Routing for Cascaded Routers

jeremytourville1 · July 5, 2024, 5:05pm

Hello, I have been struggling to get my network setup. I have read the docs: OpenWRT Routing

I have included a basic drawing here.

Here are my configs for router one and two:

R1

root@Tourville:/etc/config# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdaf:ec80:c7fe::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'

config device
        option name 'lan1'
        option macaddr 'e8:9f:80:a3:ef:e2'

config device
        option name 'lan2'
        option macaddr 'e8:9f:80:a3:ef:e2'

config device
        option name 'lan3'
        option macaddr 'e8:9f:80:a3:ef:e2'

config device
        option name 'lan4'
        option macaddr 'e8:9f:80:a3:ef:e2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'wan'
        option macaddr 'e8:9f:80:a3:ef:e1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br-voip'
        list ports 'lan3'
        list ports 'lan4'
        option mtu '1500'
        option macaddr 'E8:9F:80:A3:EF:E2'

config interface 'VOIP'
        option proto 'static'
        option device 'br-voip'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config device
        option name 'phy1-ap0'

config device
        option type 'bridge'
        option name 'br-dmz'
        list ports 'lan1'

config interface 'DMZ'
        option proto 'static'
        option device 'lan1'
        option ipaddr '192.168.50.2'
        option netmask '255.255.255.252'

config route
        option interface 'DMZ'
        option target '172.30.50.0/24'
        option gateway '192.168.50.1'

root@Tourville:/etc/config# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'VOIP'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'dmz'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'DMZ'

config forwarding
        option src 'dmz'
        option dest 'wan'

config redirect
        option dest 'dmz'
        option target 'DNAT'
        option name 'CyberRangeHTTP'
        option src 'wan'
        option src_dport '80'
        option dest_ip '172.30.50.230'
        option dest_port '80'

config redirect
        option dest 'dmz'
        option target 'DNAT'
        option name 'CyberRangeHTTPS'
        option src 'wan'
        option dest_ip '172.30.50.230'
        option src_dport '443'
        option dest_port '443'

config rule
        option src 'wan'
        list dest_ip '172.30.50.230'
        option target 'ACCEPT'
        option name 'CyberRange'

R2

root@RangeRouter:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd99:834f:8541::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '172.30.50.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '50:6A:03:C7:8D:A5'

config interface 'wan'
        option device 'wan'
        option proto 'static'
        option ipaddr '192.168.50.1'
        option netmask '255.255.255.252'
        option gateway '192.168.50.2'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'storage'
        option proto 'static'
        option device 'lan3'
        option ipaddr '172.30.51.1'
        option netmask '255.255.255.252'

root@RangeRouter:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'storage'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'CyberRangeHTTP'
        option src 'wan'
        list dest_ip '172.30.50.230'
        option dest_port '80'
        option target 'ACCEPT'
        option dest '*'

config rule
        option name 'CyberRangeHTTPS'
        option src 'wan'
        list dest_ip '172.30.50.230'
        option dest_port '443'
        option target 'ACCEPT'
        option dest '*'

config forwarding
        option src 'wan'
        option dest 'lan'

I have done the following troubleshooting:
#1 From R1 I ran network>diagnostics

PING 172.30.50.230 (172.30.50.230): 56 data bytes
64 bytes from 172.30.50.230: seq=0 ttl=63 time=0.727 ms
64 bytes from 172.30.50.230: seq=1 ttl=63 time=0.585 ms
64 bytes from 172.30.50.230: seq=2 ttl=63 time=0.543 ms
64 bytes from 172.30.50.230: seq=3 ttl=63 time=0.550 ms
64 bytes from 172.30.50.230: seq=4 ttl=63 time=0.553 ms

--- 172.30.50.230 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 0.543/0.591/0.727 ms

traceroute to 172.30.50.230 (172.30.50.230), 20 hops max, 46 byte packets
 1  192.168.50.1  0.354 ms
 2  172.30.50.230  0.501 ms !A

#2 From R2 I can ping my ISP GW 24.96.23.1
#3 I also confirmed I can run a traceroute to my external IP on R1

Can anyone assist and tell me what I have wrong? I think I have some of it correct but not enough to pass web traffic to my desired destination.

psherman · July 5, 2024, 5:22pm

I haven't read through your configs in detail, but I already see some problems with the network configs -- you've got DSA devices but you've setup multiple bridges. They should be a single bridge and then bridge-VLANs to separate the ports as desired.

Meanwhile, is there a reason you want to run the cascaded routers? All of your routing needs can be handled in a single router (R1) unless there are other considerations (could be for the academic part about learning how to do this cascaded routing method, for example).

psherman · July 5, 2024, 5:40pm

I've read through some more of your config, and R2 is certainly not going to work because you have the same subnet on lan and wan. Further, the route you added in R1 is not doing anything useful.

So let's start by understanding why you want to have a second router and cascaded routing, then we'll sort out the specifics about making it work.

anon63541380 · July 5, 2024, 5:40pm

Normal overall architecture would be to create backbone with all subnets as tagged VLAN-s, then untag them (or add subset of tags) to physical end devices.

jeremytourville1 · July 7, 2024, 11:39pm

Couple of things:
#1 Router R1 has my vlan for VOIP, lan and DMZ and I am out of ports. I would have to get pretty fancy with vlan tagging to make everything work on a single router.
#2 R2 was used previously on another ISP and I have a copy of all my configs for my Cyber Range stuff there. (Though, my present config doesn't show it I have the backups that I was going to apply later to the VM vlans and Storage vlans.

And yes, learning how to do this is part of what I am wanting to do.

I see the issue. There is a typo in my drawing. The DMZ subnet should say 192.168.50.0/30. Sorry about that
I was following the example. I noted that in the example that lan and wan are in the same subnet for the WAN and R2 routers.
Routing example: IPv4 (https://openwrt.org/docs/guide-user/network/routing/examples/routing_in_ipv4)

As a side note I discussed my setup with my co-worker who is a Cisco Network Engineer. He shared with me the following principles based on the drawing:
#1 Create a route statement on R1
#2 Create a DNAT rule on R1 from Internet/WAN to host on R2
#3 Create a Firewall ACL/Rule on R1 to allow traffic from internet to host on R2
#4 Create a similar rule as #3 on R2

He is familiar with the OpenWRT project but is more of a pfSense user personally. It was simply a conversation he and I had to try and understand some basic principles a little better. I appreciate the assistance of everyone in this community and ultimately will go with the guidance you provide.

you've setup multiple bridges. They should be a single bridge and then bridge-VLANs to separate the ports as desired.

I acknowledge your statement and I re-read the DSA mini tutorial. I now have a different understanding and think I have it setup correctly now. Here is my new config for R1.

root@Tourville:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdaf:ec80:c7fe::/48'

config device
        option name 'lan1'
        option macaddr 'e8:9f:80:a3:ef:e2'

config device
        option name 'lan2'
        option macaddr 'e8:9f:80:a3:ef:e2'

config device
        option name 'lan3'
        option macaddr 'e8:9f:80:a3:ef:e2'

config device
        option name 'lan4'
        option macaddr 'e8:9f:80:a3:ef:e2'

config interface 'lan'
        option device 'lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'wan'
        option macaddr 'e8:9f:80:a3:ef:e1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'VOIP'
        option proto 'static'
        option device 'voip'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config device
        option name 'phy1-ap0'

config interface 'DMZ'
        option proto 'static'
        option device 'dmz'
        option ipaddr '192.168.50.2'
        option netmask '255.255.255.252'

config route
        option interface 'DMZ'
        option target '172.30.50.0/24'
        option gateway '192.168.50.1'

config device
        option type 'bridge'
        option name 'lan'
        list ports 'lan2'

config device
        option type 'bridge'
        option name 'voip'
        list ports 'lan3'
        list ports 'lan4'

config device
        option type 'bridge'
        option name 'dmz'
        list ports 'lan1'