Hi, I'm using a GL.iNet GL-AR750S on OpenWrt Snapshot r9813-b812a7fa68 (git-19.093.68468-d679b93).
I've created the router's local WiFi (192.168.168.0/24), and want to use it to connect to other WiFis (with travelmate), ideally (later) with a VPN tunnel to my home firewall. For test purposes, I am connecting to my home wifi (192.168.5.0/24).
What works:
- Connecting to the router's wifi with mobile devices.
- Connecting the router to my home wifi in the sense that I get dhcp assigned IPv4 address (192.168.5.27), gateway (192.168.5.1) and DNS (192.168.1.102).
What does not work:
- Any further connection from the router to machines on my wifi (or lan), or the internet.
I.e., very basically, the router can only ping itself, but nothing more:
root@OpenWrt:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
^C
--- 8.8.8.8 ping statistics ---
6 packets transmitted, 0 packets received, 100% packet loss
root@OpenWrt:~# ping 192.168.5.1
PING 192.168.5.1 (192.168.5.1): 56 data bytes
^C
--- 192.168.5.1 ping statistics ---
8 packets transmitted, 0 packets received, 100% packet loss
root@OpenWrt:~# ping 192.168.5.27
PING 192.168.5.27 (192.168.5.27): 56 data bytes
64 bytes from 192.168.5.27: seq=0 ttl=64 time=0.266 ms
64 bytes from 192.168.5.27: seq=1 ttl=64 time=0.257 ms
64 bytes from 192.168.5.27: seq=2 ttl=64 time=0.257 ms
^C
--- 192.168.5.27 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 0.257/0.260/0.266 ms
Routing does, however, look good to me:
root@OpenWrt:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.5.1 0.0.0.0 UG 0 0 0 wlan1
192.168.5.0 * 255.255.255.0 U 0 0 0 wlan1
192.168.168.0 * 255.255.255.0 U 0 0 0 br-lan
Network configuration:
root@OpenWrt:~# ifconfig
br-lan Link encap:Ethernet HWaddr E4:95:6E:47:68:5C
inet addr:192.168.168.1 Bcast:192.168.168.255 Mask:255.255.255.0
inet6 addr: fde0:2f34:c843::1/60 Scope:Global
inet6 addr: fe80::e695:6eff:fe47:685c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1963 errors:0 dropped:0 overruns:0 frame:0
TX packets:1243 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:276514 (270.0 KiB) TX bytes:262611 (256.4 KiB)
eth0 Link encap:Ethernet HWaddr E4:95:6E:47:68:5C
inet6 addr: fe80::e695:6eff:fe47:685c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:283 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:75623 (73.8 KiB)
Interrupt:4
eth0.1 Link encap:Ethernet HWaddr E4:95:6E:47:68:5C
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:97 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:20359 (19.8 KiB)
eth0.2 Link encap:Ethernet HWaddr E4:95:6E:47:68:5C
inet6 addr: fe80::e695:6eff:fe47:685c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:167 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:52330 (51.1 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:405 errors:0 dropped:0 overruns:0 frame:0
TX packets:405 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:32288 (31.5 KiB) TX bytes:32288 (31.5 KiB)
wlan0 Link encap:Ethernet HWaddr E4:95:6E:47:68:5D
inet6 addr: fe80::e695:6eff:fe47:685d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1964 errors:0 dropped:0 overruns:0 frame:0
TX packets:1323 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:304108 (296.9 KiB) TX bytes:306756 (299.5 KiB)
wlan1 Link encap:Ethernet HWaddr E4:95:6E:47:68:5C
inet addr:192.168.5.27 Bcast:192.168.5.255 Mask:255.255.255.0
inet6 addr: fe80::e695:6eff:fe47:685c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:317 errors:0 dropped:0 overruns:0 frame:0
TX packets:603 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:66064 (64.5 KiB) TX bytes:66046 (64.4 KiB)
wlan1-1 Link encap:Ethernet HWaddr E6:95:6E:47:68:5C
inet6 addr: fe80::e495:6eff:fe47:685c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:94 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:21265 (20.7 KiB)
Firewall config:
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6 trm_wwan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
root@OpenWrt:~# cat /etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
Any hint on what I'm missing would be highly appreciated!