Some websites not accessible on Guest

Installing and Using OpenWrt
1

Hello everyone,
I am new to openwrt and i am trying to setup a DumbAP with a guest wifi but i encountered a problem.
I set up everything according to the DumbAp and relative Guest guide but on the guest network some websites and apps won't load.
I can traceroute and ping fine from pc those website, but the traceroute on phone stops at the 4th hops and from the browser, either on phone or PC it says either ERR_CONNECTION_RESET or ERR_QUIC_PROTOCOL_ERROR,
but if i try to connect to those website when i am directly connected to the main router, or using the main wifi network of the dumb AP, everything works perfectly.
For now i found not working Facebook, Instagram, Telegram, Reddit and Discord, even the apps don't load on the guest.
It's driving me mad.

Can you help me?
This is my config

system board

{
        "kernel": "5.15.137",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7621 ver:1 eco:4",
        "model": "TP-Link EAP613 v1",
        "board_name": "tplink,eap613-v1",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.2",
                "revision": "r23630-842932a63d",
                "target": "ramips/mt7621",
                "description": "OpenWrt 23.05.2 r23630-842932a63d"
        }
}

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd8e:5ffb:e9f5::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan'

config interface 'lan'
        option device 'br-lan'
        option proto 'dhcp'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.3.1'
        option netmask '255.255.255.0'

/etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option log '1'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'lan'

config rule
        option name 'Guest_DHCP'
        option target 'ACCEPT'
        option proto 'udp'
        option src 'guest'
        option src_port '68'
        option dest_port '67'
        option family 'ipv4'

config rule
        option name 'Guest_DNS'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'tcp'
        list proto 'udp'
        option family 'ipv4'

config rule
        option name 'Guest_Block_LAN'
        option src 'guest'
        option dest 'lan'
        list dest_ip '192.168.1.0/24'
        option target 'REJECT'
        option family 'ipv4'
        list proto 'all'
        option enabled '0'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HE20'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option disabled '1'

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid '*'
        option encryption 'sae'
        option key '*'
        option network 'lan'

config wifi-iface 'wifinet1'
        option device 'radio0'
        option mode 'ap'
        option ssid '*'
        option encryption 'sae'
        option key '*'
        option network 'guest'

Thank you in advance

2

There's nothing in this configuration that would cause the problem you're describing. Can you test with the same phone/PC connected to the upstream network instead?

1 Like
3

On the Upstream netowork everything works fine with all my devices. Everything works fine even if i connect on the wifi paired with the lan, but as soon i connect to the guest things break

i don't even know what to do anymore to troubleshoot this

4

Ok, i found out that the problem is not with the guest network, but with the AP Itself.

I tried to curl all the websites from the first post from openwrt ssh and got the error

curl: (35) Recv failure: Connection reset by peer

But on other websites, like google or bing, i get no error.

Same behavior with my pc if i set the AP as gateway.
everything works fine if the gateway is my ISP router.

I tried resetting the AP but nothing changed.

5

Ok i finally found the problem, it was the lan interface MAC Address.
I changed the last digit and ewverything worked fine, even though i don't know why the MAC would even a problem

6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.