I'm trying to use OpenWRT has a simple router on my system. It has 5 interfaces (eth0 through eth4) and I'd like to configure eth0 as the WAN port, and eth1-4 as the LAN ports. On the router itself, I can access the internet, however traffic from LAN is not getting through. SNAT/masquerade doesn't seem to be working properly. If I create my own masquerade rule using iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE, everything seems to work normally. Configs below. Any ideas?
network config:
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config interface 'lan'
list ifname 'eth1'
list ifname 'eth2'
list ifname 'eth3'
list ifname 'eth4'
option proto 'static'
option type 'bridge'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option metric '100'
config interface 'wan'
option ifname eth0
config globals 'globals'
option ula_prefix 'auto'
Firewall config:
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
There is no proto on the wan which means it won't have an IP address to masquerade from. Usually proto dhcp is used here to pull configuration from the ISP or other upstream network.
Thank you all. I copied the wrong iptables rule into the first forum post, the one I added manually was done using -A.
Using option proto dhcp does help, but the DHCP script fails to add routes which breaks the path to the internet. I added -x to the DHCP script in /lib/netifd/dhcp.script to debug and I see that every call to ubus call network.interface notify_proto returns Command failed: Not found. Confirmed that this is the issue because using the default uDHCP script in /usr/share/udhcpc/default.script makes everything work correctly, but obviously this will break if netifd ever reloads the network configuration. Example:
+ ubus call network.interface notify_proto '{ "action": 0, "link-up": false, "keep": false, "interface": "" }'
Command failed: Not found
# ubus call system board
Command failed: Not found
I've compiled OpenWRT using the Yocto layer here to run on a custom board: https://github.com/kraj/meta-openwrt so it's likely something is wrong with the way I'm compiling it or forgetting to start some services. Understand if that limits the support you can provide but any help is greatly appreciated!
It appears you are using firmware that is not from the official OpenWrt project.
When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.
Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).
If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.
I'd recommend that you use an official OpenWrt build for your device to ensure that your configuration makes sense and is working as expected. If it doesn't work properly, then we can help you diagnose the potential issues since you'll be running pure OpenWrt (once changes are introduced relative to the official build tools and packages, all bets are off as to what impact those changes could have on the operation of the firmware).
That makes sense. It seems like ubus is working partially - I can make other calls using ubus call, it's just this notify_proto command that fails. I'm not sure how to debug that further.
Are you developing your own code, or just building/integrating code from others? If the latter, you should reach out to the maintainers of that code to find out what might be going wrong.
Developing my own code but using that build layer I linked as a starting point. I'm pretty new to OpenWRT so I'm not sure how to debug stuff like this.
I'll move this thread to the developers section where it may be seen by the most relevant audience... but the first thing that the devs are likely to say is to start with the default OpenWrt toolchain and build process and then build your code against that.