Several problems with Linksys WRT3200ACM

LordRayden · October 25, 2020, 3:32pm

Hi,

I bought a Linksys WRT3200ACM router for my brother, building a PC router for him was too much. I like Linksys and that thing is a monster. Since I wanted support for USB LTE I installed Openwrt (latest stable).

Now I have support for USB LTE and that is working but I am having all kind of other problems which I am not used to from Linksys or Openwrt.

Port Forwarding.

I went to Firewall, Port Forwarding, configured my port but no luck. Port stay closed. I have installed UPNP but still no luck. That port stays closed… What am I doing wrong? Port Forwarding is not exactly “Rocket Science”

DHCP

The DHCP is always working on LAN (4 port switch RJ45), on Wifi it’s sometimes working sometimes not and I don’t know why. There is not exactly much to configure here. Especially the “Light Bulbs”, my brother has Wifi “Light Bulbs” that are controlled by Amazon Alexa. Three of them connect to the Wifi and work, two of them connect to the Wifi (I can see them in Luci) but don’t get an IP address. I also can’t configure them over the App because the App only connects to the first Bulb. When I start the old TP-Link router, no problems. I don’t get it… All the steps are the same with the TP-Link router and the Openwrt router, but they just don’t work with Openwrt.

Stability

The whole thing feels extremely unstable. I lose connections on the Wifi side, I can’t reach the router and have to turn it off and on to connect to him again. For example, Alexa connects so the Wifi and works fine, five minutes later Alexa can’t connect to Wifi, I have to restart the router. When I am connected to Luci I see the three Wifi’s working and then without any reason they are all offline, 3 sends later they are online again.

On my PC with Openwrt, I don’t have these problems. The whole build is stable and works fine…

What should I do? Going back to Original firmware is not an option because I need the LTE. Should I try an older version or to build one myself? I tried reinstalling it, I tried a snapshot but no luck…

Thank You

LordRayden

eduperez · October 25, 2020, 3:40pm

Port forwarding: post here your config files, or there is little anybody can do to help you.

Wifi: this router has known issues with IoT devices, have a look here for possible solutions and mitigations:

hnyman · October 25, 2020, 3:44pm

If your ISP connection is via USB modem, it is well possible that the ISP only gives you a NAT address instead of fully routeable public IP address.

LordRayden · October 25, 2020, 5:10pm

Hi hnyman,

No, I have an official IP Address. That is a thing that you can setup by yourself with my ISP, with the TP Link router I have an official IP and all port forwarding’s are working...

Thank you

@eduperez

Thank you for the Information, did not know that. I thought with an expensive Linksys router I can’t do anything wrong, besides it is an "opensource" router... Have to look into that…

Which files do you need? I did the whole config with luci...

Thank you

eduperez · October 25, 2020, 8:43pm

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

LordRayden · October 26, 2020, 10:17am

Hi,

sorry it took a little longer to answer, I wasn’t home ....

This is the output of the two files. Maybe I should say that the "Interfaces" are all created automatically on the first boot. I just change the settings. The Firewall is "untouched" except for the port forwarding...

root@GUARDIAN:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd8d:47bb:0159::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.1'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.187.254'

config interface 'wan'
        option ifname 'eth1.2'
        option proto 'dhcp'
        option metric '1'

config interface 'wan6'
        option ifname 'eth1.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 5t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6t'

config interface 'wwan'
        option proto 'dhcp'
        option metric '2'

config interface 'wan2'
        option proto 'dhcp'
        option metric '20'
        option ifname 'wan2'

config interface 'wan1'
        option proto 'dhcp'
        option ifname 'wwan0'
        option _orig_bridge 'false'
        option metric '10'

root@GUARDIAN:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wwan wan1 wan2'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config redirect
        option src_port '47306'
        option src 'wan'
        option name 'torrent'
        option src_dport '47306'
        option target 'DNAT'
        option dest_ip '192.168.187.91'
        option dest_port '47306'
        option dest 'lan'

Thank You

LordRayden · October 26, 2020, 12:23pm

Hi,

I had the following Idea. As I said I have the Linksys WRT3200ACM and a TP-Link MR200.

The MR200 has a bult in SIM Card slot which is good, no USB fumbling but he is to weak, a little bit more traffic and he is gone, you can’t reach him, he gets really hot, you can’t touch him and after some time he reboots….

The WRT3200ACM is strong and fast but no SIM Card slot, problems with Wifi probably caused by the IOT equipment and the port forwarding doesn’t work just now.

My Idea was, I take the MR200 put the Sim Card in it and connect it to the WAN port of the WRT3200ACM. On the MR200 I turn off the SSID Broadcasting and connect Alexa, Light Bulbs, TV all IOT directly to the not Broadcasted SSID of the MR200. He is strong enough for the IOT Stuff and he is stable enough for it.

On the WRT3200ACM I configure the Wifi to broadcast and use it for PCs, laptops, Xbox and so on. He is strong enough to handle the traffic and I can even use Qos to favorize Xbox traffic or I could use the third Wifi for gaming and favorize the third Wifi.

Would this setup work?

What are your thoughts?

What would you change?

Of course, I have to get the port forwarding going while with this setup I have to forward a lot of ports to the WAN router and then to the Internet.

Useful would be a function called “DMZ” which I just can’t find in Openwrt(luci). With that function I could set a “DMZ” to the IP of the WAN router and wouldn’t have to forward each port individually or is this a thinking mistake? I need a DMZ from the WAN router to the IP of the WRT3200ACM (which is not a Problem, the MR200 has DMZ)?

Your thoughts?

Thank You

LordRayden

eduperez · October 27, 2020, 10:57am

So, you have five WAN interfaces... I would go back to a single WAN, configure and check port forwarding, then add the other interfaces.

eduperez · October 27, 2020, 11:01am

The MR200 can't be configure on "bridge mode" if you want to use it as a router for IoT devices, so the WRT3200ACM is inside a NAT.

You do not want to create another NAT for the WRT3200ACM's LAN, so this one has to be configured as a dumb AP (and lose some functionality).

LordRayden · October 27, 2020, 11:55am

Hi,

yes I have 5 WAN Interfaces but I thought that is normal with Openwrt because I didn't make them, they are automatically configured after the first boot. I just need one but that is impossible (at least for me). I can delete all the extra Interfaces, apply the changes, all good. After I reboot the machine, they are all back (tried that several times). Everything gets saved and lives after the reboot except the WAN Interfaces, they all get back after the reboot.

Maybe you can remember a week or two ago I build a router PC with Openwrt, on that PC I have 6 WAN Interfaces and 3 TAPI Interfaces which I can delete but they are all back after the reboot. That is why I thought that this behavior is normal. That means on my router PC port forwarding also doesn’t work (haven’t tested it yet).

Do you have an Idea how I can permanently delete all the other Interfaces? I need just one WAN (on my router PC 2)…

Thank you

LordRayden · October 27, 2020, 11:55am

Hi,

Thank you for your answer. I understand what you mean but if I configure the WRT3200ACM as a dumb AP wouldn’t I lose his power? This is the main reason for the change to the bigger router. The CPU of the MR200 is to weak, it can’t handle the traffic. If I configure the WRT3200ACM as AP the MR200 would still have to handle all the traffic, or am I thinking wrong? I wanted the WRT3200ACM to handle the traffic and all the NAT because he has enough power to do so. The MR200 should just be a “dumb WAN Interface” but also handle the IOT stuff because the WRT3200ACM has problems with it…

Thank you

vgaetera · October 27, 2020, 12:16pm

uci -q delete firewall.@redirect[0].src_port
uci commit firewall
/etc/init.d/firewall restart

https://openwrt.org/docs/guide-user/firewall/firewall_configuration#redirects

LordRayden · October 27, 2020, 7:18pm

Hi,

thank you for your answer.

Could you please explain what this line does? As far as I understand the line, it deletes the source port. Wouldn’t that mean that I am redirecting all the traffic form the WAN Interface to one port and one machine?

I want to forward one port from wan to lan….

Thank you

LordRayden

vgaetera · October 27, 2020, 7:22pm

Source port is often dynamic, so you should avoid specifying it.

LordRayden · October 27, 2020, 7:26pm

Thank you, I will try that...

LordRayden · October 27, 2020, 7:42pm

Hi,

today I tried to compile an image for the WRT3200ACM with the latest sources and found out that this is not possible. Every Image that get created is incompatible with the router. There is absolutely no problem compiling the stable sources and the image is compatible with the router. I noticed one difference in “make menuconfig” between the stable and the latest branch. In the “Target Profile” of the stable branch I can select the WRT3200ACM “Rango”, nothing else. In the “Target Profile” of the latest branch there is the WRT3200ACM “Rango” and the WRT3200ACM (without “Rango”), when I select the “Rango” the other one gets selected automatically and I can’t unselect it. Can it be that this is the reason I get incompatible Images? I tried to force flash the Image which basically bricks the router, luckily it has two boot Images so I switched to the other one and reflashed the first one with a stable image…

Is there a way or a trick to unselect the second WRT3200ACM? Maybe that would produce a compatible Image?

Thank You

LordRayden

anomeome · October 27, 2020, 7:49pm

I just finished building and flashing an image from current master with no issues. There was a name reconciliation pushed to master a while back, but that should not cause any issues. What do you mean when you say the images is incompatible; if you are moving between stable and master you will / should get a warning, do not keep config as master has changed to DSA and will yield an install with no link on the wan / lan nics.

LordRayden · October 27, 2020, 8:00pm

Hi,

I newer keep the settings, it’s better to configure everything from the scratch in my opinion. Yes, I get the DSA message, but the router is a brick after the flash. I don’t even get an IP address.

OK, just did:

git pull

./scripts/feeds update -a

./scripts/feeds install -a

got many changes, will try again...

Thank You

LordRayden

LordRayden · October 27, 2020, 8:05pm

Just noticed another change in “make menuconfig”.

In “Target Images” there is this line in the latest branch:

“(104) Root filesystem partition size (in MB)”

In the stable branch there is this line:

“(256) Root filesystem partition size (in MB)”

Can I change that back? I know I have the 256MB model?

anomeome · October 27, 2020, 8:10pm

I would do something a little different:

./scripts/diffconfig.sh > configdiff
cp configdiff .config
make defconfig

should give you a reasonable current config based on defaults of current pull. Mine CONFIG_TARGET_ROOTFS_PARTSIZE=104