Greetings,
I installed openwrt on a raspberry pi 4 and I intend to use it as a router. I use the onboard ethernet port for LAN and a USB-ethernet adapter for WAN. The problem is that I can connect to the internet (via PPPoE) and I can ping and update packages from the Pi, however the LAN clients that connect to it don't have any internet access.
The LAN interface has the default configuration.
What am I missing?
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
1 Like
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdcd:3fd8:7013::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'WAN'
option device 'eth1'
option proto 'pppoe'
option username '**username**'
option password '**password**'
option ipv6 '0'
config wifi-device 'radio0'
option type 'mac80211'
option channel '36'
option hwmode '11a'
option path 'platform/soc/fe300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
option htmode 'VHT80'
option cell_density '0'
option disabled '1'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrtPi'
option encryption 'psk2'
option key 'password'
option disabled '1'
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'WAN'
option interface 'WAN'
option ignore '1'
list ra_flags 'none'
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
Are your client computers able to get a DHCP lease from the OpenWrt router?
What are the full details of the network configuration on your client systems? IP, Subnet mask, Gateway/Router, DNS
1 Like
Yes the clients get a DHCP address from the router.
For now it's a linux laptop simply configured for DHCP. The IP is 192.168.1.131, subnet 255.255.255.0, default route 192.168.1.1, DNS 192.168.1.1
I can ping 192.168.1.1 but the others give a "destination port unreachable" error.
What is the IP address on the WAN of OpenWrt? Is it in the 192.168.1.0/24 network, by chance?
1 Like
No, it's an ip given by the ISP via PPPoE, something like 5.12.xxx.xxx/32
I'm stumped at the moment... I'll keep thinking about it.
Is this a fresh install of OpenWrt on the Pi? Did you install or upgrade any packages (aside from the driver for your USB ethernet adapter)? Did you modify any of the configurations other than the wifi, and WAN?
Ah, got it. The WAN interface didn't have any firewall zones assigned (it was "unspecificed"). Should've figured out why it appeared as grey and not red. Seems to be working now.
Many thanks for the help!
3 Likes
That sounds reasonable. Glad it is working. But it looked like WAN did have the zone assignment...
can you show the relevant snippet of the updated firewall file?
EDIT: is this a case-sensitive issue?
It should be, in network it is defined upper case.
2 Likes
There's actually an extra line added
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'WAN'
The extra line makes it clear that it is indeed a case sensitivity issue. Your WAN network was defined with upper case letters, while the default firewall config assumed lowercase.
So that means it should've been assigned by default and it wasnt? Note that the WAN connection wasn't there when I installed openwrt because the usb-ethernet adapter wasn't detected, so I added it manually and should've assigned the zone then.
It means that it must all be in the same case.
You created the network interface, had you named it “wan” instead of “WAN”, it would have worked right away. The firewall had network defined as “wan” - it is case sensitive. Once you added “WAN” to the firewall zone, it picked up your network.
1 Like
…and for sanity, keep your interfaces all lower-case.
--
Upper-case WAN shouldn't exist anywhere.
3 Likes