Looks like you're trying to add custom nftables rules?
Or is it still https-dns-proxy issues?
amazon, guest, cctv networks showed up as phy0-apX
but windows as radio1.network1 in interfaces
I ran your script from above and got the error above
VLAN instrucion I am just reading through this link to understand how to set up the VLAN the way you suggested.
main router:
ls -l /sys/class/net
lrwxrwxrwx 1 root root 0 Jul 28 12:43 br-lan ->br-lan
lrwxrwxrwx 1 root root 0 Dec 31 1969 eth0 ->eth0
lrwxrwxrwx 1 root root 0 Dec 31 1969 eth1 ->eth1
lrwxrwxrwx 1 root root 0 Dec 31 1969 lan1 ->lan1
lrwxrwxrwx 1 root root 0 Dec 31 1969 lan2 ->lan2
lrwxrwxrwx 1 root root 0 Dec 31 1969 lan3 ->lan3
lrwxrwxrwx 1 root root 0 Dec 31 1969 lan4 ->lan4
lrwxrwxrwx 1 root root 0 Dec 31 1969 lo ->lo
lrwxrwxrwx 1 root root 0 Jul 28 12:43 phy0-ap0 ->phy0-ap0
lrwxrwxrwx 1 root root 0 Jul 28 13:06 phy0-ap1 ->phy0-ap1
lrwxrwxrwx 1 root root 0 Jul 28 12:43 phy0-ap2 ->phy0-ap2
lrwxrwxrwx 1 root root 0 Jul 28 12:56 phy0-ap3 ->phy0-ap3
lrwxrwxrwx 1 root root 0 Dec 31 1969 wan ->wan
Cudy TR3000 v1:
root@travel:~# ls -l /sys/class/net
lrwxrwxrwx 1 root root 0 Jul 23 15:05 br-lan ->br-lan
lrwxrwxrwx 1 root root 0 Dec 31 1969 eth0 ->eth0
lrwxrwxrwx 1 root root 0 Dec 31 1969 eth1 ->eth1
lrwxrwxrwx 1 root root 0 Dec 31 1969 lo ->lo
lrwxrwxrwx 1 root root 0 Jul 23 15:05 phy0-ap0 ->phy0-ap0
lrwxrwxrwx 1 root root 0 Jul 23 15:05 phy0-ap1 ->phy0-ap1
lrwxrwxrwx 1 root root 0 Jul 23 15:10 phy1-ap0 ->phy1-ap0
lrwxrwxrwx 1 root root 0 Jul 23 15:10 phy1-ap1 ->phy1-ap1
networks: cctv, amazon, windows, guest, iot, and then there is my original existing network which is untouched so far. should I also create for this one it's own VLAN for the other routers?
# Create VLAN interfaces on top of br-lan
uci set network.vlan10=device
uci set network.vlan10.type='8021q'
uci set network.vlan10.ifname='br-lan'
uci set network.vlan10.vid='10'
uci set network.vlan10.name='br-lan.10'
uci set network.vlan20=device
uci set network.vlan20.type='8021q'
uci set network.vlan20.ifname='br-lan'
uci set network.vlan20.vid='20'
uci set network.vlan20.name='br-lan.20'
uci set network.vlan30=device
uci set network.vlan30.type='8021q'
uci set network.vlan30.ifname='br-lan'
uci set network.vlan30.vid='30'
uci set network.vlan30.name='br-lan.30'
uci set network.vlan40=device
uci set network.vlan40.type='8021q'
uci set network.vlan40.ifname='br-lan'
uci set network.vlan40.vid='40'
uci set network.vlan40.name='br-lan.40'
uci set network.vlan50=device
uci set network.vlan50.type='8021q'
uci set network.vlan50.ifname='br-lan'
uci set network.vlan50.vid='50'
uci set network.vlan50.name='br-lan.50'
Edit configs directly from ssh, and or reset the wireless config.
## DEFAULT CONFIG FOR: /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option disabled '1'
# option macaddr '00:00:00:00:00:00' (Auto-populated with your radio's MAC)
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option disabled '1'
# option macaddr '00:00:00:00:00:00' (Auto-populated with your radio's MAC)
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
-------------------------------------------------------------------------------
IF YOU NEED TO RESET WIRELESS TO DEFAULTS:
# 1. Delete the current wireless configuration file
rm -f /etc/config/wireless
# 2. Tell OpenWrt to detect the hardware and generate a fresh default config
wifi config
# 3. Reload the network to apply the changes
wifi reload
-------------------------------------------------------------------------------
## WHAT YOU CAN ADD TO CONFIG
# --- 2.4GHz Virtual APs (radio0) ---
config wifi-iface 'amazon_2g'
option device 'radio0'
option network 'amazon'
option mode 'ap'
option ssid 'Amazon_IoT'
option encryption 'psk2+ccmp'
option key 'YourSecurePasswordHere'
option isolate '1'
config wifi-iface 'cctv_2g'
option device 'radio0'
option network 'cctv'
option mode 'ap'
option ssid 'Cam_Net'
option encryption 'psk2+ccmp'
option key 'YourSecurePasswordHere'
option isolate '1'
config wifi-iface 'guest_2g'
option device 'radio0'
option network 'guest'
option mode 'ap'
option ssid 'Guest_Network'
option encryption 'psk2+ccmp'
option key 'YourSecurePasswordHere'
option isolate '1'
# --- 5GHz Virtual APs (radio1) ---
config wifi-iface 'windows_5g'
option device 'radio1'
option network 'windows'
option mode 'ap'
option ssid 'Windows_Net'
option encryption 'psk2+ccmp'
option key 'YourSecurePasswordHere'
config wifi-iface 'guest_5g'
option device 'radio1'
option network 'guest'
option mode 'ap'
option ssid 'Guest_Network_5G'
option encryption 'psk2+ccmp'
option key 'YourSecurePasswordHere'
option isolate '1'
Also hope this helps too:
/etc/config/network
# --- Append to /etc/config/network ---
config device
option name 'br-amazon'
option type 'bridge'
config interface 'amazon'
option device 'br-amazon'
option proto 'static'
option ipaddr '192.168.4.1'
option netmask '255.255.255.0'
config device
option name 'br-guest'
option type 'bridge'
config interface 'guest'
option device 'br-guest'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
config device
option name 'br-cctv'
option type 'bridge'
config interface 'cctv'
option device 'br-cctv'
option proto 'static'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
config device
option name 'br-windows'
option type 'bridge'
config interface 'windows'
option device 'br-windows'
option proto 'static'
option ipaddr '192.168.5.1'
option netmask '255.255.255.0'
/etc/config/firewall
# --- Append to /etc/config/firewall ---
# 1. Amazon (IoT) Zone - Internet only
config zone
option name 'amazon'
list network 'amazon'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'amazon'
option dest 'wan'
# 2. Guest Zone - Internet only
config zone
option name 'guest'
list network 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'guest'
option dest 'wan'
# 3. Windows Zone - Internet only
config zone
option name 'windows'
list network 'windows'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'windows'
option dest 'wan'
# 4. CCTV Zone - NO INTERNET, NO CROSS-VLAN
config zone
option name 'cctv'
list network 'cctv'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
# Allow the main LAN to view the CCTV cameras
config forwarding
option src 'lan'
option dest 'cctv'
# 5. Granular Input Rules (DNS & DHCP only)
# This loops through all isolated zones to allow basic connectivity
config rule
option name 'Allow-Isolated-DNS-DHCP'
list src 'amazon'
list src 'guest'
list src 'windows'
list src 'cctv'
option dest_port '53 67'
option proto 'tcp udp'
option target 'ACCEPT'
/etc/config/dhcp
# --- Append to /etc/config/dhcp ---
config dhcp 'amazon'
option interface 'amazon'
option start '2'
option limit '5'
option leasetime '1h'
config dhcp 'guest'
option interface 'guest'
option start '2'
option limit '15'
option leasetime '2h'
config dhcp 'cctv'
option interface 'cctv'
option start '2'
option limit '10'
option leasetime '24h'
config dhcp 'windows'
option interface 'windows'
option start '2'
option limit '5'
option leasetime '1h'
Here is the VLAN config..
/etc/config/network
# Enable VLAN filtering on the existing bridge
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
option vlan_filtering '1'
# VLAN 10 - CCTV
config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan:t'
option local '1'
config interface 'cctv'
option proto 'static'
option device 'br-lan.10'
option ipaddr '10.0.10.1'
option netmask '255.255.255.0'
# VLAN 20 - Amazon
config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan:t'
option local '1'
config interface 'amazon'
option proto 'static'
option device 'br-lan.20'
option ipaddr '10.0.20.1'
option netmask '255.255.255.0'
# VLAN 30 - Windows
config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan:t'
option local '1'
config interface 'windows'
option proto 'static'
option device 'br-lan.30'
option ipaddr '10.0.30.1'
option netmask '255.255.255.0'
# VLAN 40 - Guest
config bridge-vlan
option device 'br-lan'
option vlan '40'
list ports 'lan:t'
option local '1'
config interface 'guest'
option proto 'static'
option device 'br-lan.40'
option ipaddr '10.0.40.1'
option netmask '255.255.255.0'
# VLAN 50 - IoT
config bridge-vlan
option device 'br-lan'
option vlan '50'
list ports 'lan:t'
option local '1'
config interface 'iot'
option proto 'static'
option device 'br-lan.50'
option ipaddr '10.0.50.1'
option netmask '255.255.255.0'
/etc/config/dhcp
config dhcp 'cctv'
option interface 'cctv'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'amazon'
option interface 'amazon'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'windows'
option interface 'windows'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'iot'
option interface 'iot'
option start '100'
option limit '150'
option leasetime '12h'
/etc/config/firewall
# CCTV Zone
config zone
option name 'zone_cctv'
option input 'DROP'
option output 'DROP'
option forward 'DROP'
list network 'cctv'
config rule
option name 'Allow-DHCP-cctv'
option src 'zone_cctv'
option dest_port '67'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Allow-DNS-cctv'
option src 'zone_cctv'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
# Amazon Zone
config zone
option name 'zone_amazon'
option input 'DROP'
option output 'DROP'
option forward 'DROP'
list network 'amazon'
config rule
option name 'Allow-DHCP-amazon'
option src 'zone_amazon'
option dest_port '67'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Allow-DNS-amazon'
option src 'zone_amazon'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
# Windows Zone
config zone
option name 'zone_windows'
option input 'DROP'
option output 'DROP'
option forward 'DROP'
list network 'windows'
config rule
option name 'Allow-DHCP-windows'
option src 'zone_windows'
option dest_port '67'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Allow-DNS-windows'
option src 'zone_windows'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
# Guest Zone
config zone
option name 'zone_guest'
option input 'DROP'
option output 'DROP'
option forward 'DROP'
list network 'guest'
config rule
option name 'Allow-DHCP-guest'
option src 'zone_guest'
option dest_port '67'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Allow-DNS-guest'
option src 'zone_guest'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
# IoT Zone
config zone
option name 'zone_iot'
option input 'DROP'
option output 'DROP'
option forward 'DROP'
list network 'iot'
config rule
option name 'Allow-DHCP-iot'
option src 'zone_iot'
option dest_port '67'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Allow-DNS-iot'
option src 'zone_iot'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
Section @defaults[0] option 'custom_chains' is not supported by fw4
Section @rule[8] (Allow-ISAKMP) specifies unknown option 'netmask'
Section @rule[9] (Allow-Isolated-DNS-DHCP) option 'src' must not be a list
Section @rule[9] (Allow-Isolated-DNS-DHCP) skipped due to invalid options
Automatically including '/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft'
@sync thenk you this is great stuff. I am learning a lot from you this way, hopefully one day I can stay on my own legs.
I can not connect to any of the network SSID's
it's probably due to them not reaching DHCP?
# 5. Granular Input Rules (DNS & DHCP only)
# This loops through all isolated zones to allow basic connectivity
config rule
option name 'Allow-Isolated-DNS-DHCP'
list src 'amazon'
list src 'guest'
list src 'windows'
list src 'cctv'
option dest_port '53 67'
option proto 'tcp udp'
option target 'ACCEPT'
I changed list to option but that didn't do it.
I am investigating.
Yeah I messed up, ignore that firewall config file.
You only need one firewall zone for the untrusted devices like Amazon or computer networks..
One zone for admin or lan - default is lan.
One zone for wan wan6.
See:
Thank you so much for all your help.
i am llearning a lot from your files / scripts.
I don't think that you have messed up anything. I liked your version with the various networks and firewall-zoness (probably a bit overkill but for learning purpousses that was great).
It would probably be good to have at least two firewall zomes, one resstricted completely for the cameras and one for guest and IOT and other things.
I tried to get the 4 networks and zone up and running but didn't succeeed.
Let me post the problem and see if there is an easy solution to it.
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option custom_chains '1'
option drop_invalid '1'
option synflood_protect '1'
option synflood_rate '25/s'
option synflood_burst '50'
option tcp_ecn '1'
option tcp_syncookies '1'
option tcp_window_scaling '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'wwan'
# 1. Amazon (IoT) Zone - Internet only
config zone
option name 'amazon'
list network 'amazon'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'amazon'
option dest 'wan'
# 2. Guest Zone - Internet only
config zone
option name 'guest'
list network 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'guest'
option dest 'wan'
# 3. Windows Zone - Internet only
config zone
option name 'windows'
list network 'windows'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'windows'
option dest 'wan'
# 4. CCTV Zone - NO INTERNET, NO CROSS-VLAN
config zone
option name 'cctv'
list network 'cctv'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option src 'lan'
option dest 'wan'
# Allow the main LAN to view the CCTV cameras
config forwarding
option src 'lan'
option dest 'cctv'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
/etc/init.d/firewall reload
Section @defaults\[0\] option 'custom_chains' is not supported by fw4
Automatically including '/usr/share/nftables.d/ruleset-post/20-https-dns-proxy-notrack.nft'
I tried thi configuration suggested by you with the 4 networks but not IP is being assigned by dhcp, so clienst can't connect
This is because you have the input zone rule set to REJECT and you don't have a rule to allow DHCP (and often DNS is also desired).
You need to allow input on UDP port 67 for DHCP, and TCP+UDP port 53 for DNS. Take a look at the guest wifi guide (section 3: firewall).