[Solved] When i modifying the LAN subnet, uhttpd return 403

When i using the latest version of OpenWrt(MiRouterAC2100-OpenWRT 23.05.2), The LAN default subnet is 192.168.1.1/24 . When I modify the LAN subnet to 192.168.2.1/24 , accessing the web interface at http://192.168.2.1 returns a 403 error. Upon inspecting the response headers, I noticed the presence of "X-Xss-Protection: 1; mode=block". Despite attempting to disable browser caching, disabling LAN firewall, and accessing the web interface from different devices, the issue persisted with all attempts returning a 403 error. Additionally, SSH connection to 192.168.2.1 is working perfectly fine.

/etc/config/network:

# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd77::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'
$ curl -vvv "http://192.168.2.1/cgi-bin/luci/"
*   Trying 192.168.2.1:80...
* Connected to 192.168.2.1 (192.168.2.1) port 80 (#0)
> GET /cgi-bin/luci/ HTTP/1.1
> Host: 192.168.2.1
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Connection: Keep-Alive
< Transfer-Encoding: chunked
< Keep-Alive: timeout=20
< x-luci-login-required: yes
< content-type: text/html; charset=UTF-8
< cache-control: no-cache
< expires: 0
< x-frame-options: SAMEORIGIN
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff

Let's see the config:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
cat /etc/config/uhttpd
root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.137",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "Xiaomi Redmi Router AC2100",
        "board_name": "xiaomi,redmi-router-ac2100",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.2",
                "revision": "r23630-842932a63d",
                "target": "ramips/mt7621",
                "description": "OpenWrt 23.05.2 r23630-842932a63d"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd77:eb83:94f5::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

root@OpenWrt:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
root@OpenWrt:~# cat /etc/config/uhttpd

config uhttpd 'main'
        list listen_http '0.0.0.0:80'
        list listen_http '[::]:80'
        list listen_https '0.0.0.0:443'
        list listen_https '[::]:443'
        option redirect_https '0'
        option home '/www'
        option rfc1918_filter '1'
        option max_requests '3'
        option max_connections '100'
        option cert '/etc/uhttpd.crt'
        option key '/etc/uhttpd.key'
        option cgi_prefix '/cgi-bin'
        list lua_prefix '/cgi-bin/luci=/usr/lib/lua/luci/sgi/uhttpd.lua'
        option script_timeout '60'
        option network_timeout '30'
        option http_keepalive '20'
        option tcp_keepalive '1'
        option ubus_prefix '/ubus'

config cert 'defaults'
        option days '730'
        option key_type 'ec'
        option bits '2048'
        option ec_curve 'P-256'
        option country 'ZZ'
        option state 'Somewhere'
        option location 'Unknown'
        option commonname 'OpenWrt'

root@OpenWrt:~#

I don't see any reason that it would be forbidden.

  • What is the IP address of the host from which you are trying to access LuCI?
  • Have you tried a different browser and/or clearing your browser's cache?
  • Is it at all possible that there is another host on your network with the same address (i.e. a conflict) that may be rejecting the connection attempt?
  1. I am accessing the router backend (192.168.2.1) with my computer (192.168.2.144). And before changing the subnet, my computer:192.168.1.42 access router 192.168.1.1 it's ok.
  2. Yes, I tried Chrome/FireFox, and use Incognito mode. The issue still persists.
  3. I have double-checked for any subnet conflicts. I have another router with the subnet 192.168.3.1/24 , as well as two additional virtual network interfaces (192.168.8.1/24 and 192.168.192.1/24 ). There are no IP conflicts.

Unplug your router from all network connections and power. Then connect just one cable between your router's lan port and your computer and reconnect power to your router. Make sure your computer has no other network connections -- turn off wifi if necessary. Wait for your computer to get an IP address from the router, and then try again.

I followed your instructions again, but the issue still persists.

I'd recommend just resetting to defaults. Then, when it comes back in the default state, make the IP address change as your very first thing.

I have already tried. I encountered this issue last week. So i have tried refreshing OpenWrt and reflashing Breed again, but the issue persists.

I've never seen this behavior before.
Is the OpenWrt image the default official image, or has it been customized in some way?

It's official image. And I have checked the SHA256, the file is fine.

I have another router, also using OpenWRT, with the official image. It has been working normally for a year. However, when I checked just now, accessing the backend of that router also resulted in a 403 error. But the HTTP login page's username and password input box can be loaded, and I can log in to the backend and use it normally without any issues.

Now, with this router, I'm getting a 403 error, but the frontend HTTP login page fails to load and keeps spinning. Please see the image below.

Do you have another computer to use?

This is not normal behavior. If you're using a completely default official OpenWrt image, there must be another explanation for the issue you're experiencing.

I'd recommend another computer for this test.

OK, Very thank you. I don’t have an extra computer now. If I can borrow another computer, I will test it. Thank you again for your help.

You could enable wifi and try a phone or tablet, too/

I have tried using my phone, but the issue still persists.

Have you reset your router to defaults since we have been discussing the issue? If not, please try it again. Then change only the lan IP address and nothing else and try again.

In fact, please use a different IP subnet... the subnet you are using should be fine, but I wonder if you are running into some strange conflict in your specific situation.

Try 192.168.5.1.

Yes, I have tried reflash openwrt since we have been discussing the issue, and just only to change the LAN subnet, the issue still persists.

Now I try to change it to 192.168.5.1

What browser(s) are you using?

I've just taken a default configuration of 23.05.2, changed the IP address, and then brought up the LuCI page with zero issues.

PC: Chrome, FireFox
Phone: Chrome

Great, I was able to log in using a non-Chrome browser on my phone, although it still returned a 403 status code. Nevertheless, I was able to log in and use it normally, just like and I successfully changed the subnet. However, I'm still unable to log in using my computer. I don't know why.