci export dhcp
package dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option localservice '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option force '1'
option dhcpv6 'disabled'
option ra 'disabled'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
root@OpenWrt:/# uci export firewall
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option disabled '0'
config zone
option name 'lan'
list network 'lan'
list network 'lan1'
list network 'lan2'
list network 'lan3'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config forwarding
option src 'wan'
option dest 'lan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'all'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'all'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'all'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'all'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'all'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest 'lan'
option proto 'all'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'any'
option limit '1000/sec'
option family 'any'
option target 'ACCEPT'
config rule
option name 'Allow-PTP'
option src 'wan'
option dest 'lan'
option dest_mac '01:80:C2:00:00:0E'
option proto 'all'
option family 'any'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include 'map'
option type 'script'
option path '/etc/firewall.d/map_firewall'
option family 'any'
option reload '1'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'any'
option reload '1'
Very old and unsupported version. It is unlikely that anyone will be able to reproduce your issue.
Please upgrade to the current stable first.
since our vendor only support this version of openwrt we are using the same. Please let us know any idea whether the firewall setting we need to twick for getting the PTP packets ?
Let me just point out that you have disabled the IPv6 RA and DHCP6, but DHCPv4 is still operating in the lan interface. And since there is a bridge between the eth0 and eth1 there is no firewall applied there, unless you manually installed and run ebtables.
IPV6 i dont want it as server so i have disabled it in dhcp file. this is proper ?
Yes, it is.