In the above image I have both what I currently have as a home network and what I want as a home network. Being an amateur network admin and a first time openwrt user, my first question is does anybody see anything overtly wrong with my Rpi implementation? If not why cant I get it to work? (retorical)
I have setup the Rpi with a snapshot and configured the lan as per (zahradnik's how to. This setup works as I can access luci through the internal nic when pugged into the wrt1900 using the assigned static 192... ip. I have the wan, realtek gigabit dongle, configured simply as dhcp. It will pull an ip from my isps modem and from within the Rpi I can ping 8.8.8.8 as well as google.com. So that seams to be working.
Now with the wan connected to the modem and the lan connected directly to the lan of the wrt1900 I can ping, and traceroute openwrt from within luci on my wifi laptop but I can not get to http://google.com or cnn.com... This is not an optimal situation and I have not been able to find my flaw in design configuration or implementation. Any suggestions or examples would be greatly appreciated. If you want to see configurations just ask I'll be happy to provide.
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
{
"kernel": "5.4.91",
"hostname": "OpenWrt",
"model": "Raspberry Pi 4 Model B Rev 1.4",
"board_name": "raspberrypi,4-model-b",
"release": {
"distribution": "OpenWrt",
"version": "SNAPSHOT",
"revision": "r15596-297f82fc58",
"target": "bcm27xx/bcm2711",
"description": "OpenWrt SNAPSHOT r15596-297f82fc58"
}
}
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdb8:4dfb:e740::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0'
option proto 'static'
option ipaddr '192.168.1.20'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '192.168.1.25'
list dns '8.8.8.8'
config interface 'wan'
option proto 'dhcp'
option ifname 'eth1'
option hostname '*'
package dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option dynamicdhcp '0'
option ra_management '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
5: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 192.168.1.20/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
192.168.1.0/24 dev br-lan scope link src 192.168.1.20
broadcast 127.0.0.0 dev lo table local scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local scope link src 192.168.1.20
local 192.168.1.20 dev br-lan table local scope host src 192.168.1.20
broadcast 192.168.1.255 dev br-lan table local scope link src 192.168.1.20
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
lrwxrwxrwx 1 root root 16 Jan 24 09:56 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r-- 1 root root 47 Feb 9 09:03 /tmp/resolv.conf
-rw-r--r-- 1 root root 59 Feb 9 09:18 /tmp/resolv.conf.d/resolv.conf.auto
/tmp/resolv.conf.d:
-rw-r--r-- 1 root root 59 Feb 9 09:18 resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1
==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1
==> /tmp/resolv.conf.d <==
==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface lan
nameserver 192.168.1.25
nameserver 8.8.8.8
The Rpi is not live on the wan right now. I cant take the network down while the wife is working from home. One thing I noticed is that the lan appears to have dhcp running on it. I thought I had disabled dhcp. Apparently not. I guess I have to figure out how to actually do that.
I can get another reading probably this weekend when I can take the network down and put the wan on the modem.
I may be wrong, but it seems to me that the old AC1900 router needs to be reconfigured for this to work. It needs to become a bridge. If it is still configured as a router and is still serving IP addresses via DHCP, all stations connected to it are probably getting the wrong DNS server and default gateway addresses.
@cesarvog My intention was to use the Rpi as a router/gateway and keep the 1900 as the DHCP/wap. I wanted to move the 1900 to a central location in the house making it impractical to continue using it as the routing/gateway. Thus the Rpi. Thought I had disabled dhcp on the Rpi. When I was attempting to get it working I configured to 1900 to hand out the Rpi as the gateway.
Yes, that should work. Do the stations also get the address of the Rpi as the local DNS server? Otherwise, if they are still getting the AC1900 as the local DNS server and the 1900 itself also thinks it's the DNS server, then it will still try to go via it's WAN port which has no connection and that will obviously fail. I'm not trying to state the obvious here, as you seem to know what you are doing, but it's easy to get anxious to try the new setup and forget to change a few settings when multiple equipment is used. Been there, done that!
move the internet dns from the lan interface to the wan interface.
Other than that the configuration is fine. I presume the dhcp protocol on the wan interface is correct.
On 1900AC switch off dhcp server and connect upstream to the switch from a lan port. If you want to use the wan port of 1900, you'll have to bridge it somehow.
The local DNS still relies on the upstream in general, so when both local and public DNS are specified at the same time, the query result depends on timings and therefore is unpredictable.
It's working. I made DNS suggestions made and this time everything worked right off the bat. I think the primary problem was I fat fingered the gateway ip on the dd-wrt 1900 setup. Once I got the port forwarding on the Rpi setup everything worked beautifully. For now anyway. Thanks for everybody's help.
