Standalone DHCP server will not work when OpenWRT is online

Jiffy · March 27, 2024, 7:58pm

Hi,

Current set up is OPNSense and a separate dnsmasq container acting as a dhcp/dns server on a docker node. Wanted to kick the tires of OpenWrt out of pure curiosity.

Note, this is all the same hardware, the only difference is between booting the PC with a USB vs the internal drive.

To set up, I've

installed Generic x86/64 23.05.3 on a USB stick and booted the pc from it.
Configured my password
Configured my LAN address
disabled (ignored) dhcp on the br-lan so the standalone server is authoritative.
rebooted

When the PC is booted with OpenWrt, nothing can get a DHCP address from the dnsmasq container.

When I reboot with OPNSense, everything works again.
I've installed pfSense on another USB stick and that works as well.

When OpenWRT is booted, if I manually assign an ip address and my dns server's address to a PC, name lookups and Internet access work. It's just DHCP for everything else does not work.

I can't seem to find that anyone else has had this issue and I'm not quite sure that taking dnsmasq out of the docker container would actually fix this.

There are no mac address conflicts and I'm not even sure what to try.
Any ideas?

Thank you,
Jiffy

psherman · March 27, 2024, 8:02pm

are OPNSense and OpenWrt on the same physical hardawre?

If not, can you draw a diagram of your network topology?

Jiffy · March 27, 2024, 9:38pm

Yes, they are.
OPNSense boots from the internal hard drive.
To test OpenWrt, I boot from a USB stick on the same hardware.
They are NOT running simultaneously.
Thank you

psherman · March 27, 2024, 11:07pm

Ok... let's take a look at the configs:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

Jiffy · March 27, 2024, 11:12pm

Everyone is home and can't take the internet down at the moment.
I'll do this first thing tomorrow morning while they're sleeping.
Thank you!

Jiffy · March 28, 2024, 7:56am

root@OpenWrt:~# ubus call system board
{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "Intel(R) N95",
	"model": "WeiBu ADL-N",
	"board_name": "weibu-adl-n",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "x86/64",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd45:6a97:3951::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.11.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config device
	option name 'eth1'
	option macaddr '<non conflicting, randomly generated mac>'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

root@OpenWrt:~# cat /etc/config/firewall
config defaults
	option syn_flood	1
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
# Uncomment this line to disable ipv6 rules
#	option disable_ipv6	1

config zone
	option name		lan
	list   network		'lan'
	option input		ACCEPT
	option output		ACCEPT
	option forward		ACCEPT

config zone
	option name		wan
	list   network		'wan'
	list   network		'wan6'
	option input		REJECT
	option output		ACCEPT
	option forward		REJECT
	option masq		1
	option mtu_fix		1

config forwarding
	option src		lan
	option dest		wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
	option name		Allow-DHCP-Renew
	option src		wan
	option proto		udp
	option dest_port	68
	option target		ACCEPT
	option family		ipv4

# Allow IPv4 ping
config rule
	option name		Allow-Ping
	option src		wan
	option proto		icmp
	option icmp_type	echo-request
	option family		ipv4
	option target		ACCEPT

config rule
	option name		Allow-IGMP
	option src		wan
	option proto		igmp
	option family		ipv4
	option target		ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
	option name		Allow-DHCPv6
	option src		wan
	option proto		udp
	option dest_port	546
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-MLD
	option src		wan
	option proto		icmp
	option src_ip		fe80::/10
	list icmp_type		'130/0'
	list icmp_type		'131/0'
	list icmp_type		'132/0'
	list icmp_type		'143/0'
	option family		ipv6
	option target		ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Input
	option src		wan
	option proto	icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	list icmp_type		router-solicitation
	list icmp_type		neighbour-solicitation
	list icmp_type		router-advertisement
	list icmp_type		neighbour-advertisement
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
	option name		Allow-ICMPv6-Forward
	option src		wan
	option dest		*
	option proto		icmp
	list icmp_type		echo-request
	list icmp_type		echo-reply
	list icmp_type		destination-unreachable
	list icmp_type		packet-too-big
	list icmp_type		time-exceeded
	list icmp_type		bad-header
	list icmp_type		unknown-header-type
	option limit		1000/sec
	option family		ipv6
	option target		ACCEPT

config rule
	option name		Allow-IPSec-ESP
	option src		wan
	option dest		lan
	option proto		esp
	option target		ACCEPT

config rule
	option name		Allow-ISAKMP
	option src		wan
	option dest		lan
	option dest_port	500
	option proto		udp
	option target		ACCEPT

Thank you

psherman · March 28, 2024, 2:04pm

Remove the last line (ignore) if you want the dhcp server to function. That line explicitly disables the dhcp server on a given interface.

Jiffy:

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ignore '1'

Jiffy · March 28, 2024, 3:12pm

I don't want the OpenWrt DHCP or DNS server operable.
I'm using a standalone dnsmasq server for local DNS and DHCP.

krazeh · March 28, 2024, 3:14pm

Where is the docker container running? What's the setup?

_bernd · March 28, 2024, 3:20pm

Why don't you then disable dnsmasq on Openwrt?

Jiffy · March 28, 2024, 4:03pm

The docker container is on a separate PC.
It has my DHCP reservations and dns settings and tags for the kids devices so they get forced to safe search and youtube.

I'm trying to avoid recreating the above things if I decide to try yet another firewall, like I did with pfSense.

I did disable dnsmasq on OpenWrt.

The heart of the problem is when Openwrt is running, my standalone DHCP server will not hand out ip addresses. Running tcpdump on the docker server sees the requests. I can remove the LAN cable from OW and the PC's get an address. I plug the cable back in and they work just fine until their leases expires. Also rebooting them results in them not getting an address too.

Jiffy · March 28, 2024, 4:08pm

I also have dhcp-authoritative in my dnsmasq.conf on the standalone server.

krazeh · March 28, 2024, 4:18pm

Are you referring to disabling DHCP on the br-lan interface or did you disable the entire dnsmasq service?

It might be worth ruining wireshark on a separate machine and seeing what different DHCP traffic is being sent when OpenWRT is connected and when it's not.

Jiffy · March 28, 2024, 4:33pm

Hi, yes, I disabled the entire service.
I'll try another tcpdump on a separate machine later on today.
Can't take down the internet right now as I'm using my ipsec tunnel on OPNSense to work from home. (This will be my next adventure with OpenWrt. )
Thank you.

Jiffy · March 28, 2024, 6:34pm

Ran this

tcpdump -i enp1s0 -n 'udp and (port 67 or port 68)'

Broadcasts on 0.0.0.0 port 68, nothing replies.

Jiffy · March 28, 2024, 7:08pm

I even tried this. No luck.

Jiffy · March 28, 2024, 9:58pm

Ok, I just had to try.
I stopped the docker container and installed and ran dnsmasq as a service on the same host.
Everything is working fine.
I'll be scratching my head over this.