Hello!
I followed this guide and can access my modem because there's always some problem in PK your connection can get cut and you won't even know why because wires are running above and not undergroud sadly but there's a problem that when I connect to guest network I have made they can also access the modem page which I don't need them to do how to fix this issue?
Was guest network made by following https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_webinterface ?
Or is the guest network wired ?
just add a firewall rule that rejects traffic to the modem's address. Should be pretty simple.
Guest Network is on a vlan 8 I was originally going with bridge method mentioned in that post but I did it this way..
Let's see the configs:
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
root@OpenWrt:~# ubus call system board
{
"kernel": "6.12.87",
"hostname": "OpenWrt",
"system": "ARMv7 Processor rev 5 (v7l)",
"model": "NETGEAR RBR50",
"board_name": "netgear,rbr50",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.4",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r32933-4ccb782af7",
"target": "ipq40xx/generic",
"description": "OpenWrt 25.12.4 r32933-4ccb782af7",
"builddate": "1778712129"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option dhcp_default_duid ''
option ula_prefix ''
option packet_steering '1'
config device
option name 'br-vlan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
config interface 'lan'
option device 'br-vlan.1'
option proto 'static'
list ipaddr '192.168.1.1/24'
option multipath 'off'
config device
option name 'wan'
option macaddr '
config interface 'wan'
option device 'wan'
option proto 'pppoe'
option ipv6 '0'
option username ''
option password ''
config interface 'wan_6'
option device '@wan'
option proto 'dhcpv6'
option disabled '1'
option auto '0'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
option multipath 'off'
config interface 'guest'
option proto 'static'
list ipaddr '192.168.8.1/24'
option device 'br-vlan.8'
config interface 'lan_vpn'
option proto 'static'
list ipaddr '192.168.15.1/24'
option ip6assign '60'
list ip6class 'local'
option ip6hint '10'
option device 'br-vlan.15'
config interface 'vpn'
option proto 'wireguard'
option private_key '
option ip4table '20'
option ip6table '20'
list addresses ''
list addresses ''
option multipath 'off'
config rule
option in 'lan_vpn'
option lookup '20'
option priority '990'
config rule
option in 'lan_vpn'
option action 'prohibit'
option priority '991'
config rule6
option in 'lan_vpn'
option lookup '20'
option priority '990'
config rule6
option in 'lan_vpn'
option action 'prohibit'
option priority '991'
config wireguard_vpn
option public_key ''
option endpoint_host ''
option endpoint_port '51820'
option persistent_keepalive '25'
option route_allowed_ips '1'
option description 'de-dus-wg-001'
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
config bridge-vlan 'vlan_1'
option device 'br-vlan'
option vlan '1'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
config bridge-vlan 'vlan_8'
option device 'br-vlan'
option vlan '8'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
config bridge-vlan 'vlan_15'
option device 'br-vlan'
option vlan '15'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
config interface 'onu'
option proto 'static'
option device 'wan'
option ipaddr '192.168.100.2'
option netmask '255.255.255.0'
option multipath 'off'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone 'lan'
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone 'wan'
option name 'wan'
option input 'DROP'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan_6'
list network 'onu'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
option enabled '1'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
option enabled '1'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
option enabled '1'
config redirect
option name 'lan Intercept-DNS'
option src 'lan'
option src_dport '53'
option family 'any'
config zone 'guest'
option name 'guest'
list network 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config rule
option name 'guest Allow-DNS-DHCP-NTP'
option src 'guest'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53 67 123'
option enabled '1'
config rule
option name 'vpn Allow-DNS-DHCP-NTP'
option src 'lan_vpn'
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53 67 123'
option enabled '1'
config rule
option name 'guest Allow-Ping'
option src 'guest'
option target 'ACCEPT'
option proto 'icmp'
option family 'ipv4'
list icmp_type 'echo-request'
option enabled '0'
config rule
option name 'guest Allow-DHCPv6'
option src 'guest'
option target 'ACCEPT'
option proto 'udp'
option family 'ipv6'
option dest_port '546'
option enabled '0'
config rule
option name 'guest Allow-MLD'
option src 'guest'
option target 'ACCEPT'
option proto 'icmp'
option family 'ipv6'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option enabled '0'
config rule
option name 'guest Allow-ICMPv6-Input'
option src 'guest'
option target 'ACCEPT'
option proto 'icmp'
option family 'ipv6'
option limit '1000/sec'
list icmp_type 'bad-header'
list icmp_type 'destination-unreachable'
list icmp_type 'echo-reply'
list icmp_type 'echo-request'
list icmp_type 'neighbour-advertisement'
list icmp_type 'neighbour-solicitation'
list icmp_type 'packet-too-big'
list icmp_type 'router-advertisement'
list icmp_type 'router-solicitation'
list icmp_type 'time-exceeded'
list icmp_type 'unknown-header-type'
option enabled '0'
config redirect
option name 'guest Intercept-DNS'
option src 'guest'
option src_dport '53'
option family 'any'
config forwarding 'guest_to_wan'
option src 'guest'
option dest 'wan'
config zone
option name 'lan_vpn'
list network 'lan_vpn'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config zone 'wan_nat6'
option name 'wan_nat6'
list network 'vpn'
option masq '1'
option masq6 '1'
option mtu_fix '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding 'lan_vpn_to_wan_nat6'
option src 'lan_vpn'
option dest 'wan_nat6'
config rule
option src 'guest'
option name 'guest Block All'
option target 'DROP'
option enabled '1'
config rule
option name 'Block-DoT-DoQ'
option src '*'
option dest '*'
option dest_port '853'
option target 'REJECT'
option enabled '1'
root@OpenWrt:~#
The "guest Block All" rule I followed the video from Youtube of VanTechCorner
There's a lot of stuff in your config that looks a bit odd... like you were reinventing the wheel. However...
The device here should be @wan:
This probably won't do anything:
And your rule for blocking the modem is probably going to look like this:
config rule
option name 'Block-onu-from-guest'
option src `guest`
option dest 'wan'
option dest_ip '192.168.100.0/24'
option target 'REJECT'
Really?? 
like what do you see odd in there??
I can still access the modem on guest network
Edit: Now I can't it took a while but it doesn't work anymore
Sorry for wasting your time 
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! 
Done 
but can you give me a hint of what's odd in my configuration I can maybe try to re-do it
Thanks for the help!!
Just some of the IPv6 rules you've added to the guest network, and the like. If everything is working, you're fine. But typically those apply to the wan and aren't necessary on the lan/guest side.
Ohh! those are there maybe someday when I have ipv6 available (they're disabled though) as of now my isp doesn't really provide ipv6 it's only ipv4 behind cgnat as well and I didn't know I copied these from another person I searched many websites on what's the best way to get a guest network that's completely isolated also got some help from LLM still learning on what's good to have and what's not sorry for that but yeah everything works fine!!
So... yeah, not needed.
This is a huge liability. In fact, I did not review your configs in detail -- I was only looking for what was necessary to solve your issue. I would actually recommend that you reset and start over from scratch. We have not yet seen LLMs achieve a fully correct and secure config.
Use the guest network link provided earlier.
Did you review them just now and told me this 
Oh.. but I didn't really use LLM to like configure everything only few steps which I got stuck on doing myself if you say my configuration is not secure I can do it again would take some time
I followed mostly from OpenWrt Wiki Guide
AdGuard Home
WireGuard Client Setup and help from "egc"
Irqbalance
Access Modem through Modem
etc you're getting my point right
Thanks again for the help! 