Wifi network on AP - no access to internet

fabf · February 7, 2023, 6:08pm

Hello,

I wan't to change my network to add VLAN and separate network but I'm new to OpenWrt so I try to go step by step.

I have a Netgear GS108Tv3 with OpenWrt 22.03.
In its initial configuration, all ports are bridged together as described in the docs.

My OpenWrt is linked to the ISP Modem/router which is on the subnet 192.168.1.1/24.
I removed one of the port (port 3) from the bridge, created a new interface called "WIFI" with port 3 and connected a Wifi access point to port 3 (ORBI RBR750).
Capture d’écran 2023-02-07 à 18.50.44

The WIFI interface (network 192.168.30.1/24) has DHCP enabled.
The clients that connects to the Wifi AP got an IP address in the range 192.168.30.x but can't go to internet.
I have configured a zone in the firewall section to allow connection from wifi to LAN with no success

the WAN zone has created by the installation but I think it is useless since the internet is reached thru my ISP modem (gateway on the LAN)

Can you help my troubleshot this problem, it is giving me headaches
How to access internet from clients connected to WIFI ?
Thank you

fabf · February 7, 2023, 6:08pm

I add the config of Firewall page

psherman · February 7, 2023, 6:56pm

Which device? I assume the Orbi?

Are you doing anything special on the Netgear switch? Keep in mind that you should not attempt routing on that device due to the fact that it is a switch and the hardware is not optimized for routing (it'll be really slow).. all routing should hpapen on the Orbi.

Let's see your configuration files from the Orbi:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

fabf · February 7, 2023, 8:31pm

Thank for your reply.

When I say : I removed one of the port (port 3) from the bridge
I mean : I went to Network > Interface menu, then on Device tab, click Configure on the device named "switch" and then deselect the port called lan3 from the bridge port menu:

Referring your second question, I've installed OpenWRT on the netgear GS108Tv3 switch and I attempted routing on this device. I didn't know it is to slow to do routing.
It don't seem OpenWrt is compatible with ORBI RBR750 on the compatibility list

here are the files :
/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdf4:xxxx:xxxx::/48'

config device 'switch'
	option name 'switch'
	option type 'bridge'
	option macaddr '94:18:xx:xx:xx:xx'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan4'
	list ports 'lan5'
	list ports 'lan6'
	list ports 'lan7'
	list ports 'lan8'

config bridge-vlan 'lan_vlan'
	option device 'switch'
	option vlan '1'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan4'
	list ports 'lan5'
	list ports 'lan6'
	list ports 'lan7'
	list ports 'lan8'

config device
	option name 'switch.1'
	option macaddr '94:18:xx:xx:xx:xx'

config interface 'lan'
	option device 'switch.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list dns '1.1.1.1'
	option gateway '192.168.1.254'

config interface 'wifi'
	option proto 'static'
	option device 'lan3'
	option ipaddr '192.168.30.1'
	option netmask '255.255.255.0'
	option broadcast '192.168.30.255'
	list dns '1.1.1.1'
	list dns '8.8.8.8'
	option gateway '192.168.1.1'

/etc/config/wireless
no wireless on the device

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option leasetime '12h'
	option start '160'
	option limit '10'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'wifi'
	option interface 'wifi'
	option limit '150'
	option leasetime '12h'
	option start '20'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'wifi'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'wifi'

config forwarding
	option src 'wifi'
	option dest 'lan'

So do you think I should give away or buy a more powerful router ?

psherman · February 7, 2023, 9:02pm

I said this before...

If your Orbi is running OpenWrt, that is where you should be doing the routing. The switch (Netgear device) is not designed for routing. The Orbi is.

There are a whole bunch of problems that I see here... I'd suggest that you reset your devices to default and then do the following:

if your fritzbox is using 192.168.1.1 as its IP address, the GS108T must not use the same address (currently it is, based on the configs you shared). Set it to something like 192.168.1.2 instead.
Then use the Orbi to create a secondary network.

fabf · February 7, 2023, 10:38pm

Ok, I understand I can't use the GS108T as a router.

Unfortunately, my Orbi RBR750 (AX4200) doesn't have a OpenWRT firmware available.
The only one that exists is for the RBR50 (AC3000) but I don't think I could use this firmware in my RBR750, could I ?

psherman · February 7, 2023, 10:42pm

No, don't attempt to install firmware for another device... it will almost certainly cause a brick.

Given that your Orbi can't run OpenWrt, if you were to do what you're proposing (routing on the switch), you'd only be able to use that new network on the AP... the regular LAN would not be braodcast on the AP in that situation. Is that what you want?

Or... better asked...
what is your goal? Why do you want a separate subnet for wifi? Is it for guests or other untrusted devices?

fabf · February 8, 2023, 12:13pm

Hello,

I was planning to setup my network from the ground with this main goal : separate my network by usage by doing VLANs :

For example, for my job, I run some dockers containers and VM and I would like to make a separate VLAN with restricted access
on the same server, I also run containers for entertainment, so a VLAN could be shared by the TV, the media containers and NAS shares
restrict kids access to internet with a parental control, maybe make a VLAN for their devices
make a guest wifi network with access only to internet
make a personal network with some extended access to my servers
isolate cameras on a specific VLAN and store footage to the NAS
I also want to monitor my bandwidth usage and the ISP router doesn't give much information

Here is the full picture of my network (the colored rounded rectangles just represents physical places where the devices are)

As I mentioned, the first question was just a step to understand OpenWRT and learn how it can help me.

psherman · February 8, 2023, 4:39pm

For this type of network, you really need to have a proper router. You don't want to do the routing for this network on a device that is designed as a switch.

Depending on your perspective, you could buy something that will suit your needs long term, or just something to tinker around with until you're more comfortable with OpenWrt. For learning purposes, it can be a really inexpensive router on the used market or even new. But you will want it to be a router (which may or may not include wifi and a built-in switch). The Raspberry Pi/Orange Pi/Banana Pi devices are also really popular choices (depending on availability and price, of course).

slh · February 9, 2023, 2:18am

With the amount of inter-VLAN routing expected ("docker", "entertainment"), I would assume throughput expectations close to 1 GBit/s wirespeed, which means you need a quite beefy router to deal with that (x86_64 comes to mind, e.g Tips for getting cheap used x86-based firewall with full Gbit NAT (a PC Engines APU) if you are in the US with baytrail-d/ ivy-bridge or newer).

rtl838x however peaks out around 15-20 MBit/s total, it's a switch (L2), not a router (L3). These are quite different use cases, L2 switching just needs a 'stupid' but massively parallel switch fabric, L3 routing needs (a lot of) CPU power to make decisions dynamically.

https://openwrt.org/toh/watchguard/firebox-m300 could kind of provide both features, to some extent.

fabf · February 9, 2023, 4:45pm

Hello and thank you for your advices.

I have a RaspberryPi 3 laying around and I could use it to make some tests and learn how to use OpenWrt. I didn’t assumed I could use a non « network based » device to do routing. Is it very powerful !

After, I could by a more robust router or mini-PC. I hope I will be able to use it with my Orbi mesh wireless AP (which was quite expensive) and do the segregation I want on the wireless device connected.

I have another question for my learning : in a lot of OpenWRT example I see a LAN interface and a WAN interface. In my use case, I assume I will never have a WAN interface because my OpenWRT device will be after my ISP router. So this device will always be on the LAN part.
Am I right ?

slh · February 9, 2023, 9:33pm

As a router, it is not.

The RPi3 and its predecessors are bottlenecked by its USB2 system bus, connecting its onboard ethernet port and any USB ethernet card you're going to connect for WAN. This is a severe performance limit. Only the RPi4 has added PCIe and USB3 support, getting rid of this bottleneck.

While you can certainly experiment with a RPi3, it's not good for router use.