Relayd forward dhcp on MediaTek MT7628

Noneangel · October 2, 2020, 5:17pm

Hello,

I try to configure a MT7628 MediaTek router to get the following setup:
config
The MediaTek router must extend my wifi, and provide wired connection to a device.
I tried to create a relay bridge between the two routers following this relayd guide.
I get internet on devices connected to the MediaTek router that have a static ip, but I can't get an ip from the ips router dhcp server through the MediaTek router. I found this thread where some users found-out that the dhcp request were not correctly forwarder by the MT7628 rooter.

I tired to apply the workaround (see previous link), but without success. I don't know how to debug the problem (user from the previous thread use tcpdump, but I don't know what is expected nor in case of success nor in case of failure).

Could someone provide me some help to setup the bridge for dhcp for ipv4 ?

My config is the following:

# cat /etc/config/dhcp
config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option dhcpv6 'server'
        option ra 'server'
        option ignore '1'
        option ra_management '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config relay
        option interface 'wwan'
        option local_addr '192.168.2.1' # lan interface address
        option server_addr '192.168.1.1' # the actual dhcp server address (isp router)

# cat /etc/config/network
config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'aMACadress::/48'

config interface 'lan'
        option ifname 'eth0.1'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.2.1'
        option gateway '192.168.1.1'
        option type 'bridge'
        option delegate '0'
        list dns '192.168.1.1'

config device 'lan_dev'
        option name 'eth0.1'
        option macaddr 'aMACadress'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config device 'wan_dev'
        option name 'eth0.2'
        option macaddr 'aMACadress'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6t'

config interface 'wwan'
        option proto 'dhcp'
        option delegate '0'

config interface 'repeater_bridge'
        option proto 'relay'
        option ipaddr '192.168.1.2'
        list network 'lan'
        list network 'wwan'
        option forward_dhcp '0'

# cat /etc/config/wireless
config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11g'
        option path 'platform/10180000.wmac'
        option htmode 'HT20'
        option disabled '0'
        option country 'FR'
        option channel 'auto'

config wifi-iface 'default_radio0'
        option network 'lan'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ap-MediaTek'
        option encryption 'psk-mixed'
        option key 'password'

config wifi-iface 'wifinet0'
        option network 'wwan'
        option ssid 'ap-ips'
        option encryption 'psk2'
        option device 'radio0'
        option mode 'sta'
        option bssid 'aMACadress'
        option key 'password'

# cat /etc/config/firewall
config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan repeater_bridge wwan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config forwarding
        option dest 'lan'
        option src 'wan'

The ip range of my isp network is 192.168.1.0/24
The ip of my ips network is 192.168.1.1

anon4457646 · October 2, 2020, 5:54pm

etc/config/network.

config interface 'wwan'
	option proto 'static'
	option ipaddr '192.168.1.2'
	option netmask '255.255.255.0'
	option gateway '192.168.1.1'
	list dns '192.168.1.1'

config interface 'repeter'
	option proto 'relay'
	list network 'lan'
	list network 'wwan'
	option ipaddr '192.168.1.2'

`
`
``

etc/config/firewall change that

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan wwan repeter'                                                                        

etc/config/dhcp 

`config dhcp 'lan'
	option interface 'lan'
	option ignore '1'``

make sure wwan is the network assigned at your wificlient, and also make sure wwan firewall is on lan zone

Noneangel · October 2, 2020, 7:34pm

Thank you for looking into my problem.

Unfortunately, the outcome is the same (no IP address affected to device connected to the MT7628 router).
Just to be sure that I did follow (and understand) your instructions correctly (I did apply every one of them even if I say that I don't understand some of them):

In /etc/config/network
I changed the protocol form dhcp to a static address. I understand this instruction (I had fixed this ip in the isp router, but it is better that way).
Then, I renamed the interface repeater_bridge by repeter. I don't understand why. And I re-enable the forward_dhcp (the one that was disabled by this previously mentioned workaround). I don't get why the forward_dhcp is re-enabled again as it doesn't work on MT7628 and that I try to make dnsmasq to forward the dhcp.
In /etc/config/firewall, in zone named lan, I rename the interface from repeater_bridge to repeter to match the renaming in /etc/config/network. Also, the repeter goes to the end of the list (maybe the order of network do mater ?)
In /etc/config/dhcp on lan, I removed every option execpt the one that disable the dhcp server. It was already disabled.

make sure wwan is the network assigned at your wificlient

I believe that this information is found on /etc/config/wireless

config wifi-iface 'wifinet0'
        option network 'wwan'
        option ssid 'ap-ips'
        option encryption 'psk2'
        option device 'radio0'
        option mode 'sta' # this is the wifi client, connecting to my isp router
        option bssid 'aMACadress'
        option key 'password'

make sure wwan firewall is on lan zone

I believe that this information is found on /etc/config/firewall, in the part you ask me to modified: option network 'lan wwan repeter'

Just to be sure, I also tried with the firewall disabled with the command /etc/init.d/firewall stop, but same result.

anon4457646 · October 2, 2020, 7:44pm

sorry if that is not working, but that is working for me on mwlwifi, hard to make it working on that driver, i'm sure if you ll play a bit that will work.