[SOLVED] Issue with subnet isolation on multiple lan interfaces

Installing and Using OpenWrt
1

Hello everyone,

TL;DR: My two LAN subnets on separate interfaces and firewall zones can still access each other router’s web interface—how can I isolate them?

I have an issue with subnet isolation in my setup.

Here is my configuration:

  • I am using a Raspberry Pi 5 with OpenWrt 24.10.0-rc2, connected to my ISP router through Ethernet.
  • A USB Wi-Fi dongle (AWUS036ACM) is plugged in, in addition to the built-in Wi-Fi.

I have three interfaces configured:

  • WAN connected to eth0 and uses the DHCP protocol (192.168.1.0/24).
  • Two LANs, each linked to a Wi-Fi device set up as an access point, with IP address ranges 192.168.2.0/24 and 192.168.3.0/24.

I have three firewall zones configured: one for each LAN and one for the WAN interface. Each LAN forwards traffic to the WAN zone.

Question: Why can I access the router IP 192.168.3.1 while connected to the 192.168.2.0/24 subnet (and vice versa)?

Ubus

{
	"kernel": "6.6.63",
	"hostname": "OpenWrt",
	"system": "ARMv8 Processor rev 1",
	"model": "Raspberry Pi 5 Model B Rev 1.0",
	"board_name": "raspberrypi,5-model-b",
	"rootfs_type": "ext4",
	"release": {
		"distribution": "OpenWrt",
		"version": "24.10.0-rc2",
		"revision": "r28161-ea17e958b9",
		"target": "bcm27xx/bcm2712",
		"description": "OpenWrt 24.10.0-rc2 r28161-ea17e958b9",
		"builddate": "1733226068"
	}
}

Network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdec:198a:526d::/48'

config interface 'lan_1'
	option proto 'static'
	option device 'radio0.network1'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'

config interface 'lan_2'
	option proto 'static'
	option device 'radio1.network1'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth0'

DHCP

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'lan_1'
	option interface 'lan_1'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'lan_2'
	option interface 'lan_2'
	option start '100'
	option limit '150'
	option leasetime '12h'

Firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config zone
	option name 'lan_1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan_1'

config zone
	option name 'lan_2'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan_2'

config zone
	option name 'wan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan_1'
	option dest 'wan'

config forwarding
	option src 'lan_2'
	option dest 'wan'
2

Because the zone's input rule is Accept. This includes any IP assigned to the router, regardless of interface.

1 Like
3

Thank you. However, setting the zone’s input rule to reject makes the router inaccessible via its lan IP (192.168.2.1 or 192.168.3.1), even from its own subnet, which is not wanted.

From LAN 1, I want to access the router only at 192.168.2.1, not 192.168.3.1, and vice versa.

4

You can make firewall rules to block the unwanted DST IP on the undesired network if you desire only a response from a particular IP when the SRC is a particular network.

OpenWrt is a zone based firewall, so the behavior you describe is otherwise expected and normal. The rules are based on the zone, so the input traffic is allowed to the router, regardless of the DST IP the SRC device in a particular zone uses.

I made the same observation when first using OpenWrt. Welcome to the community!

1 Like
5

Thank you, it's much clearer now! :bowing_man:

1 Like
6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.