Routing issue or Firewall issue?

kcl · January 16, 2024, 10:24am

Hello, I want to share a printer from vlan(1111) to my other vlans(1201,1202)
i added firewall rules but still cannot ping the printer from other vlans.
I also added static routes to this vlan but still the same. is this a routing issue or a firewall issue?

flygarn12 · January 16, 2024, 10:47am

What did you write in the fw rules?
Ping is IGMP traffic and not TCP/UDP traffic.

kcl · January 16, 2024, 11:00am

this is my firewall config


config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config zone
	option name '302'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network '302'

config forwarding
	option src '302'
	option dest 'wan'

config rule
	option name 'Guest DNS'
	option src 'guest'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Guest DHCP'
	list proto 'udp'
	option src 'guest'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'Guest to Lan'
	option src 'guest'
	option dest 'lan'
	option target 'DROP'

config rule 'guest_fwd'
	option name 'Allow-HTTP/HTTPS-Guest-Forward'
	option src 'guest'
	option dest 'wan'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '80 443'

config zone
	option name 'gcs1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'GCS1'

config forwarding
	option src 'gcs1'
	option dest 'wan'

config rule
	option name 'gcs1-DNS'
	option src 'gcs1'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'gcs1-DHCP'
	list proto 'udp'
	option src 'gcs1'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'gcs1 Wan Forward-HTTP/HTTPS'
	option src 'gcs1'
	option dest 'wan'
	option dest_port '80 443'
	option target 'ACCEPT'

config rule
	option name 'gcs1 to Lan'
	option src 'gcs1'
	option dest 'lan'
	option target 'DROP'

config zone
	option name 'gcs2'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'GCS2'

config forwarding
	option src 'gcs2'
	option dest 'wan'

config rule
	option name 'GCS2 DNS'
	option src 'gcs2'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'GCS2 DHCP'
	option src 'gcs2'
	option dest_port '67-68'
	option target 'ACCEPT'

config zone
	option name 'Printer'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'printer'

config forwarding
	option src 'gcs2'
	option dest 'Printer'

config forwarding
	option src 'gcs1'
	option dest 'Printer'

config forwarding
	option src 'guest'
	option dest 'Printer'

config forwarding
	option src 'lan'
	option dest 'Printer'

config rule
	option name 'Printer DNS'
	option src 'Printer'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Printer DHCP'
	option src 'Printer'
	option dest_port '67-68'
	option target 'ACCEPT'

trendy · January 16, 2024, 11:00am

ICMP to be precise.

kcl · January 16, 2024, 11:08am

kcl:

config forwarding
	option src 'gcs2'
	option dest 'Printer'

config forwarding
	option src 'gcs1'
	option dest 'Printer'

config forwarding
	option src 'guest'
	option dest 'Printer'

config forwarding
	option src 'lan'
	option dest 'Printer'

shouldn't this rule allow all kind of traffic to foward to printer?

lleachii · January 16, 2024, 11:23am

Did you configure an IP and gateway into the printer?

kcl · January 16, 2024, 11:28am

this is my network config

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd7f:225e:26f1::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '10.247.212.58'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.1.1'
	list dns '192.168.1.1'
	list dns '213.42.20.20'
	list dns '195.229.241.222'
	list dns '8.8.8.8'

config device
	option name 'wan'
	option macaddr '32:23:03:13:90:8e'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1'
	list ports 'lan2'

config bridge-vlan
	option device 'br-lan'
	option vlan '333'

config interface 'guest'
	option proto 'static'
	option device 'br-lan.333'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config interface '302'
	option proto 'static'
	option device 'br-lan.302'
	option ipaddr '10.249.249.1'
	option netmask '255.255.255.0'
	option gateway '192.168.1.1'

config bridge-vlan
	option device 'br-lan'
	option vlan '302'

config bridge-vlan
	option device 'br-lan'
	option vlan '1201'
	list ports 'lan4:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '1202'

config interface 'GCS1'
	option proto 'static'
	option device 'br-lan.1202'
	option ipaddr '10.10.10.1'
	option netmask '255.255.255.0'
	option type 'bridge'

config interface 'GCS2'
	option proto 'static'
	option device 'br-lan.1201'
	option ipaddr '10.254.254.1'
	option netmask '255.255.255.0'
	option type 'bridge'

config bridge-vlan
	option device 'br-lan'
	option vlan '1111'
	list ports 'lan3'

config interface 'printer'
	option proto 'static'
	option device 'br-lan.1111'
	option ipaddr '10.247.247.1'
	option netmask '255.255.255.252'

config route
	option interface 'GCS1'
	option target '10.247.247.0/30'
	option gateway '10.10.10.1'

config route
	option interface 'GCS2'
	option target '10.247.247.0/30'
	option gateway '10.254.254.1'

config route
	option interface 'guest'
	option target '10.247.247.0/30'
	option gateway '192.168.10.1'

i have setup ip, dhcp, firewall, static routing for the printer, i cannot just ping or access it thru other vlans.

flygarn12 · January 16, 2024, 11:30am

Is the printer in the dhcp leases list in luci?

kcl · January 16, 2024, 11:32am

yes it has an assigned ip address thru dhcp
10.247.247.2

trendy · January 16, 2024, 12:03pm

Remove the invalid gateways 192.168.1.1 from interfaces lan and 302.
The static routes are wrong, remove them.

config route
	option interface 'GCS1'
	option target '10.247.247.0/30'
	option gateway '10.10.10.1'

config route
	option interface 'GCS2'
	option target '10.247.247.0/30'
	option gateway '10.254.254.1'

config route
	option interface 'guest'
	option target '10.247.247.0/30'
	option gateway '192.168.10.1'

Other than that the configuration on OpenWrt looks correct. I would suspect some particularity of the printer, dropping packets from external networks. You can quickly verify that by adding masquerade on the firewall zone Printer.

kcl · January 16, 2024, 12:27pm

enabling masquerading works but it also allows access to the openwrt management
is there any way to make it more secure?

trendy · January 16, 2024, 12:47pm

It is not connected to masquerade, but to having input ACCEPT.

egc · January 16, 2024, 1:06pm

Does the printer has a firewall which blocks traffic from other subnets then its own?

kcl · January 16, 2024, 2:07pm

I'm trying to test the connection with my laptop on the supposed to be printer vlan port.
Now i cannot even ping even it even if i allow the input accept option in the firewall.
it's not an issue from the printer if my laptop cannot be pinged as well.

kcl · January 16, 2024, 2:10pm

This is my complete config

DHCP


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '254'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'GCS'
	option interface 'GCS'
	option start '100'
	option limit '250'
	option leasetime '12h'

config dhcp 'printer'
	option interface 'printer'
	option start '1'
	option limit '3'
	option leasetime '12h'

Firewall


config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Guest DNS'
	option src 'guest'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Guest DHCP'
	list proto 'udp'
	option src 'guest'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'Guest to Lan'
	option src 'guest'
	option dest 'lan'
	option target 'DROP'

config rule 'guest_fwd'
	option name 'Allow-HTTP/HTTPS-Guest-Forward'
	option src 'guest'
	option dest 'wan'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '80 443'

config rule
	option name 'gcse-DNS'
	option src 'gsce'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'gcse-DHCP'
	list proto 'udp'
	option src 'gsce'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'gsce wan forward-HTTP/HTTPS'
	option src 'gsce'
	option dest 'wan'
	option dest_port '80 443'
	option target 'ACCEPT'

config rule
	option name 'gsce to Lan'
	option src 'gsce'
	option dest 'lan'
	option target 'DROP'

config zone
	option name 'gcs'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'GCS'

config forwarding
	option src 'gcs'
	option dest 'wan'

config rule
	option name 'GCS DNS'
	option src 'gcs'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'GCS DHCP'
	option src 'gcs'
	option dest_port '67-68'
	option target 'ACCEPT'

config zone
	option name 'Printer'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	list network 'printer'

config forwarding
	option src 'gcs'
	option dest 'Printer'

config forwarding
	option src 'guest'
	option dest 'Printer'

config forwarding
	option src 'lan'
	option dest 'Printer'

config rule
	option name 'Printer DNS'
	option src 'Printer'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Printer DHCP'
	option src 'Printer'
	option dest_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'GCSE to Printer'
	option src 'gsce'
	option dest 'Printer'
	option target 'ACCEPT'
	list proto 'all'

config rule
	option name 'Printer'
	list proto 'all'
	option src 'Printer'
	option dest 'lan'
	option target 'DROP'

config rule
	option name 'GCS'
	list proto 'all'
	option src 'gcs'
	option dest 'Printer'
	option target 'ACCEPT'

config rule
	option name 'GCS to Wan'
	option src 'gcs'
	option dest 'wan'
	option dest_port '80 443'
	option target 'ACCEPT'

config zone
	option name 'gsce'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'GSCE'

config forwarding
	option src 'gsce'
	option dest 'wan'

config forwarding
	option src 'gsce'
	option dest 'Printer'

Network


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd7f:225e:26f1::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '10.254.254.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.1.1'


config device
	option name 'wan'


config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan4'

config bridge-vlan
	option device 'br-lan'
	option vlan '333'

config interface 'guest'
	option proto 'static'
	option device 'br-lan.333'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config bridge-vlan
	option device 'br-lan'
	option vlan '1201'
	list ports 'lan1'

config bridge-vlan
	option device 'br-lan'
	option vlan '1202'

config interface 'GCS'
	option proto 'static'
	option device 'br-lan.1201'
	option ipaddr '10.247.212.58'
	option netmask '255.255.255.0'
	option type 'bridge'


config bridge-vlan
	option device 'br-lan'
	option vlan '1111'
	list ports 'lan3'

config interface 'printer'
	option proto 'static'
	option device 'br-lan.1111'
	option ipaddr '10.247.247.1'
	option netmask '255.255.255.252'

config interface 'GSCE'
	option proto 'static'
	option device 'br-lan.1202'
	option ipaddr '10.10.10.1'
	option netmask '255.255.255.0'

egc · January 16, 2024, 2:18pm

Follow @trendy's advice

lleachii · January 16, 2024, 6:08pm

I asked about the printer.

The printer can't talk to another network if you never configured a gateway.

kcl · January 17, 2024, 4:25am

Which gateway should I add on the printer network?
10.254.254.1(management network)
10.10.10.1 or 10.247.212.58 which are vlan for users?

trendy · January 17, 2024, 6:21am

OpenWrt doesn't need any gateway on the printer network.
The printer itself needs the OpenWrt interface IP 10.247.247.1 configured as gateway.

kcl · January 17, 2024, 9:27am

I can now ping the device from any other vlans in the network but i cannot print anything.
Is this a firewall issue? do i need to open any ports to print?