[SOLVED] Phone Tethering with two routers

Installing and Using OpenWrt
1

Screenshot 2022-03-19 at 17-56-54 Untitled Diagram.drawio - diagrams.net
Screenshot 2022-03-19 at 17-56-54 Untitled Diagram.drawio - diagrams.net1232×843 87.6 KB

I am trying unsuccessfully to share my 4G broadband connection from my phone to my house using a router. Both the phone and the router are placed at the roof of my house and are connected with ethernet cable to my main router.
If I connect with my laptop to the roof router directly I have connection and the router can ping any destination without problem but when I connect to it from my main router I can access the routers interface but I have no connection
My wan interface has no special settings just static ip
ip 192.168.8.5
subnet 255.255.255.0
gateway 192.168.8.1
dns 1.1.1.1

I am really clueless here, I suspect firewall issue but I don't know where to start

2

your main router appears to have 2 internet connections, right? If so, you'll need to use mwan to handle that scenario.

3

I have installed mwan but didnt bother to configure it yet, I will when both connections are working.
All the tests are being performed by disabling wan1 and working only with wan2, so mwan shouldn't be needed

4

Let's see the configuration of each of the routers -- please make it clear which one is which.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall
5

Main Router

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd6a:b843:3b28::/48'

config atm-bridge 'atm'
        option encaps 'llc'
        option payload 'bridged'
        option nameprefix 'dsl'
        option vci '32'
        option vpi '1'

config dsl 'dsl'
        option annex 'a'
        option tone 'av'
        option ds_snr_offset '0'

config device
        option name 'br-lan'
        option type 'bridge'
        option macaddr '40:f2:01:15:40:50'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.5.2'
        list dns '192.168.5.103'

config device
        option name 'dsl0'
        option macaddr '40:f2:01:15:40:51'

config interface 'wan'
        option proto 'pppoe'
        option username 'xxxxxxxxxxxxxx'
        option password 'xxxxxxxxxx'
        option ipv6 'auto'
        option type 'bridge'
        option device 'eth0.2'
        option metric '10'

config interface 'wan6'
        option device '@wan'
        option proto 'dhcpv6'
        option type 'bridge'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0 1 2 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '5 6t'
        option vid '2'


config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '4 6t'

config device
        option name 'eth1'
        option acceptlocal '1'

config interface 'WAN2'
        option proto 'static'
        option device 'eth0.3'
        option ipaddr '192.168.8.5'
        option netmask '255.255.255.0'
        option gateway '192.168.8.1'
  • /etc/config/firewall*
config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'WAN2'

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option name 'wg'
        option masq '1'
        list network 'Wireguard'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config redirect
        option target 'DNAT'
        option src 'lan'
        option src_dport '53'
        option dest 'lan'
        option dest_port '53'
        option name 'Redirect Dns Queries to PiHole'
        option src_ip '!192.168.5.103'
        option dest_ip '192.168.5.103'

config nat
        list proto 'tcp'
        list proto 'udp'
        option src 'lan'
        option dest_port '53'
        option dest_ip '192.168.5.103'
        option target 'MASQUERADE'

ROOF Router

/etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd2:0ac4:cc77::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option hostname 'GL-AR300M-9b0'
        option ifname 'eth1'
        option ipaddr '192.168.8.1'

config device 'lan_dev'
        option name 'eth1'
        option macaddr 'e4:95:6e:40:b9:b0'

config interface 'tethering'
        option proto 'dhcp'
        option ifname 'usb0'
        option metric '30'
        option disabled '0'

config interface 'wwan'
        option proto 'dhcp'
        option metric '20'
        option auto '0'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option mtu_fix '1'
        option input 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'tethering'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'
        option enabled '1'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'
        option reload '1'

config include 'glfw'
        option type 'script'
        option path '/usr/bin/glfw.sh'
        option reload '1'

config zone 'guestzone'
        option name 'guestzone'
        option forward 'REJECT'
        option output 'ACCEPT'
        option input 'REJECT'

config forwarding 'guestzone_fwd'
        option src 'guestzone'
        option dest 'wan'
        option enabled '1'

config rule 'guestzone_dhcp'
        option name 'guestzone_DHCP'
        option src 'guestzone'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '67-68'

config rule 'guestzone_dns'
        option name 'guestzone_DNS'
        option src 'guestzone'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53'

config rule 'glservice_rule'
        option name 'glservice'
        option dest_port '83'
        option proto 'tcp udp'
        option src 'wan'
        option target 'ACCEPT'
        option enabled '0'

config include 'mwan3'
        option type 'script'
        option path '/var/etc/mwan3.include'
        option reload '1'

config include 'gls2s'
        option type 'script'
        option path '/var/etc/gls2s.include'
        option reload '1'

config include 'glqos'
        option type 'script'
        option path '/usr/sbin/glqos.sh'
        option reload '1'

config rule 'sambasharewan'
        option src 'wan'
        option dest_port '137 138 139 445'
        option dest_proto 'tcpudp'
        option target 'DROP'

config rule 'sambasharelan'
        option src 'lan'
        option dest_port '137 138 139 445'
        option dest_proto 'tcpudp'
        option target 'ACCEPT'

config forwarding
        option dest 'lan'
        option src 'wan'

config nat
        list proto 'tcp'
        list proto 'udp'
        option dest_ip '192.168.8.15'
        option src 'wan'
        option target 'MASQUERADE'
        option device 'usb0'
        option enabled '0'

config rule
        option dest 'lan'
        option src 'wan'
        option target 'ACCEPT'
        list dest_ip '192.168.8.15'
        option name 'lan pass traffic'

config rule
        option src 'lan'
        option name 'lan pass traffic'
        list src_ip '192.168.8.15'
        option dest 'wan'
        option target 'ACCEPT'
6

I don't need my Roof Router necessarilly in different subnet I just thought it would be easier to setup, if you believe that we should put all under same subnet I can make the change

7

They need to be a separate subnet. The house router will be routing 192.168.1.0 -> 192.168.8.0 and / or the DSL line. This is all good.

The roof router seems to have a 'wwan' network that isn't doing anything, delete it.

You should be able to connect a laptop directly to the roof router, DHCP pull a 192.168.8.X address, and access the Internet via the phone. Once that works you can consider the house router.

On the house router, testing without mwan, you should fully disable the DSL connection with an option disabled 1 under wan. Then WAN2 should take over. Rename wan2 in lower case to be consistent.

1 Like
8

I could not believe my eyes, the problem was the capital name I had used for wan.
I renamed the interface and magically everything worked like a charm, just like that.
I even setup mwan3 and worked from the beginning no second try.

Thank you all for the help, I am sure I wouldn't have figured that out by myself.
As it seems consistency really matters :smile:

PS: just for reference I used this guide for mwan setup, in case somebody need it

9

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.