Hi all,
im setting up guest wifi and done everything in the openwrt docs but the device isn’t able to resolve the domains as the DNS is not working even tho i have the rules setup, i also want to restrict it block everything and allow web browsing only,
Im using Unbound + Dnsmasq in Parallel
Thanks
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
+ inbound config
root@OpenWrt:~# ubus call system board
ireless
cat /etc/config/dhcp
cat /etc/config/fir{
"kernel": "6.12.50",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 0",
"model": "Banana Pi BPI-R4 (2x SFP+)",
"board_name": "bananapi,bpi-r4",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "SNAPSHOT",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r0-b64fded",
"target": "mediatek/filogic",
"description": "OpenWrt SNAPSHOT r0-b64fded",
"builddate": "1759878387"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option ula_prefix
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'sfp-lan'
config interface 'lan'
option device 'br-lan'
option proto 'static'
list ipaddr '192.168.1.1/24'
option ip6assign '60'
config device
option name 'br-wan'
option type 'bridge'
list ports 'wan'
list ports 'sfp-wan'
config device
option name 'wan'
option macaddr
config device
option name 'sfp-wan'
option macaddr
config interface 'wan'
option device 'br-wan'
option proto 'pppoe'
option username
option password
option ipv6 'auto'
config interface 'wan6'
option device 'br-wan'
option proto 'dhcpv6'
config device
option type 'bridge'
option name 'br-guest'
option bridge_empty '1'
config interface 'Guest'
option proto 'static'
option device 'br-guest'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
root@OpenWrt:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option radio '0'
option band '2g'
option channel 'auto'
option htmode 'EHT40'
option country 'GB'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid
option encryption 'sae'
option key
option ocv '0'
option isolate '1'
option bridge_isolate '1'
option dtim_period '3'
option ieee80211r '1'
option ft_over_ds '0'
option ieee80211k '1'
option time_advertisement '2'
option time_zone 'GMT0'
option wnm_sleep_mode '1'
option wnm_sleep_mode_no_keys '1'
option bss_transition '1'
option proxy_arp '1'
config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option radio '1'
option band '5g'
option channel 'auto'
option htmode 'EHT160'
option country 'GB'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid
option encryption 'sae'
option key
option ocv '0'
option isolate '1'
option bridge_isolate '1'
option dtim_period '3'
option ieee80211r '1'
option ft_over_ds '0'
option ieee80211k '1'
option time_advertisement '2'
option wnm_sleep_mode '1'
option wnm_sleep_mode_no_keys '1'
option bss_transition '1'
option proxy_arp '1'
option time_zone 'GMT0'
config wifi-device 'radio2'
option type 'mac80211'
option path 'soc/11300000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option radio '2'
option htmode 'EHT320'
option country 'GB'
option cell_density '0'
option band '6g'
option channel 'auto'
config wifi-iface 'default_radio2'
option device 'radio2'
option network 'lan'
option mode 'ap'
option ssid
option encryption 'sae'
option key
option ocv '0'
option isolate '1'
option bridge_isolate '1'
option dtim_period '3'
option ieee80211r '1'
option ft_over_ds '0'
option ieee80211k '1'
option time_advertisement '2'
option wnm_sleep_mode '1'
option wnm_sleep_mode_no_keys '1'
option bss_transition '1'
option proxy_arp '1'
option time_zone 'GMT0'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option ssid 'Guest'
option encryption 'sae'
option isolate '1'
option bridge_isolate '1'
option dtim_period '3'
option key
option ocv '0'
option network 'Guest'
root@OpenWrt:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option noresolv '1'
option port '1053'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
list dhcp_option 'option:dns-server,0.0.0.0'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piofolder '/tmp/odhcpd-piofolder'
config host
option name 'OpenWrt'
option ip '192.168.1.107'
list mac
config host
option name 'NAS'
list mac
option ip '192.168.1.234'
config dhcp 'Guest'
option interface 'Guest'
option start '100'
option limit '150'
option leasetime '12h'
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
option flow_offloading '1'
option flow_offloading_hw '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'DROP'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.fail2ban'
option enabled '1'
option reload '1'
config rule
option src 'lan'
option dest 'wan'
option name 'Block CCTV Lan'
list src_mac
option target 'REJECT'
config rule
option src 'wan'
option dest 'lan'
option name 'Block CCTV Wan'
list src_mac
option target 'REJECT'
config zone
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'Guest'
config forwarding
option src 'guest'
option dest 'wan'
config rule
option src 'guest'
option name 'Allow-DNS-Guest'
option dest_port '53'
option target 'ACCEPT'
config rule
option name 'Allow-DHCP-Guest'
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'
option src 'guest'
root@OpenWrt:~# cat /etc/config/unbound
config unbound 'ub_main'
option add_extra_dns '0'
option dhcp_link 'dnsmasq'
option dns64 '1'
option domain 'lan'
option edns_size '1232'
option extended_stats '0'
option hide_binddata '1'
option interface_auto '1'
option listen_port '53'
option localservice '1'
option manual_conf '0'
option num_threads '1'
option protocol 'default'
option rate_limit '0'
option rebind_localhost '0'
option rebind_protection '1'
option recursion 'aggressive'
option resource 'large'
option root_age '9'
option ttl_min '120'
option ttl_neg_max '1000'
option unbound_control '1'
option validator '1'
option verbosity '1'
list iface_trig 'lan'
list iface_trig 'wan'
list iface_wan 'wan'
option enabled '1'
config zone 'auth_icann'
option enabled '0'
option fallback '0'
option url_dir 'https://www.internic.net/domain/'
option zone_type 'auth_zone'
list server 'lax.xfr.dns.icann.org'
list server 'iad.xfr.dns.icann.org'
list zone_name '.'
list zone_name 'arpa.'
list zone_name 'in-addr.arpa.'
list zone_name 'ip6.arpa.'
config zone 'fwd_isp'
option enabled '0'
option fallback '0'
option resolv_conf '1'
option zone_type 'forward_zone'
list zone_name 'isp-bill.example.com.'
list zone_name 'isp-mail.example.net.'
config zone 'fwd_google'
option enabled '0'
option fallback '0'
option tls_index 'dns.google'
option tls_upstream '1'
option zone_type 'forward_zone'
list server '8.8.4.4'
list server '8.8.8.8'
list server '2001:4860:4860::8844'
list server '2001:4860:4860::8888'
list zone_name '.'
config zone 'fwd_cloudflare'
option enabled '0'
option fallback '0'
option tls_index 'cloudflare-dns.com'
option tls_upstream '1'
option zone_type 'forward_zone'
list server '1.1.1.1'
list server '1.0.0.1'
list server '2606:4700:4700::1111'
list server '2606:4700:4700::1001'
list zone_name '.'
When you change the default dnsmasq listening port, no DNS server is advertised via DHCP (unless explicitly specified via option 6).
uci add_list dhcp.Guest.dhcp_option='6,192.168.2.1'
uci commit dhcp
service dnsmasq restart
Ah that worked thanks, have I messed up my lan DHCP option by chance too, also quick question how do I block guest lan only to web browsing and nothing more, Thanks
uci del firewall.@forwarding[1]
uci add firewall rule
uci set firewall.@rule[-1].src='guest'
uci set firewall.@rule[-1].dest='wan'
uci set firewall.@rule[-1].name='Allow-Guest-Browsing'
uci add_list firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='80 443'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
fw4 restart
Thanks for all your help
Quick question do I need to do ‘6.192.168.1.1’ option for LAN interface too, I'm running unbound in parallel
Leave it as per the guide. From the dnsmasq man page:
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.