Trying to set up VERY SIMPLE network on OpenWrt router

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello again from Columbus Ohio,

I am still here working on my RPi4B running OpenWRT 21.02.0 using Wireguard, and looking for a way to get my Televisions to work reliably with Netflix.

Since Netflix sends shows over IPv6, and VPNBypass does not seem to work with IPv6, I figured I would implement a very simple network called "TVNET" and put it on VLAN eth0.40, and route it to VLAN eth0.10, which is the WAN port off my DOCSIS3 modem.

But I cant get it to work. I get good local access but no internet access.

The TV gets served up a DHCP connection and it gets the advertised DNS servers.
The Wireguard service works great, and I have the OpenVPN service disabled.
Can anybody tell me what I am doing wrong?

By the way, I'm not running a real JWICS node over OpenVPN :slight_smile:

Update: The WAN port (eth0.10) is actually a private DHCP provided client address that is served from my Wide Open West (WoW) IPv4 & IPv6 compliant DOCSIS3 cable modem/router. I just (incorrectly) call it the WAN port. It's really just a DHCP client.

This is the /etc/config/network file

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd09:c84f:a20f::/48'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth0.10'
	option metric '0'

config device
	option name 'maint'

config interface 'maint'
	option device 'eth0.56'
	option proto 'static'
	option ipaddr '192.168.56.30'
	option netmask '255.255.255.0'
	option defaultroute '0'

config interface 'OVPN'
	option proto 'none'
	option device 'tun0'

config device
	option name 'tun0'

config device
	option name 'eth0.56'
	option type '8021q'
	option ifname 'eth0'
	option vid '56'

config device
	option name 'eth0.54'
	option type '8021q'
	option ifname 'eth0'
	option vid '54'

config device
	option name 'eth0.10'
	option type '8021q'
	option ifname 'eth0'
	option vid '10'

config interface 'wg0'
	option proto 'wireguard'
	option listen_port '51820'
	option peerdns '0'
	option private_key '4IXtJUk'
	list addresses '10.13.98.205/24'
	list dns '104.223.91.210'
	list dns '104.223.91.194'

config wireguard_wg0
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	option endpoint_port '1443'
	list allowed_ips '128.0.0.0/1'
	list allowed_ips '0.0.0.0/1'
	option description 'TorGuard - New York'
	option public_key 'bQhZye'
	option endpoint_host '67.213.221.19'

config device
	option type '8021q'
	option ifname 'eth0'
	option vid '52'
	option name 'eth0.52'

config interface 'SSCI'
	option proto 'static'
	option device 'eth0.52'
	option ipaddr '192.168.52.1'
	option netmask '255.255.255.0'
	option type 'bridge'

config device
	option type '8021q'
	option ifname 'eth0'
	option vid '40'
	option name 'eth0.40'

config device
	option name 'wlan0'

config device
	option name 'wg0'

config interface 'JWICS'
	option proto 'static'
	option device 'eth0.54'
	option ipaddr '192.168.54.1'
	option netmask '255.255.255.0'
	option defaultroute '0'

config interface 'TVNET'
	option proto 'static'
	option device 'eth0.40'
	option ipaddr '192.168.40.1'
	option netmask '255.255.255.0'
	option defaultroute '0'

This is my /etc/config/firewall file

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option synflood_protect '1'
	option drop_invalid '1'
	option forward 'REJECT'

config zone
	option name 'JWICS'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'JWICS'

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option name 'ssci'
	list network 'SSCI'

config zone
	option name 'tvnet'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option mtu_fix '1'
	list network 'TVNET'

config zone
	option name 'wan'
	option output 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	option input 'REJECT'
	option forward 'REJECT'
	list network 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled '0'

config include
	option path '/etc/firewall.user'

config zone
	option output 'ACCEPT'
	option forward 'REJECT'
	option input 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option family 'ipv4'
	option name 'ovpn'
	list network 'OVPN'

config rule
	option name 'Allow-OpenVPN'
	list proto 'udp'
	option src 'wan'
	option target 'ACCEPT'
	option dest 'ovpn'
	option family 'ipv4'

config zone
	option name 'wg'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wg0'

config forwarding
	option src 'ssci'
	option dest 'wg'

config rule
	option name 'Allow-Wireguard'
	list proto 'all'
	option src 'wan'
	option dest 'wg'
	option target 'ACCEPT'

config forwarding
	option src 'JWICS'
	option dest 'ovpn'

config forwarding
	option src 'tvnet'
	option dest 'wan'

config rule
	option name 'Allow-TVNet'
	option src 'wan'
	option dest 'tvnet'
	option target 'ACCEPT'
	list proto 'all'