Would you mind posting your config in the following way, instead of uci listings? I find it much easier to read this way:
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
i did not get this one .. what do you mean by that?
i did all other changes, and removed everything not crucial, still no luck. i also added port 22 to "allow THINGS to access MQTT server" i thought there is something wrong with mqtt/1833 but ssh is also not working.
changed config
# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option ipv6 '0'
option delegate '0'
config interface 'wan'
option device 'eth0.7'
option proto 'pppoe'
option username 'xxx'
option password 'xxx'
option ipv6 '0'
option ac 'xxx'
option host_uniq 'xxx'
option peerdns '0'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 4 6t'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '7'
option ports '0t 5t'
option vid '7'
config interface 'guest'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
list dns '192.168.1.1'
option ipv6 '0'
config interface 'things'
option proto 'static'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
list dns '192.168.1.1'
option ipv6 '0'
# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'xxx'
option encryption 'sae-mixed'
option key 'xxx'
config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option cell_density '0'
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'xxx'
option encryption 'psk2'
option key 'xxx'
option network 'lan'
config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option ssid 'xxx'
option encryption 'psk2'
option key 'xxx'
option network 'guest'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option ssid 'xxx'
option encryption 'psk2'
option key 'x'
option network 'things'
# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '0'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
list server '116.203.32.217'
list server '176.9.93.198'
option authoritative '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
list dhcp_option '6,192.168.1.1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
option force '1'
list dhcp_option '6,192.168.1.1'
config dhcp 'things'
option interface 'things'
option start '100'
option limit '150'
option leasetime '12h'
list dhcp_option '6,192.168.1.1'
config host
option name 'moj'
option ip '192.168.1.200'
option mac 'xxx'
config host
option ip '192.168.2.173'
option mac 'xxx'
option name 'xxx'
option dns '1'
config host
option name 'moj'
option duid 'xxx'
config host
option name 'xxx'
option ip '192.168.3.238'
option mac 'xxx'
option dns '1'
config domain
option name 'xxx'
option ip '192.168.1.200'
config domain
option name 'xxx'
option ip '192.168.1.200'
config host
option ip '192.168.2.208'
option mac 'xxx'
option name 'xxx'
option dns '1'
config host
option name 'xxx'
option ip '192.168.1.244'
option mac 'xxx'
config domain
option name 'xxx'
option ip '2.2.2.2'
# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'DROP'
option output 'ACCEPT'
option forward 'DROP'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
option masq '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'guest'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'guest'
config forwarding
option src 'guest'
option dest 'wan'
config rule
option name 'allow GUEST Bare Necessities'
option src 'guest'
option dest_port '67 68 53 5353 123'
option target 'ACCEPT'
config rule
option name 'allow THINGS Bare Necessities'
option src 'things'
option dest_port '67 68 53 5353 123'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'moj HTTP'
option src 'wan'
option src_dport '80'
option dest_ip '192.168.1.200'
option enabled '0'
config redirect
option target 'DNAT'
option name 'moj HTTPS'
option src 'wan'
option src_dport '443'
option dest_ip '192.168.1.200'
list proto 'tcp'
option family 'ipv4'
option dest 'lan'
config redirect
option target 'DNAT'
option name 'moj SSH'
option src 'wan'
option src_dport '26344'
option dest_ip '192.168.1.200'
option dest_port '22'
option family 'ipv4'
list proto 'tcp'
option dest 'lan'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'moj OPENVPN'
option family 'ipv4'
list proto 'udp'
option src 'wan'
option src_dport '1194'
option dest_ip '192.168.1.200'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'moj TimeLimit'
option family 'ipv4'
list proto 'tcp'
option src 'wan'
option src_dport '28181'
option dest_ip '192.168.1.200'
config zone
option name 'things'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'things'
config rule
option name 'allow THINGS to access MQTT server'
option src 'things'
option target 'ACCEPT'
option dest 'lan'
option dest_port '1883 22'
list proto 'tcp'
list proto 'udp'
list proto 'icmp'
list proto 'igmp'
list proto 'esp'
config rule
option name 'allow LAN to access THINGS'
option dest 'things'
option target 'ACCEPT'
option src 'lan'
config rule
option name 'deny THINGS to access WAN'
option src 'things'
option dest 'wan'
option target 'DROP'
option enabled '0'
config forwarding
option src 'things'
option dest 'lan'
Try removing the things network from the things firewall zone and adding it to the lan firewall zone. This will provide the maximum permissions. If it still doesn’t work, it is likely related to local restrictions or limitations on the hosts
Don’t forget to restart the router after making this change
The server (192.168.1.200) has a static lease from the openwrt dhcp and i can access it with moj.lan.
I wonder why there are 2:
config host
option name 'moj'
option ip '192.168.1.200'
option mac 'xxx'
config host
option name 'moj'
option duid 'xxx'
The mac seems correct.
The clients in the THINGS network also gets the IP from the openwrt dhcp.
What baffles me is that i can access the server in LAN with on ports 22, 443 from a client in the THINGS network but 1883 and 80 do not work. curl https://moj.lan - works curl http://moj.lan - does not work
ok, somehow it's fixed now but unfortunately i haven't found out exactly what the problem was because i did a few things at once but maybe this helps anyone. i traced back what i changed lately and:
realized i recently installed NoMachine and RustDesk for trying out remote control - uninstalled those from the server machine
changed the ip range of the THINGS network to 10.0.0.1/24
rebooted the server
and now everything miraculously works as it should.
I've followed your progress configuring this setup with interest since I'll be doing something similar. I'd appreciate it if you could post your final configuration. Cheers!
