I have a home network that I'm converting from an ASUS RT-N66U router (stock firmware) to a TP Link Archer C7 (AC 1750 - v4) running OpenWRT.
Flashing the firmware went smoothly using OpenWrt 18.06.1 r7258-5eb055306f / LuCI openwrt-18.06 branch (git-18.228.31946-f64b152). I had no problems setting up the internal network, the guest network, and all of the devices on those networks. Where I seem to be stuck is in how to forward internet traffic to two specific endpoints within my network.
The relevant portion of the internal network looks like this:
Router (192.168.1.1) -> Debian KVM hypervisor (192.168.1.40) -> Debian KVM guest (192.168.2.2)
According to the diagnostics page in luci, the router can ping the KVM guest. Other devices on the internal network (including the hypervisor and Windows DHCP wifi clients) can connect to the KVM guest on port 22 and port 80. However, I haven't been able to forward any internet traffic through to the guest. (To eliminate confusion about what is internal and what is external, I have been testing connectivity from a Debian box that's completely independent of my home network.)
I've tried this a bunch of different ways. My initial hope was to forward wlan:80 directly to 192.168.2.2:80, but that doesn't work.
I then set up iptables forwarding on the hypervisor so it would accept traffic on 192.168.1.40:8080 and forward to 192.168.2.2:80, using the rules below. Then, I configured OpenWRT to forward traffic from wlan:80 to 192.168.1.40:8080. No dice.
iptables -I FORWARD -o virbr1 -d 192.168.2.2 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 8080 -j DNAT --to 192.168.2.2:80
iptables -t nat -A OUTPUT -p tcp --dport 8080 -j DNAT --to 192.168.2.2:80
After a few more dead ends, I decided I might have a problem with NAT, and I tried the rewrite rules as suggested by Jo-Philipp Wich at the bottom of this bug. Same behavior.
The other suggestion in that bug was to change the default route, but I wasn't sure exactly where that would be done. The hypervisor has these routes:
default via 192.168.1.1 dev eth0 onlink
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.40
192.168.2.0/24 dev virbr1 proto kernel scope link src 192.168.2.1
The guest has these:
default via 192.168.2.1 dev eth0 onlink
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.2
I don't think I can change the guest to use 192.168.1.1 as the default route, since that network isn't reachable from the guest's virtual network.
The hypervisor is currently sitting on an eth0 wired connection using this virsh network:
<network connections='3'>
<name>virtual</name>
<forward mode="nat" dev="eth0"/>
<bridge name='virbr1' stp='on' delay='0'/>
<mac address='52:xx:yy:zz:a0:b9'/>
<ip address='192.168.2.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.2.2' end='192.168.2.250'/>
<host mac='52:xx:00:00:00:01' ip='192.168.2.2'/>
<host mac='52:xx:00:00:00:02' ip='192.168.2.3'/>
<host mac='52:xx:00:00:00:03' ip='192.168.2.4'/>
</dhcp>
</ip>
</network>
I've also tried it on a wireless wlan0 network with <forward mode='route'/>, which is my preference (if possible) because the room the hypervisor normally lives in doesn't have a wired connection right now.
I'm at a loss. Can someone point me at what I might be missing? After staring at this for too many hours, I'm not sure whether I'm just being dense and missing some obvious step, or something is broken. This whole setup used to work with the ASUS router, so it it seems like it should be possible.