Setting a Static IPv4 Upstream address from within the OpenWRT router

jimjamz · June 8, 2024, 3:27am

Hello all. First time poster here, and have started using OpenWRT since May 2024.
Apologies in advance for any erroneous or obvious points and terms I may discuss here.

I have a standard Technicolor router with my ISP, which I am now using as a public-facing(?) modem that the DSL connection goes into. Wireless broadcasting has been disabled, DHCP and NAT are still enabled. The only device connecting to this router (now referred to as a modem) will be another router.
I have a Linksys WRT1900ACS with OpenWRT installed on one of the partitions. It also has DHCP enabled for providing IP addresses, to which all other devices will connect to.
On the modem, I have created a static IPv4 lease for the OpenWRT router (e.g. 192.168.123.100). This is done by associating the MAC address of the OpenWRT router to the lease. However, I have noticed sometimes, that, when either the router or modem are restarted, the static IPv4 address used for the router is not the one I have specified. Sometimes, the OpenWRT router has been assigned a different IPv4 address (e.g. 192.168.123.106). I've confirmed this on both the UIs of the modem and the OpenWRT router (known as the IPv4 Upstream). This can sometimes be resolved by a combination of restarting the modem and router in a particular order, to ensure the router receives the specified IP address.

When I have previously configured static leases for other devices, such as laptops, PCs or tablets, the IP address they are provided is the same as the one I have specified within the static lease on the modem.

So, my question is, is there an issue with either the Technicolor router/modem (i.e not following the static lease rules), or the Linksys OpenWRT router (e.g. using its combination of interfaces to receive a different IP), or do I have to additionally configure the OpenWRT router to further ensure it receives the same IPv4 address that I specified within the static lease on the modem?

It's not been necessary for years, but I used to set the static address from the device side by adding the static IP, netmask and gateway details in /etc/network/interfaces on Linux devices such as Raspberry Pis. However, that has not been necessary for some time, and I felt it was more appropriate to set the static lease from the router instead. Would I need to do such a thing on the OpenWRT router?

EDIT: I have not changed the function of neither router. None are working as an AP or in Bridged mode.

eduperez · June 8, 2024, 1:57pm

If you have configured it properly on the Technicolor router, and the Linksys is also configured properly as a DHCP client, then you should not need to do anything else.

However, if it fails, you can try to diagnose the issue, or you can just configure a static address on the Linksys.

jimjamz · June 10, 2024, 3:40am

Thank you for your response, @eduperez

I am confident your first two suggestions are already applied correctly.

Although I have done my best to ensure the Linksys/OpenWRT router is assigned a static IP lease from the Technicolor router(modem), please can you advise on how to configure the Linksys/OpenWRT router to have a static IPv4 upstream address on the Linksys?

I assumed that this may be similar to how its done on other linux devices, setting this in /etc/network/interfaces. However, there appears to be no such file or directory in the OpenWRT directory structure.

psherman · June 10, 2024, 5:15am

If you're using LuCI, you'll navigate to Network > Interfaces > Edit wan interface and then change the protocol to static -- this will give you the ability to specify the IP address manually. Make sure that you do not overlap the upstream's DHCP address range and that the static IP you use does not conflict with any other devices on the upstream network.

You must set all fields based on the upstream network's parameters:

IP address
Subnet mask
Gateway
DNS (this can optionally be a public DNS server instead of the upstream router's address).

eduperez · June 10, 2024, 5:18am

You can use the GUI, as suggested by @psherman, or you can edit the file '/etc/config/network'.

jimjamz · June 13, 2024, 5:29am

Thank you @psherman and @eduperez for both the UI and CLI approaches.

I tried the solution provided by @psherman. The static IP was applied successfully. I was able to connect to the router thereafter, and so were other several devices. No further changes were made.
Unfortunately, the router stopped working several hours later and I was no longer able to connect to it. I'm working with the router remotely but need assistance on-site and haven't been able to solve the problem yet. Once I've been able to resolve/diagnose the issue, I'll be able to mark it as an answer.

psherman · June 13, 2024, 5:31am

When you get access to the device again (i.e. via the assistant, I guess), get a complete config dump and we'll see if we can help from there.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

jimjamz · June 17, 2024, 3:43am

I've been able to re-establish a connection to the remote router and I've identified there are still some connectivity issues.

There was no connection issue for me remotely connecting via SSH, but for the users connected locally to the remote OpenWRT router. The reason for my disconnection was because a local user of the remote router cut the power to the router several times, causing the partition switch on this particular Linksys router, which was still using the stock (and unconfigured) Linksys software on the alternate partition. I've since managed to install OpenWRT on the alternate partition and import the OpenWRT configuration file, which I exported from the primary partition just before the initial connectivity issues.

What triggered the local user to cut the power is because, when I made the wan interface change from DHCP Client to Static, local users of the router had no Internet access.

When the wan interface is set to DHCP Client, everyone including local users of the router have an internet connection.
When the wan interface is set to Static, I continue to have an SSH connection to the remote router, and an SSH connection to devices on that router (which in turn, provide me a VPN tunnel as well as access to the router's luci UI, and also acts as a dynamic DNS resolver), but other devices on the router, are connected but without internet access.

For example, when the wan interface is set to DHCP Client, I can SSH onto a remote device connected to the remote router, and wget a file successfully.
When the wan interface is set to Static, I receive:

Resolving cdimage.debian.org (cdimage.debian.org)... failed: Temporary failure in name resolution.
wget: unable to resolve host address ‘cdimage.debian.org’

The requested details are as follows:

$ ubus call system board

{
	"kernel": "5.15.150",
	"hostname": "MyLinksysRouter",
	"system": "ARMv7 Processor rev 1 (v7l)",
	"model": "Linksys WRT1900ACS",
	"board_name": "linksys,wrt1900acs",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "mvebu/cortexa9",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}

$ cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd17:2099:1b3d::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.10.123.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'wan'
	option macaddr 'e3:22:0f:44:aa:0f'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

$ cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'VHT80'
	option country 'GB'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'MyLinksysRouter_5G'
	option encryption 'sae-mixed'
	option macaddr 'e3:22:0f:44:aa:11'
	option key 'myPassword123'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option country 'GB'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'MyLinksysRouter'
	option encryption 'sae-mixed'
	option macaddr 'e3:22:0f:44:aa:10'
	option key 'myPassword123'

$ cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '120'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	option start '100'
	option limit '120'
	option leasetime '12h'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'MY-LAPTOP-ETH'
	option ip '10.10.123.100'
	option mac '42:A1:DA:1A:10:10'

config host
	option name 'MY-LAPTOP-WLAN'
	option ip '10.10.123.101'
	option mac '92:F1:AA:3A:20:20'

config host
	option name 'DESKTOP-PC'
	option ip '10.10.123.102'
	option mac '00:22:0F:4D:30:30'

config host
	option name 'OLD-LAPTOP-ETH'
	list mac '55:0A:1C:2E:40:40'
	option ip '10.10.123.103'
	option leasetime '12h'

$ cat /etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'SSH'
	option src 'wan'
	option src_dport '11122'
	option dest_ip '10.10.123.102'
	option dest_port '11122'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'TINYPROXY'
	option src 'wan'
	option src_dport '8888'
	option dest_ip '10.10.123.102'
	option dest_port '8888'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'PIVPN'
	option src 'wan'
	option src_dport '58100'
	option dest_ip '10.10.123.102'
	option dest_port '58100'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'VNC'
	option src 'wan'
	option src_dport '5900'
	option dest_ip '10.10.123.103'
	option dest_port '5900'
	option enabled '0'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'RDP'
	option family 'ipv4'
	option src 'wan'
	option src_dport '3389'
	option dest_ip '10.10.123.103'
	option dest_port '3389'

At the time of writing this, I have noticed that the Linksys OpenWRT router is leasing IPv6 addresses to devices on the router, but the upstream Technicolor router (modem) has IPv6 provision disabled. When setting the OpenWRT router wan interface to static, could this be what is causing those devices not to obtain internet access from the upstream router?

EDIT: One additional point worth mentioning, is that @psherman had instructed to provide the necessary DNS values when setting the wan interface to Static.
However, such an option to enter those DNS values does not appear:

In such a situation above, where the upstream router (modem) has IPv6 disabled, should the downstream router have Delegate IPv6 prefixes enabled on the wan interface?

ANOTHER EDIT: Apologies for further editing. I've just noticed that when attempting to set the wan interface to Static, the IPv4 broadcast value may be out of range of the upstream address range. I'm attempting to set the IPv4 broadcast to 192.168.123.255, but the upstream range is from 192.168.123.1 to 192.168.123.120. Could that be a potential cause?

psherman · June 17, 2024, 5:33am

You will find DNS under the Advanced Settings tab -- and it is mandatory.

Leave the broadcast field empty. It will auto-calculate. As long as the subnet mask matches the upstream network, it's fine (that is likely the case -- 255.255.255.0 aka /24). The range of the upstream that you refer to is likely just the DHCP range -- it is probable that it is a full /24 because 120 is not a subnet based logical boundary. I'm pretty sure that this is not related.

The problem is almost certainly DNS.

jimjamz · June 17, 2024, 1:34pm

Populating the DNS values under the Advanced Settings tab was the solution to providing internet access for local users of the remote router. The IPv4 Broadcast input field was also left empty.

Thank you @psherman for your assistance and expertise in resolving this. Thanks also to @eduperez for providing alternative methods to accomplish the task.

system · June 27, 2024, 1:35pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.