Trafic rule to block device form Internet not working

Installing and Using OpenWrt
1

Hi,

I have very peculiar case. I have two sites, tied together with WireGuard (if it is of any importance).

Site A is 192.168.0.x

Site B is 192.168.1.x (AX3600 OpenWrt 24.10.4)

I have couple of devices on site B. One of them is IP Camera with IP 192.168.1.132.
I usually peek trough WireGuard from site A to see what is happening on site B, but do not want camera on site B to be able to talk to Internet, just to site A.

For that, I created a simple traffic rule on site B router:

config rule
option dest 'wan'
option name 'Block_IPCAM'
list src_ip '192.168.1.132'
option target 'REJECT'
option src 'lan'

Then I enabled SSH in cam, logged into 192.168.1.132 and tried to ping internet sites. And it worked!

I tried multiple thing. Changing from “reject” to “drop”. Changing from IP to MAC address. Nothing helps, it can still talk to Internet.

What am I doing wrong? Is it WireGuard that is somehow bypassing the Traffic Rules?

Network file:



config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option packet_steering '2'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
option ipv6 '0'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ipv6 '0'
option delegate '0'

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option ipv6 '0'

config interface 'wwan'
option proto 'dhcp'

config interface 'Wireguard'
option proto 'wireguard'
option private_key 'redacted'
list dns '10.0.5.1'
option delegate '0'
list addresses '10.0.5.5/32'

config wireguard_Wireguard
option description '4_lan_Delta.conf'
option public_key 'redacted'
option preshared_key 'redacted'
option persistent_keepalive '25'
option endpoint_host 'redacted'
option endpoint_port '443'
list allowed_ips '192.168.0.0/24'
list allowed_ips '10.0.5.0/24'
option route_allowed_ips '1'

config device
option name 'Wireguard'
option ipv6 '0'

config device
option type 'bridge'
option name 'br-guest'
option bridge_empty '1'

config interface 'guest'
option proto 'static'
option device 'br-guest'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option gateway '192.168.20.1'
option delegate '0'

firewall file:



config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'Wireguard'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wwan'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'guest'

config forwarding
option src 'guest'
option dest 'wan'

config rule
option src 'guest'
option name 'Allow-DNS-Guest'
option dest_port '53'
option target 'ACCEPT'

config rule
option src 'guest'
option name 'Allow-DHCP-Guest'
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'

config rule
option src ''
option dest ''
option name 'Block B-to-A'
list src_ip '192.168.1.0/24'
list dest_ip '192.168.0.0/24'
option target 'REJECT'

config rule
option dest 'wan'
option name 'Block_IPCAM'
list src_ip '192.168.1.132'
option target 'REJECT'
option src 'lan'

Thanks!

2

this is what I'm using:

config rule
        option src 'lan'
        option dest 'wan'
        option name 'monitors drop packets'
        list src_ip '192.168.2.151'
        option target 'DROP'
3

Yes, of course. It should work. I tried both DROP and REJECT. But it does not.

4

Just to rule it out: when you test internet connectivity on the camera to test the rule, you see ipv4 addresses being used, right? I’m asking because I see you don’t have ipv6 enabled on this openwrt router based on the config, but there may be another device on the camera’s network acting as an ipv6 router sending RA-s.

6

I test by logging in on IPCam using SSH and pinging some address on the internet. Ping returns ordinary ipv4 address back. Ipv6 is disabled in the router itself.

How can I check if some other device is routing the packages for camera?

7

After enabling the rule did you reboot the camera?

And what is it with wwan?

8

I deleted the “wwan” interface and also restarted the camera. Still not working.

9

Not sure if required, but I'm not seeing any protocols in the rule; TCP, UDP, ICMP, etc...

2 Likes
10

traceroute

(Instead of ping)

11

Bang! That was it. I checked “Any” and now it works. Many thanks! :smiley:

This forum is the best!

2 Likes
12

P.S.

More info:

I had TPC and UDP blocked. But I assume that ping does not use any of those two but uses “ICMP or “IGMP”. By checking in “Any” it took care of thing.

13

FYI, the default is TCP UDP, hence specifying 'Any' works.

Yes, ping has an official name - "ICMP Echo-Request". I mention it because that's how you specify it in OpenWrt. It's a specific type of ICMP packet. The response is "ICMP Echo-Reply".

14

Yeah, I tested connectivity using ping but it never dawned on me that blocking UDP and TCP will not block ping. Now it all falls into place. Thanks!

1 Like