[Solved] Getting dhcp on lan but no surf

Installing and Using OpenWrt Network and Wireless Configuration
1

figured out how to get my trendnet tu3-etg usb 3gb eth to light up ..
dhcp gives ip 192.168.2.x to locals .. but no one can get out.
destination unreachable.

i followed the steps online through multiple pages .. but it looks like there is a rule somewhere not letting traffic out .

anyone run into this before .

Model Raspberry Pi 3 Model B Rev 1.2
Firmware Version LEDE Reboot 17.01.4 r3560-79f57e422d / LuCI lede-17.01 branch (git-17.290.79498-d3f0685)
Kernel Version 4.4.92

======
root@LEDE:/etc/config# cat network

config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd89:81d7:c70e::/48'

config interface 'lan'
option type 'bridge'
option ifname 'eth0'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.2.1'
option broadcast '192.168.2.255'

config interface 'WAN'
option ifname 'eth1'
option _orig_ifname 'eth1'
option _orig_bridge 'false'
option proto 'static'
option ipaddr '192.168.42.105'
option netmask '255.255.255.0'
option gateway '192.168.42.1'
option dns '192.168.42.129'
config route

======

root@LEDE:/etc/config# cat firewall

config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config include
option path '/etc/firewall.user'

config zone
option name 'eth1'
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option network 'WAN'

=======

root@LEDE:/etc/config# cat dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
option localservice '1'
option nonwildcard '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option ra 'server'
list dhcp_option '6,8.8.8.8'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'

config host

======================

root@LEDE:/etc/config# uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd89:81d7:c70e::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0'
network.lan.proto='static'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ipaddr='192.168.2.1'
network.lan.broadcast='192.168.2.255'
network.WAN=interface
network.WAN.ifname='eth1'
network.WAN._orig_ifname='eth1'
network.WAN._orig_bridge='false'
network.WAN.proto='static'
network.WAN.ipaddr='192.168.42.105'
network.WAN.netmask='255.255.255.0'
network.WAN.gateway='192.168.42.1'
network.WAN.dns='192.168.42.129'
network.@route[0]=route

2

This is set to a local IP address.

It should be something like Google's DNS server 8.8.8.8

3

I agree with @jwoods, although if the gateway that is at 192.168.42.1 also has DNS, you can use that DNS if you like. Either way, it needs to be outside your RPi.

If that doesn't work, try performing ping tests, first from the RPi itself (ssh into it) and then from a host downstream of it. This series of ping tests starts local and moves progressively out towards the internet and finally using DNS.

ping 192.168.2.1
ping 192.168.42.1
ping 8.8.8.8
ping google.com

EDIT: just realizing that 192.168.42.129 might possibly be a local DNS server that you may have on your network... if that is the case, it should, in theory, be okay... but to rule out an issue there, it is a good idea to set the DNS from the gateway (assuming it is also providing DNS), ISP, or public DNS server.

4

Use lowercase "wan" for the name of your wan network. By convention, only lowercase should be used for the names of all network interfaces and adapters. (This is despite LuCI showing names in uppercase, though the kernel has it in lowercase).

You don't need the firewall zone you added at the bottom called "eth1". There is by default a wan zone attached to the wan (note lowercase) network.

Run ifconfig to make sure your second ethernet adapter is up and configured. Kernel drivers must be installed. There is also the issue that upon bootup it is kind of arbitrary which one will become eth0 and which one is eth1.

Usually when you double-NAT you can let the wan network obtain an address by DHCP.

As noted, the wan dhcp should be pointed at your Internet gateway router or a public DHCP server.

5

I fixed it redid the install fresh..

That ip is my pihole :stuck_out_tongue: