When connecting to my guest network DNS lookups are reallllly slow. When connecting to my trusted network DNS resolving is fast (or at least good enough for me at this stage in time)
For more background information on how it is setup:https://forum.openwrt.org/t/solved-guest-interface-on-openwrt-19-7-4
Is there anyway I can debug why DNS is sooo much slower for the Guests network than the trusted network?
network
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd68:74a7:6e62::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '10.0.0.1'
option netmask '255.252.0.0'
option delegate '0'
option force_link '0'
config interface 'wan'
option ifname 'eth1.2'
option proto 'dhcp'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 2 3 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4 6t'
config interface 'if_Trusted'
option proto 'static'
option force_link '0'
option type 'bridge'
option ipaddr '10.4.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.40'
option delegate '0'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '2t 5t'
option vid '40'
config interface 'if_Guests'
option proto 'static'
option type 'bridge'
option ipaddr '10.5.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.50'
option delegate '0'
option force_link '0'
config switch_vlan
option device 'switch0'
option vlan '4'
option ports '2t 5t'
option vid '50'
config interface 'if_tmp_oldlan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ifname '@lan'
firewall
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option synflood_protect '1'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan if_Trusted if_Servers if_Switch_APs if_IOT if_Peripherals if_tmp_oldlan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'lan'
option name 'block iot wan'
option src_ip '192.168.1.128/25'
option dest 'wan'
option target 'DROP'
config rule
option src 'lan'
option name 'block default ipcam'
option src_ip '192.168.1.10'
option dest 'wan'
option target 'DROP'
config redirect
option dest_port '443'
option src 'wan'
option name 'guideriis'
option src_dport '443'
option target 'DNAT'
option dest 'lan'
option proto 'tcp udp'
option dest_ip '192.168.1.111'
config zone 'guest'
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option network 'guest if_Guests'
config forwarding 'guest_wan'
option src 'guest'
option dest 'wan'
config rule 'guest_dns'
option name 'Allow-DNS-Guest'
option src 'guest'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
config rule 'guest_dhcp'
option name 'Allow-DHCP-Guest'
option src 'guest'
option dest_port '67'
option family 'ipv4'
option proto 'udp'
option target 'ACCEPT'
dhcp
root@OpenWrt:~# cat /etc/config/dhcp
config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option sequential_ip '1'
option localservice '0'
option boguspriv '0'
#option logdhcp '1'
#option logqueries '1'
#option logfacility '/tmp/dnsmasq.log'
#config dhcp 'wan'
# option interface 'wan'
# option ignore '1'
#config odhcpd 'odhcpd'
# option maindhcp '0'
# option leasefile '/tmp/hosts/odhcpd'
# option leasetrigger '/usr/sbin/odhcpd-update'
# option loglevel '7'
config dhcp 'if_Trusted'
option interface 'if_Trusted'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
config dhcp 'if_Guests'
option interface 'if_Guests'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
Post the runtime network+DNS configuration from the client.
1 Like
is this what you meant?
root@OpenWrt:~# ubus call system board; \
> uci export network; \
> uci export dhcp; uci export firewall; \
> head -n -0 /etc/firewall.user; \
> iptables-save -c; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.*
/tmp/resolv.* /tmp/resolv.*/*
{
"kernel": "4.14.195",
"hostname": "OpenWrt",
"system": "ARMv7 Processor rev 1 (v7l)",
"model": "Linksys WRT3200ACM",
"board_name": "linksys,rango",
"release": {
"distribution": "OpenWrt",
"version": "19.07.4",
"revision": "r11208-ce6496d796",
"target": "mvebu/cortexa9",
"description": "OpenWrt 19.07.4 r11208-ce6496d796"
}
}
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd68:74a7:6e62::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '10.0.0.1'
option netmask '255.252.0.0'
option delegate '0'
option force_link '0'
config interface 'wan'
option ifname 'eth1.2'
option proto 'dhcp'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 2 3 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4 6t'
config interface 'if_Trusted'
option proto 'static'
option force_link '0'
option type 'bridge'
option ipaddr '10.4.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.40'
option delegate '0'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '2t 5t'
option vid '40'
config interface 'if_Guests'
option proto 'static'
option type 'bridge'
option ipaddr '10.5.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.50'
option delegate '0'
option force_link '0'
config switch_vlan
option device 'switch0'
option vlan '4'
option ports '2t 5t'
option vid '50'
config interface 'if_tmp_oldlan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ifname '@lan'
package dhcp
config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option sequential_ip '1'
option localservice '0'
option boguspriv '0'
config dhcp 'if_Trusted'
option interface 'if_Trusted'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
config dhcp 'if_Guests'
option interface 'if_Guests'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
package firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option synflood_protect '1'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan if_Trusted if_Servers if_Switch_APs if_IOT if_Peripherals if_tmp_oldlan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'lan'
option name 'block iot wan'
option src_ip '192.168.1.128/25'
option dest 'wan'
option target 'DROP'
config rule
option src 'lan'
option name 'block default ipcam'
option src_ip '192.168.1.10'
option dest 'wan'
option target 'DROP'
config redirect
option dest_port '443'
option src 'wan'
option name 'guideriis'
option src_dport '443'
option target 'DNAT'
option dest 'lan'
option proto 'tcp udp'
option dest_ip '192.168.1.111'
config zone 'guest'
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option network 'guest if_Guests'
config forwarding 'guest_wan'
option src 'guest'
option dest 'wan'
config rule 'guest_dns'
option name 'Allow-DNS-Guest'
option src 'guest'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
config rule 'guest_dhcp'
option name 'Allow-DHCP-Guest'
option src 'guest'
option dest_port '67'
option family 'ipv4'
option proto 'udp'
option target 'ACCEPT'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
# Generated by iptables-save v1.8.3 on Thu Nov 12 18:17:36 2020
*nat
:PREROUTING ACCEPT [218716:21975752]
:INPUT ACCEPT [58287:4571370]
:OUTPUT ACCEPT [20663:1421289]
:POSTROUTING ACCEPT [7427:734886]
:postrouting_guest_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_guest_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_guest_postrouting - [0:0]
:zone_guest_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[218716:21975752] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[49015:5645453] -A PREROUTING -i br-if_Trusted -m comment --comment "!fw3" -j zone_lan_prerouting
[167690:15996551] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[294:32303] -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
[1717:301445] -A PREROUTING -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_prerouting
[51497:5005851] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[35:5813] -A POSTROUTING -o br-if_Trusted -m comment --comment "!fw3" -j zone_lan_postrouting
[7199:714041] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[44070:4270965] -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
[93:7832] -A POSTROUTING -o br-if_Guests -m comment --comment "!fw3" -j zone_guest_postrouting
[93:7832] -A zone_guest_postrouting -m comment --comment "!fw3: Custom guest postrouting rule chain" -j postrouting_guest_rule
[1717:301445] -A zone_guest_prerouting -m comment --comment "!fw3: Custom guest prerouting rule chain" -j prerouting_guest_rule
[7234:719854] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[0:0] -A zone_lan_postrouting -s 10.0.0.0/14 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.0.0.1
[0:0] -A zone_lan_postrouting -s 10.0.0.0/14 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.0.0.1
[0:0] -A zone_lan_postrouting -s 10.4.0.0/16 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.4.0.1
[0:0] -A zone_lan_postrouting -s 10.4.0.0/16 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.4.0.1
[0:0] -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 192.168.1.1
[0:0] -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 192.168.1.1
[216705:21642004] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_lan_prerouting -s 10.0.0.0/14 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.0.0.0/14 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.4.0.0/16 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.4.0.0/16 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 192.168.1.0/24 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 192.168.1.0/24 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[44070:4270965] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[44070:4270965] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[294:32303] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis" -j DNAT --to-destination 192.168.1.111:443
COMMIT
# Completed on Thu Nov 12 18:17:36 2020
# Generated by iptables-save v1.8.3 on Thu Nov 12 18:17:36 2020
*mangle
:PREROUTING ACCEPT [27497256:13098441225]
:INPUT ACCEPT [130026:18070279]
:FORWARD ACCEPT [27345038:13077402517]
:OUTPUT ACCEPT [126284:17146886]
:POSTROUTING ACCEPT [27362617:13083393873]
[52115:2958532] -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[19241:1030408] -A FORWARD -i eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Thu Nov 12 18:17:36 2020
# Generated by iptables-save v1.8.3 on Thu Nov 12 18:17:36 2020
*filter
:INPUT ACCEPT [116:22081]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_guest_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_guest_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_guest_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_guest_dest_ACCEPT - [0:0]
:zone_guest_dest_REJECT - [0:0]
:zone_guest_forward - [0:0]
:zone_guest_input - [0:0]
:zone_guest_output - [0:0]
:zone_guest_src_REJECT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
[6651:635685] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
[123375:17434594] -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
[43823:5771464] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[316:18848] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
[16011:1388368] -A INPUT -i br-if_Trusted -m comment --comment "!fw3" -j zone_lan_input
[61554:10131558] -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
[961:59539] -A INPUT -i eth1.2 -m comment --comment "!fw3" -j zone_wan_input
[1026:83665] -A INPUT -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_input
[27345039:13077402557] -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
[9929055:12364959638] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[31411:5217246] -A FORWARD -i br-if_Trusted -m comment --comment "!fw3" -j zone_lan_forward
[17384254:707187184] -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
[0:0] -A FORWARD -i eth1.2 -m comment --comment "!fw3" -j zone_wan_forward
[319:38489] -A FORWARD -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_forward
[74:5405] -A FORWARD -m comment --comment "!fw3" -j reject
[6993:663045] -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
[118217:16172034] -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
[96487:14676200] -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[56:12855] -A OUTPUT -o br-if_Trusted -m comment --comment "!fw3" -j zone_lan_output
[1:68] -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
[21628:1470951] -A OUTPUT -o eth1.2 -m comment --comment "!fw3" -j zone_wan_output
[45:11960] -A OUTPUT -o br-if_Guests -m comment --comment "!fw3" -j zone_guest_output
[460:43159] -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
[47:3397] -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
[316:18848] -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
[0:0] -A syn_flood -m comment --comment "!fw3" -j DROP
[45:11960] -A zone_guest_dest_ACCEPT -o br-if_Guests -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_guest_dest_REJECT -o br-if_Guests -m comment --comment "!fw3" -j reject
[319:38489] -A zone_guest_forward -m comment --comment "!fw3: Custom guest forwarding rule chain" -j forwarding_guest_rule
[319:38489] -A zone_guest_forward -m comment --comment "!fw3: Zone guest to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_guest_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[74:5405] -A zone_guest_forward -m comment --comment "!fw3" -j zone_guest_dest_REJECT
[1026:83665] -A zone_guest_input -m comment --comment "!fw3: Custom guest input rule chain" -j input_guest_rule
[0:0] -A zone_guest_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
[932:64477] -A zone_guest_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
[52:17056] -A zone_guest_input -p udp -m udp --dport 67 -m comment --comment "!fw3: Allow-DHCP-Guest" -j ACCEPT
[0:0] -A zone_guest_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[42:2132] -A zone_guest_input -m comment --comment "!fw3" -j zone_guest_src_REJECT
[45:11960] -A zone_guest_output -m comment --comment "!fw3: Custom guest output rule chain" -j output_guest_rule
[45:11960] -A zone_guest_output -m comment --comment "!fw3" -j zone_guest_dest_ACCEPT
[42:2132] -A zone_guest_src_REJECT -i br-if_Guests -m comment --comment "!fw3" -j reject
[59:13742] -A zone_lan_dest_ACCEPT -o br-if_Trusted -m comment --comment "!fw3" -j ACCEPT
[17276791:696265052] -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
[17415665:712404430] -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
[26585:1595100] -A zone_lan_forward -s 192.168.1.128/25 -p tcp -m comment --comment "!fw3: block iot wan" -j zone_wan_dest_DROP
[80839:9371983] -A zone_lan_forward -s 192.168.1.128/25 -p udp -m comment --comment "!fw3: block iot wan" -j zone_wan_dest_DROP
[0:0] -A zone_lan_forward -s 192.168.1.10/32 -p tcp -m comment --comment "!fw3: block default ipcam" -j zone_wan_dest_DROP
[0:0] -A zone_lan_forward -s 192.168.1.10/32 -p udp -m comment --comment "!fw3: block default ipcam" -j zone_wan_dest_DROP
[17308277:701576379] -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[17276793:696265871] -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[77565:11519926] -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
[0:0] -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[77565:11519926] -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
[57:12923] -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
[57:12923] -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[15895:1366287] -A zone_lan_src_ACCEPT -i br-if_Trusted -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[61554:10131558] -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[172:11289] -A zone_wan_dest_ACCEPT -o eth1.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[53185:6803254] -A zone_wan_dest_ACCEPT -o eth1.2 -m comment --comment "!fw3" -j ACCEPT
[107388:10828051] -A zone_wan_dest_DROP -o eth1.2 -m comment --comment "!fw3" -j DROP
[0:0] -A zone_wan_dest_REJECT -o eth1.2 -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
[0:0] -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
[961:59539] -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
[0:0] -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
[0:0] -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
[570:20520] -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
[0:0] -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[391:39019] -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
[21628:1470951] -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
[21628:1470951] -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
[391:39019] -A zone_wan_src_REJECT -i eth1.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Thu Nov 12 18:17:36 2020
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
19: br-if_Guests: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.5.0.1/16 brd 10.5.255.255 scope global br-if_Guests
valid_lft forever preferred_lft forever
21: br-if_Trusted: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.4.0.1/16 brd 10.4.255.255 scope global br-if_Trusted
valid_lft forever preferred_lft forever
23: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.0.0.1/14 brd 10.3.255.255 scope global br-lan
valid_lft forever preferred_lft forever
inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
25: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.178.20/24 brd 192.168.178.255 scope global eth1.2
valid_lft forever preferred_lft forever
default via 192.168.178.1 dev eth1.2 proto static src 192.168.178.20
10.0.0.0/14 dev br-lan proto kernel scope link src 10.0.0.1
10.4.0.0/16 dev br-if_Trusted proto kernel scope link src 10.4.0.1
10.5.0.0/16 dev br-if_Guests proto kernel scope link src 10.5.0.1
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
192.168.178.0/24 dev eth1.2 proto kernel scope link src 192.168.178.20
broadcast 10.0.0.0 dev br-lan table local proto kernel scope link src 10.0.0.1
local 10.0.0.1 dev br-lan table local proto kernel scope host src 10.0.0.1
broadcast 10.3.255.255 dev br-lan table local proto kernel scope link src 10.0.0.1
broadcast 10.4.0.0 dev br-if_Trusted table local proto kernel scope link src 10.4.0.1
local 10.4.0.1 dev br-if_Trusted table local proto kernel scope host src 10.4.0.1
broadcast 10.4.255.255 dev br-if_Trusted table local proto kernel scope link src 10.4.0.1
broadcast 10.5.0.0 dev br-if_Guests table local proto kernel scope link src 10.5.0.1
local 10.5.0.1 dev br-if_Guests table local proto kernel scope host src 10.5.0.1
broadcast 10.5.255.255 dev br-if_Guests table local proto kernel scope link src 10.5.0.1
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local proto kernel scope link src 192.168.1.1
local 192.168.1.1 dev br-lan table local proto kernel scope host src 192.168.1.1
broadcast 192.168.1.255 dev br-lan table local proto kernel scope link src 192.168.1.1
broadcast 192.168.178.0 dev eth1.2 table local proto kernel scope link src 192.168.178.20
local 192.168.178.20 dev eth1.2 table local proto kernel scope host src 192.168.178.20
broadcast 192.168.178.255 dev eth1.2 table local proto kernel scope link src 192.168.178.20
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
ls: /tmp/resolv.*/*: No such file or directory
lrwxrwxrwx 1 root root 16 Sep 6 18:19 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r-- 1 root root 32 Nov 10 21:53 /tmp/resolv.conf
-rw-r--r-- 1 root root 58 Nov 11 18:36 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 192.168.178.1 #will be removed soon and then my openwrt router will be directly connected to ISP
search fritz.box
Post connection status/details from your laptop/mobile while connected to the guest network.
I am running debian 10 xfce4 desktop. can you please tell me how I do that?
1 Like
cat /etc/resolv.conf on Trusted
cat /etc/resolv.conf on Guests
So it is the local DNS where the bottleneck lies. I will figure out now where that 8.8.8.8 is comming from
grep -v -e ^# -e ^$ /etc/nsswitch.conf /etc/resolv.conf; \
ip address show; ip route show; ip rule show; \
time nslookup example.org; \
time nslookup example.org 8.8.8.8; \
time nslookup example.org 1.1.1.1
8.8.8.8 was hardcoded in my network manager for the Trusted wireless network.
So the local DNS is the problem which now also applies to the Trusted network
pvedesktop@pvemobile:~$ grep -v -e ^# -e ^$ /etc/nsswitch.conf /etc/resolv.conf; \
> ip address show; ip route show; ip rule show; \
> time nslookup openwrt.org; \
> time nslookup openwrt.org 8.8.8.8; \
> time nslookup openwrt.org 1.1.1.1
/etc/nsswitch.conf:passwd: files systemd
/etc/nsswitch.conf:group: files systemd
/etc/nsswitch.conf:shadow: files
/etc/nsswitch.conf:gshadow: files
/etc/nsswitch.conf:hosts: files mdns4_minimal [NOTFOUND=return] dns
/etc/nsswitch.conf:networks: files
/etc/nsswitch.conf:protocols: db files
/etc/nsswitch.conf:services: db files
/etc/nsswitch.conf:ethers: db files
/etc/nsswitch.conf:rpc: db files
/etc/nsswitch.conf:netgroup: nis
/etc/resolv.conf:domain lan
/etc/resolv.conf:search lan
/etc/resolv.conf:nameserver 10.5.0.1
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp0s31f6: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast master vmbr0 state DOWN group default qlen 1000
link/ether c8:5b:76:72:f3:b6 brd ff:ff:ff:ff:ff:ff
3: wlp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether e4:a7:a0:66:00:8f brd ff:ff:ff:ff:ff:ff
inet 10.5.4.1/16 brd 10.5.255.255 scope global dynamic wlp4s0
valid_lft 91sec preferred_lft 91sec
inet6 fe80::e6a7:a0ff:fe66:8f/64 scope link
valid_lft forever preferred_lft forever
4: vmbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether c8:5b:76:72:f3:b6 brd ff:ff:ff:ff:ff:ff
default via 10.5.0.1 dev wlp4s0
10.5.0.0/16 dev wlp4s0 proto kernel scope link src 10.5.4.1
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
Server: 10.5.0.1
Address: 10.5.0.1#53
Non-authoritative answer:
Name: openwrt.org
Address: 139.59.209.225
;; connection timed out; no servers could be reached
real 0m25.016s
user 0m0.011s
sys 0m0.000s
;; connection timed out; no servers could be reached
real 0m15.010s
user 0m0.010s
sys 0m0.000s
Server: 1.1.1.1
Address: 1.1.1.1#53
Non-authoritative answer:
Name: openwrt.org
Address: 139.59.209.225
Name: openwrt.org
Address: 2a03:b0c0:3:d0::1af1:1
real 0m5.036s
user 0m0.008s
sys 0m0.004s
1 Like
Disable peer DNS and configure a major public DNS provider:https://openwrt.org/docs/guide-user/base-system/dhcp_configuration#upstream_dns_provider
Then check:
# OpenWrt
head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*; \
time nslookup example.org; \
time nslookup example.org 8.8.8.8; \
time nslookup example.org 1.1.1.1
# Client
time nslookup example.org
after these changes:
uci -q delete network.wan.dns
I am no longer able to ssh into 10.0.0.1 (openwrt) using the Guests network
1 Like
trendy
November 12, 2020, 11:11pm
11
These will not work when the upstream nameserver has private IP. That is why you are not getting any response.
iptables-save -c | grep "INPUT -i br-if_Guests"
root@OpenWrt:~# iptables-save -c | grep "INPUT -i br-if_Guests"
After a good night sleep now I am able to connect to OpenWrt when using the Guests interface. Somehow it seems things are cached for well after a router reboot. Is there any way I can make any change forcibly be applied? I.e flush anything related?
I have a concrete example of how (L)uci can make a mess of things.
When moving my guests interface back to it's own fwzone I normally just save&apply.
But when looking at the unsaved changes first I saw references to interfaces that have long since been deleted using (L)uci. Image at the bottom.
Turns out that the lan firewall zone is not properly updated by uci when deleting interfaces from Luci that are still in a firewall zone. I am sure I am doing something wrong but just a heads up to @d…
root@OpenWrt:~# head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*; \
> time nslookup openwrt.org; \
> time nslookup openwrt.org 8.8.8.8; \
> time nslookup openwrt.org 1.1.1.1
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf.auto <==
# Interface if_Guests
nameserver 1.1.1.1
# Interface if_Trusted
nameserver 1.1.1.1
# Interface wan
nameserver 1.1.1.1
head: /tmp/resolv.*/*: No such file or directory
Server: 127.0.0.1
Address: 127.0.0.1#53
Name: openwrt.org
Address 1: 139.59.209.225
Address 2: 2a03:b0c0:3:d0::1af1:1
real 0m 0.00s
user 0m 0.00s
sys 0m 0.00s
Server: 8.8.8.8
Address: 8.8.8.8#53
Name: openwrt.org
Address 1: 139.59.209.225
Address 2: 2a03:b0c0:3:d0::1af1:1
real 0m 0.01s
user 0m 0.00s
sys 0m 0.00s
Server: 1.1.1.1
Address: 1.1.1.1#53
Name: openwrt.org
Address 1: 139.59.209.225
Address 2: 2a03:b0c0:3:d0::1af1:1
real 0m 0.00s
user 0m 0.00s
sys 0m 0.00s
pvedesktop@pvemobile:~$ time nslookup openwrt.org
Server: 10.5.0.1
Address: 10.5.0.1#53
Non-authoritative answer:
Name: openwrt.org
Address: 139.59.209.225
Name: openwrt.org
Address: 2a03:b0c0:3:d0::1af1:1
real 0m0.014s
user 0m0.010s
sys 0m0.000s
1 Like
# Flush DNS cache
/etc/init.d/dnsmasq restart
# Disable DNS caching
uci set dhcp.@dnsmasq[0].cachesize="0"
uci commit dhcp
/etc/init.d/dnsmasq restart
I must be missing something obvious. it's either that or I have found a serious bug in the latest kernel.
Done;
# Flush DNS cache
/etc/init.d/dnsmasq restart
# Disable DNS caching
uci set dhcp.@dnsmasq[0].cachesize="0"
uci commit dhcp
/etc/init.d/dnsmasq restart
when connected to the guests network;
pvedesktop@pvemobile:~$ time nslookup openwrt.org
;; connection timed out; no servers could be reached
real 0m15.010s
user 0m0.006s
sys 0m0.005s
pvedesktop@pvemobile:~$ ssh root@10.0.0.1
root@10.0.0.1's password: # I really should not be getting this far
# after a long long while
Connection closed by 10.0.0.1 port 22 #which is good in one sense but nah not good in all other senses I guess
Current cleaned up config;
root@OpenWrt:/etc/config# cat network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd68:74a7:6e62::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '10.0.0.1'
option netmask '255.252.0.0'
option delegate '0'
option force_link '0'
config interface 'wan'
option ifname 'eth1.2'
option proto 'dhcp'
option peerdns '0'
list dns '1.1.1.1'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 2 3 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4 6t'
config interface 'if_Trusted'
option proto 'static'
option force_link '0'
option type 'bridge'
option ipaddr '10.4.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.40'
option delegate '0'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '2t 5t'
option vid '40'
config interface 'if_Guests'
option proto 'static'
option type 'bridge'
option ipaddr '10.5.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.50'
option delegate '0'
option force_link '0'
config switch_vlan
option device 'switch0'
option vlan '4'
option ports '2t 5t'
option vid '50'
config interface 'if_tmp_oldlan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ifname '@lan'
root@OpenWrt:/etc/config# cat firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option synflood_protect '1'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan if_Trusted if_tmp_oldlan if_Guests'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone 'guest'
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option network 'guest'
config forwarding 'guest_wan'
option src 'guest'
option dest 'wan'
config rule 'guest_dns'
option name 'Allow-DNS-Guest'
option src 'guest'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
config rule 'guest_dhcp'
option name 'Allow-DHCP-Guest'
option src 'guest'
option dest_port '67'
option family 'ipv4'
option proto 'udp'
option target 'ACCEPT'
root@OpenWrt:/etc/config# cat dhcp
config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option sequential_ip '1'
option localservice '0'
option boguspriv '0'
option cachesize '0'
config dhcp 'if_Trusted'
option interface 'if_Trusted'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
config dhcp 'if_Guests'
option interface 'if_Guests'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
Can someone please release me from this misery?
Ill keep one updated
trendy:
I told you already.
My humble apologies. I must have missed that
iptables-save -c | grep "INPUT -i br-if_Guests"
[206:14799] -A INPUT -i br-if_Guests -m comment --comment "!fw3" -j zone_lan_input
[0:0] -A INPUT -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_input
And some weird differences again between Guests and Trusted. The interfaces refuse to use 1.1.1.1 as DNS but on the Trusted network that does not seem to matter
pvedesktop@pvemobile:~$ #current on Guests network
pvedesktop@pvemobile:~$ time nslookup openwrt.org
Server: 10.5.0.1 #not sure why this still lists a private ip even though the wan interface explicitly sets 1.1.1.1
Address: 10.5.0.1#53
Non-authoritative answer:
Name: openwrt.org
Address: 139.59.209.225
Name: openwrt.org
Address: 2a03:b0c0:3:d0::1af1:1
real 0m10.022s #ouch.
user 0m0.005s
sys 0m0.005s
pvedesktop@pvemobile:~$ ssh root@openwrt.lan
ssh: Could not resolve hostname openwrt.lan: Temporary failure in name resolution #good I guess
pvedesktop@pvemobile:~$ ssh root@10.0.0.1
ssh: connect to host 10.0.0.1 port 22: Connection timed out # very good!
pvedesktop@pvemobile:~$ #switching to Trusted network
pvedesktop@pvemobile:~$ time nslookup openwrt.org
Server: 10.4.0.1 #this is also a local ip but this is fast. it's not consistent ;(
Address: 10.4.0.1#53
Non-authoritative answer:
Name: openwrt.org
Address: 139.59.209.225
Name: openwrt.org
Address: 2a03:b0c0:3:d0::1af1:1
real 0m0.023s
user 0m0.010s
sys 0m0.000s
pvedesktop@pvemobile:~$ ssh root@openwrt.lan
root@openwrt.lan's password:
trendy
November 13, 2020, 10:04am
17
Post again everything you have configured here to get the whole picture:
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
iptables-save -c; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
root@OpenWrt:~# ubus call system board; \
> uci export network; uci export wireless; \
> uci export dhcp; uci export firewall; \
> head -n -0 /etc/firewall.user; \
> iptables-save -c; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.*
/tmp/resolv.* /tmp/resolv.*/*
{
"kernel": "4.14.195",
"hostname": "OpenWrt",
"system": "ARMv7 Processor rev 1 (v7l)",
"model": "Linksys WRT3200ACM",
"board_name": "linksys,rango",
"release": {
"distribution": "OpenWrt",
"version": "19.07.4",
"revision": "r11208-ce6496d796",
"target": "mvebu/cortexa9",
"description": "OpenWrt 19.07.4 r11208-ce6496d796"
}
}
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd68:74a7:6e62::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '10.0.0.1'
option netmask '255.252.0.0'
option delegate '0'
option force_link '0'
config interface 'wan'
option ifname 'eth1.2'
option proto 'dhcp'
option peerdns '0'
list dns '1.1.1.1'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0 1 2 3 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4 6t'
config interface 'if_Trusted'
option proto 'static'
option force_link '0'
option type 'bridge'
option ipaddr '10.4.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.40'
option delegate '0'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '2t 5t'
option vid '40'
config interface 'if_Guests'
option proto 'static'
option type 'bridge'
option ipaddr '10.5.0.1'
option netmask '255.255.0.0'
option ifname 'eth0.50'
option delegate '0'
option force_link '0'
config switch_vlan
option device 'switch0'
option vlan '4'
option ports '2t 5t'
option vid '50'
config interface 'if_tmp_oldlan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ifname '@lan'
package wireless
config wifi-device 'radio0'
option type 'mac80211'
option hwmode '11a'
option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
option country 'NL'
option legacy_rates '0'
option txpower '20'
option htmode 'VHT80'
option channel '44'
config wifi-device 'radio1'
option type 'mac80211'
option hwmode '11g'
option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
option txpower '20'
option country 'NL'
option noscan '1'
option channel '6'
option htmode 'HT40'
config wifi-device 'radio2'
option type 'mac80211'
option path 'platform/soc/soc:internal-regs/f10d8000.sdhci/mmc_host/mmc0/mmc0:0001/mmc0:0001:1'
option country 'NL'
config wifi-iface 'wifinet0'
option device 'radio0'
option ssid 'OpenWrt-Trusted+'
option network 'if_Trusted'
option encryption 'psk2'
option mode 'ap'
option key '12345678'
config wifi-iface 'wifinet1'
option device 'radio0'
option ssid 'OpenWrt-Guests+'
option network 'if_Guests'
option encryption 'psk2'
option mode 'ap'
option key '12345678'
config wifi-iface 'wifinet2'
option device 'radio1'
option ssid 'OpenWrt-Trusted'
option network 'if_Trusted'
option encryption 'psk2'
option mode 'ap'
option key '12345678'
config wifi-iface 'wifinet3'
option device 'radio1'
option ssid 'OpenWrt-Guests'
option network 'if_Guests'
option encryption 'psk2'
option mode 'ap'
option key '12345678'
package dhcp
config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option sequential_ip '1'
option localservice '0'
option boguspriv '0'
option cachesize '0'
config dhcp 'if_Trusted'
option interface 'if_Trusted'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
config dhcp 'if_Guests'
option interface 'if_Guests'
option start '1025'
option limit '1000'
option leasetime '2m'
option force '1'
package firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option synflood_protect '1'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan if_Trusted if_tmp_oldlan if_Guests'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone 'guest'
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option network 'if_Guests'
config forwarding 'guest_wan'
option src 'guest'
option dest 'wan'
config rule 'guest_dns'
option name 'Allow-DNS-Guest'
option src 'guest'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
config rule 'guest_dhcp'
option name 'Allow-DHCP-Guest'
option src 'guest'
option dest_port '67'
option family 'ipv4'
option proto 'udp'
option target 'ACCEPT'
config rule
option src 'lan'
option name 'block iot wan'
option src_ip '192.168.1.128/25'
option dest 'wan'
option target 'DROP'
config rule
option src 'lan'
option name 'block default ipcam'
option src_ip '192.168.1.10'
option dest 'wan'
option target 'DROP'
config redirect
option dest_port '443'
option src 'wan'
option name 'guideriis'
option src_dport '443'
option target 'DNAT'
option dest 'lan'
option proto 'tcp udp'
option dest_ip '192.168.1.111'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
# Generated by iptables-save v1.8.3 on Fri Nov 13 11:06:18 2020
*nat
:PREROUTING ACCEPT [7041:738494]
:INPUT ACCEPT [1920:156338]
:OUTPUT ACCEPT [2752:193300]
:POSTROUTING ACCEPT [740:82375]
:postrouting_guest_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_guest_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_guest_postrouting - [0:0]
:zone_guest_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
[7038:738362] -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
[2087:262298] -A PREROUTING -i br-if_Trusted -m comment --comment "!fw3" -j zone_lan_prerouting
[4619:448452] -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
[257:22765] -A PREROUTING -i br-if_Guests -m comment --comment "!fw3" -j zone_lan_prerouting
[75:4847] -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
[257:22765] -A PREROUTING -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_prerouting
[4360:400992] -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
[2:376] -A POSTROUTING -o br-if_Trusted -m comment --comment "!fw3" -j zone_lan_postrouting
[732:80887] -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
[4:1032] -A POSTROUTING -o br-if_Guests -m comment --comment "!fw3" -j zone_lan_postrouting
[3622:318697] -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
[4:1032] -A POSTROUTING -o br-if_Guests -m comment --comment "!fw3" -j zone_guest_postrouting
[4:1032] -A zone_guest_postrouting -m comment --comment "!fw3: Custom guest postrouting rule chain" -j postrouting_guest_rule
[257:22765] -A zone_guest_prerouting -m comment --comment "!fw3: Custom guest prerouting rule chain" -j prerouting_guest_rule
[738:82295] -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
[0:0] -A zone_lan_postrouting -s 10.0.0.0/14 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.0.0.1
[0:0] -A zone_lan_postrouting -s 10.0.0.0/14 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.0.0.1
[0:0] -A zone_lan_postrouting -s 10.4.0.0/16 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.4.0.1
[0:0] -A zone_lan_postrouting -s 10.4.0.0/16 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.4.0.1
[0:0] -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 192.168.1.1
[0:0] -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 192.168.1.1
[0:0] -A zone_lan_postrouting -s 10.5.0.0/16 -d 192.168.1.111/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.5.0.1
[0:0] -A zone_lan_postrouting -s 10.5.0.0/16 -d 192.168.1.111/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j SNAT --to-source 10.5.0.1
[6963:733515] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_lan_prerouting -s 10.0.0.0/14 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.0.0.0/14 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.4.0.0/16 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.4.0.0/16 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 192.168.1.0/24 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 192.168.1.0/24 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.5.0.0/16 -d 192.168.178.20/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_lan_prerouting -s 10.5.0.0/16 -d 192.168.178.20/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis (reflection)" -j DNAT --to-destination 192.168.1.111:443
[3622:318697] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[3622:318697] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[75:4847] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: guideriis" -j DNAT --to-destination 192.168.1.111:443
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 443 -m comment --comment "!fw3: guideriis" -j DNAT --to-destination 192.168.1.111:443
COMMIT
# Completed on Fri Nov 13 11:06:18 2020
# Generated by iptables-save v1.8.3 on Fri Nov 13 11:06:18 2020
*mangle
:PREROUTING ACCEPT [2909518:372202251]
:INPUT ACCEPT [6437:736890]
:FORWARD ACCEPT [2902145:371347612]
:OUTPUT ACCEPT [8210:881406]
:POSTROUTING ACCEPT [2907361:371914342]
[1450:81896] -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[670:35936] -A FORWARD -i eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Fri Nov 13 11:06:18 2020
# Generated by iptables-save v1.8.3 on Fri Nov 13 11:06:18 2020
*filter
:INPUT ACCEPT [7:899]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_guest_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_guest_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_guest_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_guest_dest_ACCEPT - [0:0]
:zone_guest_dest_REJECT - [0:0]
:zone_guest_forward - [0:0]
:zone_guest_input - [0:0]
:zone_guest_output - [0:0]
:zone_guest_src_REJECT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_DROP - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
[18:2796] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
[6424:734354] -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
[3697:394428] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[8:480] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
[773:68677] -A INPUT -i br-if_Trusted -m comment --comment "!fw3" -j zone_lan_input
[1634:249975] -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
[206:14799] -A INPUT -i br-if_Guests -m comment --comment "!fw3" -j zone_lan_input
[114:6475] -A INPUT -i eth1.2 -m comment --comment "!fw3" -j zone_wan_input
[0:0] -A INPUT -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_input
[2902148:371347732] -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
[105961:258679763] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[1421:252063] -A FORWARD -i br-if_Trusted -m comment --comment "!fw3" -j zone_lan_forward
[2794667:112409966] -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
[99:5940] -A FORWARD -i br-if_Guests -m comment --comment "!fw3" -j zone_lan_forward
[0:0] -A FORWARD -i eth1.2 -m comment --comment "!fw3" -j zone_wan_forward
[0:0] -A FORWARD -i br-if_Guests -m comment --comment "!fw3" -j zone_guest_forward
[0:0] -A FORWARD -m comment --comment "!fw3" -j reject
[57:5916] -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
[7991:826714] -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
[5193:630095] -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[4:744] -A OUTPUT -o br-if_Trusted -m comment --comment "!fw3" -j zone_lan_output
[0:0] -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
[5:1360] -A OUTPUT -o br-if_Guests -m comment --comment "!fw3" -j zone_lan_output
[2789:194515] -A OUTPUT -o eth1.2 -m comment --comment "!fw3" -j zone_wan_output
[0:0] -A OUTPUT -o br-if_Guests -m comment --comment "!fw3" -j zone_guest_output
[100:5971] -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
[0:0] -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
[8:480] -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
[0:0] -A syn_flood -m comment --comment "!fw3" -j DROP
[0:0] -A zone_guest_dest_ACCEPT -o br-if_Guests -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_guest_dest_REJECT -o br-if_Guests -m comment --comment "!fw3" -j reject
[0:0] -A zone_guest_forward -m comment --comment "!fw3: Custom guest forwarding rule chain" -j forwarding_guest_rule
[0:0] -A zone_guest_forward -m comment --comment "!fw3: Zone guest to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_guest_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_guest_forward -m comment --comment "!fw3" -j zone_guest_dest_REJECT
[0:0] -A zone_guest_input -m comment --comment "!fw3: Custom guest input rule chain" -j input_guest_rule
[0:0] -A zone_guest_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
[0:0] -A zone_guest_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
[0:0] -A zone_guest_input -p udp -m udp --dport 67 -m comment --comment "!fw3: Allow-DHCP-Guest" -j ACCEPT
[0:0] -A zone_guest_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[0:0] -A zone_guest_input -m comment --comment "!fw3" -j zone_guest_src_REJECT
[0:0] -A zone_guest_output -m comment --comment "!fw3: Custom guest output rule chain" -j output_guest_rule
[0:0] -A zone_guest_output -m comment --comment "!fw3" -j zone_guest_dest_ACCEPT
[0:0] -A zone_guest_src_REJECT -i br-if_Guests -m comment --comment "!fw3" -j reject
[10:1020] -A zone_lan_dest_ACCEPT -o br-if_Trusted -m comment --comment "!fw3" -j ACCEPT
[2792356:112173768] -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
[5:1360] -A zone_lan_dest_ACCEPT -o br-if_Guests -m comment --comment "!fw3" -j ACCEPT
[2796187:112667969] -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
[642:38520] -A zone_lan_forward -s 192.168.1.128/25 -p tcp -m comment --comment "!fw3: block iot wan" -j zone_wan_dest_DROP
[1933:216264] -A zone_lan_forward -s 192.168.1.128/25 -p udp -m comment --comment "!fw3: block iot wan" -j zone_wan_dest_DROP
[0:0] -A zone_lan_forward -s 192.168.1.10/32 -p tcp -m comment --comment "!fw3: block default ipcam" -j zone_wan_dest_DROP
[0:0] -A zone_lan_forward -s 192.168.1.10/32 -p udp -m comment --comment "!fw3: block default ipcam" -j zone_wan_dest_DROP
[2793612:112413185] -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[2792362:112174044] -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[2613:333451] -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
[0:0] -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[2613:333451] -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
[9:2104] -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
[9:2104] -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[766:67778] -A zone_lan_src_ACCEPT -i br-if_Trusted -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[1634:249975] -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[206:14799] -A zone_lan_src_ACCEPT -i br-if_Guests -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[250:10000] -A zone_wan_dest_ACCEPT -o eth1.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[3789:423656] -A zone_wan_dest_ACCEPT -o eth1.2 -m comment --comment "!fw3" -j ACCEPT
[2575:254784] -A zone_wan_dest_DROP -o eth1.2 -m comment --comment "!fw3" -j DROP
[0:0] -A zone_wan_dest_REJECT -o eth1.2 -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
[0:0] -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
[114:6475] -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
[0:0] -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
[0:0] -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
[14:504] -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
[0:0] -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[100:5971] -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
[2789:194515] -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
[2789:194515] -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
[100:5971] -A zone_wan_src_REJECT -i eth1.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Fri Nov 13 11:06:18 2020
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
19: br-if_Guests: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.5.0.1/16 brd 10.5.255.255 scope global br-if_Guests
valid_lft forever preferred_lft forever
21: br-if_Trusted: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.4.0.1/16 brd 10.4.255.255 scope global br-if_Trusted
valid_lft forever preferred_lft forever
23: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 10.0.0.1/14 brd 10.3.255.255 scope global br-lan
valid_lft forever preferred_lft forever
inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
25: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.178.20/24 brd 192.168.178.255 scope global eth1.2
valid_lft forever preferred_lft forever
default via 192.168.178.1 dev eth1.2 proto static src 192.168.178.20
10.0.0.0/14 dev br-lan proto kernel scope link src 10.0.0.1
10.4.0.0/16 dev br-if_Trusted proto kernel scope link src 10.4.0.1
10.5.0.0/16 dev br-if_Guests proto kernel scope link src 10.5.0.1
192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
192.168.178.0/24 dev eth1.2 proto kernel scope link src 192.168.178.20
broadcast 10.0.0.0 dev br-lan table local proto kernel scope link src 10.0.0.1
local 10.0.0.1 dev br-lan table local proto kernel scope host src 10.0.0.1
broadcast 10.3.255.255 dev br-lan table local proto kernel scope link src 10.0.0.1
broadcast 10.4.0.0 dev br-if_Trusted table local proto kernel scope link src 10.4.0.1
local 10.4.0.1 dev br-if_Trusted table local proto kernel scope host src 10.4.0.1
broadcast 10.4.255.255 dev br-if_Trusted table local proto kernel scope link src 10.4.0.1
broadcast 10.5.0.0 dev br-if_Guests table local proto kernel scope link src 10.5.0.1
local 10.5.0.1 dev br-if_Guests table local proto kernel scope host src 10.5.0.1
broadcast 10.5.255.255 dev br-if_Guests table local proto kernel scope link src 10.5.0.1
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 192.168.1.0 dev br-lan table local proto kernel scope link src 192.168.1.1
local 192.168.1.1 dev br-lan table local proto kernel scope host src 192.168.1.1
broadcast 192.168.1.255 dev br-lan table local proto kernel scope link src 192.168.1.1
broadcast 192.168.178.0 dev eth1.2 table local proto kernel scope link src 192.168.178.20
local 192.168.178.20 dev eth1.2 table local proto kernel scope host src 192.168.178.20
broadcast 192.168.178.255 dev eth1.2 table local proto kernel scope link src 192.168.178.20
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
ls: /tmp/resolv.*/*: No such file or directory
lrwxrwxrwx 1 root root 16 Sep 6 18:19 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r-- 1 root root 32 Nov 13 10:16 /tmp/resolv.conf
-rw-r--r-- 1 root root 35 Nov 13 10:16 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 1.1.1.1
head: /tmp/resolv.*/*: No such file or directory
trendy
November 13, 2020, 10:34am
19
if_Guests is defined in 2 zones, lan and guest. It is applied first on lan and will use the policies of the lan zone. Make sure it belongs to one zone only to avoid any issues on the firewall.
1 Like
Thanks for spotting that!
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan if_Trusted if_tmp_oldlan'
But you've guessed it
pvedesktop@pvemobile:~$ time nslookup openwrt.org
;; connection timed out; no servers could be reached
real 0m15.009s
user 0m0.005s
sys 0m0.005s
Just a while ago the guest network started blocking access to openwrt again. without any configuration change on my end what so ever.
Should I file a bug or is the config still not correct?