Yet Another Dual/Multi ISP Question

ncompact · August 3, 2023, 9:03am

ok now that we have established what your requests are, you will surely get a precise answer.

recapping:

wan
wanb
lan
lanb

lan -> wan
lanb -> wanb

not lan to lanb

I assume it is

or

but you leave yourself in the hands of someone more competent than me.

ncompact · August 3, 2023, 9:12am

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

lleachii · August 3, 2023, 10:05am

Also, this:

Example:

config route
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway 'xxx.xxx.xxx.xxx' #ISP router IP on WAN_A
        option table '1'  #use numbers or a complex method to use names
        option interface 'wan_a'

config route
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway 'yyy.yyy.yyy.yyy' #ISP router IP on WAN_B
        option table '2'  #use numbers or a complex method to use names
        option interface 'wan_b'

config rule
        option src '192.168.x.0/24' #LAN_A subnet
        option dest '0.0.0.0/0'
        option priority '1'
        option lookup '1'

config rule
        option src '192.168.y.0/24' #LAN_B subnet
        option dest '0.0.0.0/0'
        option priority '2'
        option lookup '2'

You can change/rearrange priority numbers and make exceptions to certain IP's accordingly. E.g. you could make a rule with a higher priority number for LANA to reach management (by looking up table main. You could even instead put a specific route to the management IP range in the corresponding route table (i.e table '1' or table '2'. Just FYI if you're new to this - priority numbers and table numbers are different things.

ip -4 route
ip -4 rule

Edit - A brief explanation:

This adds a default gateway via wan_a in a new table 1
This adds a default gateway via wan_b in a new table 2
You tell all traffic SRC lan_a IP range to lookup table 1 - you use priority position 1 for this IP Rule
You tell all traffic SRC lan_b IP range to lookup table 2 - you use priority position 2 for this IP Rule

ambad4u · August 3, 2023, 11:12am

ncompact:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

Before I'll post my 'HORRENDOUS' configs..., I'll try first the suggestions

I'll get back in a few hours for testing!

ambad4u · August 3, 2023, 11:46am

Is it okay for a "routing table id" being used for example "100" (& your example: 1 & 2) but never declared or saved inside /etc/iproute2/rt_tables???

lleachii · August 3, 2023, 11:50am

Yes - I noted that above:

The Wiki also says so:

Defines the table ID to use for the route. The ID can be either a numeric table index ranging from 0 to 65535 or a symbolic alias declared in /etc/iproute2/rt_tables. The special aliases local (255), main (254) and default (253) are recognized as well

(emphasis added by me)

You discovered the complex method. So if you use numbers - adding symbolic aliases to that file become unnecessary.

ambad4u · August 3, 2023, 12:28pm

lleachii:

Example:

config route
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway 'xxx.xxx.xxx.xxx' #ISP router IP on WAN_A
        option table '1'  #use numbers or a complex method to use names
        option interface 'wan_a'

wait...
since my gateway is via dhcp client, sooner or later, this ip will change..., how do we handle ip changes???

lleachii · August 3, 2023, 12:33pm

This is why I asked you:

Let me think on this.

Is it a RFC1918 IP, or a Public address?

ambad4u · August 3, 2023, 12:44pm

yes & my apologies...

one is public static IP (via PPPoE) [but below...]
other one is public dynamic (bridged mode directly into OpenWRT)

the static one is not yet "bridged" into OpenWRT as family members needs atleast an internet connection (otherwise household members will be sad)

am currently still testing!!!
Thanks for all the patience!!!

ambad4u · August 3, 2023, 2:23pm

Okay..., so far..., the test did not go well...
after placing the codes above into /etc/config/network and issuing 'service network reload'... no internet comming from the OpenWRT for now, but that's okay... (rebooted a couple of times as well to test both 'eth3' & 'eth4')

Anyways..., please take note as i have mentioned before, the config(s) are in a 'horrendous' state... (I'll be asking this as a new topic in the future... so hold your gripes for the moment..., until that topic comes )

for this, let me explain some interface names (of importance...):
isp-A: 'dhcp client' (in bridged mode w/ public dynamic ip)
interface name: wan
bridge device: br-wan
network device: eth1

isp-B: 'dhcp client' (NOT-bridged w/ private ip)
interface name: globe
bridge device: br-wan1
network device: eth2

the 'interface names': e1v4 & xTEMP..., consider them to be as eth3 & eth4 respectively.

I also have "option 6" for pi-hole DNS stuff, but I removed them from "e1v4 & xTEMP"

and lastly, I am testing inside proxmox.

so here are the configs:
contents of "/etc/config/network"

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd5b:f0be:f6ba::/48'
        option packet_steering '1'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br-mgmt'
        list ports 'eth0'
        option ipv6 '0'

config interface 'mgmt'
        option proto 'static'
        option device 'br-mgmt'
        option ipaddr '10.10.10.254'
        option netmask '255.255.255.0'
        option defaultroute '0'
        option delegate '0'
        option broadcast '10.10.10.255'

config device
        option type 'bridge'
        option name 'br-lan'
        list ports 'eth10'

config interface 'lan'
        option proto 'static'
        option device 'br-lan'
        option ipaddr '10.123.234.254'
        option netmask '255.255.255.0'
        option broadcast '10.0.0.255'

config device
        option type 'bridge'
        option name 'br-pve'
        list ports 'eth5'
        option ipv6 '0'

config device
        option type 'bridge'
        option name 'br-wan'
        list ports 'eth1'
        list ports 'eth8'
        option macaddr '2c:53:4a:01:a0:f4'

config interface 'wan'
        option proto 'dhcp'
        option device 'br-wan'
        option peerdns '0'

config device
        option type 'bridge'
        option name 'br-DNS'
        list ports 'eth9'
        option ipv6 '0'

config interface 'DNS'
        option proto 'static'
        option device 'br-DNS'
        option ipaddr '172.27.72.254'
        option netmask '255.255.255.248'
        option broadcast '172.27.72.255'
        option delegate '0'

config interface 'pve'
        option proto 'static'
        option device 'br-pve'
        option ipaddr '192.168.134.254'
        option netmask '255.255.255.252'
        option broadcast '192.168.134.255'

config device
        option type 'bridge'
        option name 'br-e1v4'
        list ports 'eth6'
        option ipv6 '0'

config interface 'e1v4'
        option proto 'static'
        option device 'br-e1v4'
        option ipaddr '172.24.48.254'
        option netmask '255.255.255.0'
        option broadcast '172.24.48.255'

config device
        option type 'bridge'
        option name 'br-e2v4'
        list ports 'eth4'

config interface 'e2v4'
        option proto 'static'
        option device 'br-e2v4'
        option ipaddr '172.16.64.254'
        option netmask '255.255.255.248'
        option broadcast '172.16.64.255'
        option delegate '0'

config device
        option type 'bridge'
        option name 'br-e0v4'
        list ports 'eth3'
        list ports 'eth11'

config interface 'e0v4'
        option proto 'static'
        option device 'br-e0v4'
        option ipaddr '10.20.30.254'
        option netmask '255.255.255.0'
        option broadcast '10.20.30.255'
        option delegate '0'
        option defaultroute '0'

config device
        option type '8021q'
        option ifname 'br-e0v4'
        option vid '101'
        option name 'br-e0v4.101'
        option ipv6 '0'

config interface 'e0v4_101'
        option proto 'static'
        option device 'br-e0v4.101'
        option ipaddr '172.27.101.254'
        option netmask '255.255.255.0'
        option broadcast '172.27.101.255'

config device
        option type '8021q'
        option ifname 'br-e0v4'
        option vid '404'
        option name 'br-e0v4.404'
        option ipv6 '0'

config interface 'e0v4_404'
        option proto 'static'
        option device 'br-e0v4.404'
        option ipaddr '172.27.44.254'
        option netmask '255.255.255.0'
        option broadcast '172.27.44.255'
        option delegate '0'

config interface 'modemPLDT'
        option proto 'static'
        option device '@wan'
        option ipaddr '10.54.154.54'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'br-wan1'
        list ports 'eth2'

config device
        option type '8021q'
        option ifname 'br-e0v4'
        option vid '202'
        option name 'br-e0v4.202'
        option ipv6 '0'

config interface 'e0v4_202'
        option proto 'static'
        option device 'br-e0v4.202'
        option ipaddr '10.1.1.254'
        option netmask '255.255.255.0'
        option broadcast '10.1.1.255'

config interface 'globe'
        option proto 'static'
        option device 'br-wan1'
        option ipaddr '10.32.64.222'
        option netmask '255.255.255.0'
        option gateway '10.32.64.254'
        option broadcast '10.32.64.255'

config device
        option type 'bridge'
        option name 'br-temp'
        list ports 'oldeth10'

config interface 'xTEMP'
        option proto 'static'
        option device 'br-temp'
        option ipaddr '10.123.123.254'
        option netmask '255.255.255.0'
        option broadcast '10.123.123.255'
        option delegate '0'

config route
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway '49.145.123.205'
        option table '1'
        option interface 'wan'

config route
        option target '0.0.0.0'
        option netmask '0.0.0.0'
        option gateway '10.32.64.222'
        option table '2'
        option interface 'globe'

config rule
        option src '172.24.48.0/24'
        option dest '0.0.0.0/0'
        option priority '1'
        option lookup '1'

config rule
        option src '10.123.123.0/24'
        option dest '0.0.0.0/0'
        option priority '2'
        option lookup '2'

contents of "/etc/config/dhcp"

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option noresolve '1'
        option port '53'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list server '127.0.0.1#1053'
        list server '::1#1053'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '100'
        option leasetime '12h'

config dhcp 'DNS'
        option interface 'DNS'
        option start '1'
        option limit '1'
        option leasetime '12h'
        list dhcp_option '6,172.27.72.251,172.27.72.252'

config dhcp 'mgmt'
        option interface 'mgmt'
        option start '100'
        option limit '99'
        option leasetime '12h'

config dhcp 'pve'
        option interface 'pve'
        option start '1'
        option limit '2'
        option leasetime '12h'
        list dhcp_option '6,172.27.72.251,172.27.72.252'
        option ignore '1'

config dhcp 'e1v4'
        option interface 'e1v4'
        option start '100'
        option limit '99'
        option leasetime '12h'

config dhcp 'e0v4'
        option interface 'e0v4'
        option start '100'
        option limit '99'
        option leasetime '12h'
        list dhcp_option '6,172.27.72.252,172.27.72.251'

config dhcp 'e0v4_101'
        option interface 'e0v4_101'
        option start '100'
        option limit '99'
        option leasetime '12h'
        list dhcp_option '6,172.27.72.252,172.27.72.251'

config dhcp 'e0v4_404'
        option interface 'e0v4_404'
        option start '100'
        option limit '99'
        option leasetime '12h'
        list dhcp_option '6,172.27.72.252,172.27.72.251'

config host
        option ip '172.27.44.123'
        option mac '64:AE:F1:28:8F:09'
        option name 'Hisense-TV'
        option dns '1'

config dhcp 'e2v4'
        option interface 'e2v4'
        option start '100'
        option limit '99'
        option leasetime '12h'
        list dhcp_option '6,172.27.72.252,172.27.72.251'

config dhcp 'e0v4_202'
        option interface 'e0v4_202'
        option start '100'
        option limit '99'
        option leasetime '12h'

config dhcp 'xTEMP'
        option interface 'xTEMP'
        option start '100'
        option limit '99'
        option leasetime '12h'

contents of "/etc/config/firewall"

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'zmgmt'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option log '1'
        list network 'mgmt'

config zone
        option name 'lan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'lan'

config zone
        option name 'zDNS'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option log '1'
        list network 'DNS'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-DHCP-Renew'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE0V4'
        option dest_port '67 68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Renew'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE0V4_101'
        option dest_port '67 68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Renew'
        option family 'ipv4'
        list proto 'udp'
        option target 'ACCEPT'
        option src 'zE0V4_202'
        option dest_port '67 68'

config rule
        option name 'Allow-DHCP-Renew'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE0V4_404'
        option dest_port '67 68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Renew'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE1V4'
        option dest_port '67 68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Renew'
        option family 'ipv4'
        option target 'ACCEPT'
        list proto 'udp'
        option dest_port '67 68'
        option src 'zE2V4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping'
        option family 'ipv4'
        list proto 'icmp'
        option src 'zE0V4'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping'
        option family 'ipv4'
        list proto 'icmp'
        option src 'zE0V4_101'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping'
        option family 'ipv4'
        list proto 'icmp'
        option src 'zE0V4_202'
        option target 'ACCEPT'

config rule
        option name 'Allow-Ping'
        list proto 'icmp'
        option src 'zE0V4_404'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        list proto 'icmp'
        option src 'zE1V4'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        list proto 'icmp'
        option src 'zE2V4'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option family 'ipv4'
        option src 'zmgmt'
        option target 'ACCEPT'
        list proto 'icmp'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config forwarding
        option src 'zDNS'
        option dest 'wan'

config rule
        option name 'Allow-DNS-DNS'
        option family 'ipv4'
        option src 'zDNS'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-PING'
        list proto 'icmp'
        option src 'zDNS'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-DNS-DHCP'
        option family 'ipv4'
        list proto 'udp'
        option src 'zDNS'
        option dest_port '67 68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-ports'
        list proto 'tcp'
        option src 'zDNS'
        option dest_port '80 4711'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option family 'ipv4'
        list proto 'udp'
        option src 'zmgmt'
        option dest 'zDNS'
        option dest_port '53'
        option target 'ACCEPT'
        option name 'Allow-DNS-to-PiHole'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'

config zone
        option name 'zPVE'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'pve'

config zone
        option name 'zE0V4'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'e0v4'

config zone
        option name 'zE1V4'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'e1v4'

config zone
        option name 'zE2V4'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'e2v4'

config zone
        option name 'zE0V4_101'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'e0v4_101'

config zone
        option name 'zE0V4_404'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'e0v4_404'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'modemPLDT'
        list network 'wan'
        list network 'wan6'

config rule
        option name 'Allow-DNS-to-PiHole'
        option family 'ipv4'
        list proto 'udp'
        option src 'zPVE'
        option dest 'zDNS'
        option dest_port '53'
        option target 'ACCEPT'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'

config forwarding
        option src 'zPVE'
        option dest 'wan'

config forwarding
        option src 'zE1V4'
        option dest 'wan'

config rule
        option name 'Allow-DNS-to-PiHole'
        list proto 'udp'
        option src 'zE1V4'
        option dest 'zDNS'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'
        option dest_port '53'
        option target 'ACCEPT'
        option family 'ipv4'

config forwarding
        option src 'zE2V4'
        option dest 'wan'

config rule
        option name 'Allow-DNS-to-PiHole'
        option family 'ipv4'
        option src 'zE2V4'
        option dest 'zDNS'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'udp'

config rule
        option name 'Allow-DNS-to-PiHole'
        list proto 'udp'
        option src 'zE0V4'
        option dest 'zDNS'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'
        option dest_port '53'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-DNS-to-PiHole'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE0V4_101'
        option dest 'zDNS'
        option dest_port '53'
        option target 'ACCEPT'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'

config rule
        option name 'Allow-DNS-to-PiHole'
        option family 'ipv4'
        option src 'zE0V4_404'
        option dest 'zDNS'
        list dest_ip '172.27.72.252'
        list dest_ip '172.27.72.251'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'udp'

config rule
        option name 'Access-OpenWRT-x86'
        option family 'ipv4'
        list proto 'tcp'
        option src 'zmgmt'
        option dest_port '22 80 443'
        option target 'ACCEPT'
        list dest_ip '10.10.10.254'

config rule
        option name 'Access-NeWiFi-D2'
        list proto 'tcp'
        option src 'zE1V4'
        option dest 'zE0V4'
        list dest_ip '10.20.30.249'
        option dest_port '22 80 443'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-NTP'
        list proto 'udp'
        option dest_port '123 1023'
        option target 'ACCEPT'
        option src 'zE0V4'
        option family 'ipv4'

config forwarding
        option src 'zE0V4_101'
        option dest 'wan'

config forwarding
        option src 'zE0V4_404'
        option dest 'wan'

config rule
        option name 'Allow-NTP'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE0V4_404'
        option dest_port '123 1023'
        option target 'ACCEPT'

config rule
        option name 'Allow-NTP'
        option family 'ipv4'
        list proto 'udp'
        option src 'zE2V4'
        option target 'ACCEPT'
        option dest_port '123 1023'

config rule
        option name 'alowPING'
        option family 'ipv4'
        list proto 'icmp'
        option src 'zE1V4'
        option dest 'zDNS'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'xxxxtemp'
        option family 'ipv4'
        list proto 'tcp'
        option src 'zE1V4'
        option dest 'zDNS'
        option dest_port '80 443'
        option target 'ACCEPT'

config forwarding
        option src 'zE0V4'
        option dest 'wan'

config zone
        option name 'zE0V4_202'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'e0v4_202'

config forwarding
        option src 'zE0V4_202'
        option dest 'zWAN1'

config zone
        option name 'zTEMP'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'xTEMP'

config zone
        option name 'zWAN1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        list network 'globe'
        option mtu_fix '1'

config forwarding
        option src 'zTEMP'
        option dest 'zWAN1'

spank shield activated!!!, however, I am open to any critique/comments..., (even if its negative) as long as I learn from it...

ncompact · August 3, 2023, 6:45pm

the only advice I give you is that when one of the two links
wan or wanb will go down you will block the corresponding lan or lanb

people ask why their internet is down...

ambad4u · August 3, 2023, 10:32pm

my apologies, i don't get this...

I'm not doing anything for the 'local networks', may you explain further?

ambad4u · August 4, 2023, 1:50am

A minor update & observation...
i have modified "/etc/config/network" to just to include

config route
	option target '0.0.0.0'
	option netmask '0.0.0.0'
	option gateway '10.32.64.222'	
	option table '2'
	option interface 'globe'

config rule
	option src '10.123.123.0/24'
	option dest '0.0.0.0/0'
	option priority '2'
	option lookup '2'

upon checking the routes, I see "10.123.123.0/24" is in the main table

root@OpenWrt-x86:~# ip route show table main
default via 49.145.112.1 dev br-wan  src 49.145.127.195
10.1.1.0/24 dev br-e0v4.202 scope link  src 10.1.1.254
10.10.10.0/24 dev br-mgmt scope link  src 10.10.10.254
10.20.30.0/24 dev br-e0v4 scope link  src 10.20.30.254
10.32.64.0/24 dev br-wan1 scope link  src 10.32.64.222
10.54.154.0/24 dev br-wan scope link  src 10.54.154.54
10.123.123.0/24 dev br-temp scope link  src 10.123.123.254

and below is the ipv4 rules
openwrt-000

so: 10.123.123.0/24 is on both table 'main' & in '2'
But, it still does not have internet over "xTEMP"

below is table '2', but i don't see '10.123.123.0/24'
is it because '10.123.123.0/24' is defined into the ipv4 rule inside '/etc/config/network'???

root@OpenWrt-x86:~# ip route show table 2
default via 10.32.64.222 dev br-wan1
root@OpenWrt-x86:~#

comparing to the table main, the first line seems the gateway & succeeding lines are networks that can reference to the first line or gateway?

what i did was to go to 'xTEMP' interface and uncheck 'Use default gateway' & explicitly used table '2'

now..., main does not contain: '10.123.123.0/24' and is visible on table '2'

root@OpenWrt-x86:~# ip route show table main
default via 49.145.112.1 dev br-wan  src 49.145.127.195
10.1.1.0/24 dev br-e0v4.202 scope link  src 10.1.1.254
10.10.10.0/24 dev br-mgmt scope link  src 10.10.10.254
10.20.30.0/24 dev br-e0v4 scope link  src 10.20.30.254
10.32.64.0/24 dev br-wan1 scope link  src 10.32.64.222
10.54.154.0/24 dev br-wan scope link  src 10.54.154.54
10.123.234.0/24 dev br-lan scope link  src 10.123.234.254
49.145.112.0/20 dev br-wan scope link  src 49.145.127.195
172.16.64.248/29 dev br-e2v4 scope link  src 172.16.64.254
172.24.48.0/24 dev br-e1v4 scope link  src 172.24.48.254
172.27.44.0/24 dev br-e0v4.404 scope link  src 172.27.44.254
172.27.72.248/29 dev br-DNS scope link  src 172.27.72.254
172.27.101.0/24 dev br-e0v4.101 scope link  src 172.27.101.254
192.168.134.252/30 dev br-pve scope link  src 192.168.134.254
root@OpenWrt-x86:~#

root@OpenWrt-x86:~# ip route show table 2
default via 10.32.64.222 dev br-wan1
10.123.123.0/24 dev br-temp scope link
root@OpenWrt-x86:~#

even restarted OpenWRT & my test linux VM, & still no internet...
however, when i did 'ping www.google.com' it is able to see the ip, but still no go.
openwrt-003

any hint's/insights???

lleachii · August 4, 2023, 9:38am

In order to assist fruther, need to know why you did that?

Edit - basically did you add rules that say the DST IP of LANx loookup table 2?

If not the reply traffic no longer has a route.

ambad4u · August 4, 2023, 9:47am

Out of curiosity + experiment + observation...
am just observing the table(s), since 'main' contains many things and table '2' only has 1 line...

lleachii · August 4, 2023, 9:49am

Well, this is likely the issue created by removing the LAN route. Be sure to address that if you do so.

ambad4u · August 4, 2023, 9:54am

i have not added any other rules, rules are just these:

config route
	option target '0.0.0.0'
	option netmask '0.0.0.0'
	option gateway '10.32.64.222'	
	option table '2'
	option interface 'globe'

config rule
	option src '10.123.123.0/24'
	option dest '0.0.0.0/0'
	option priority '2'
	option lookup '2'

btw, does issuing "service network restart" enough when I modify: "/etc/config/network"??? or do i need to add like sort of 'flushing'???

Thank You for your Patience!!!

lleachii · August 4, 2023, 9:57am

To be clear, one is a route, the other a rule
It's not clear, so I surmise then you acknowledge the issue from your post above

I personally use /etc/init.d/network reload

ambad4u · August 4, 2023, 9:58am

am unsure how to answer this, but i did not add further rules...
anyhow, how would "DST IP ... LANx lookup table 2" would look like on the console?

lleachii · August 4, 2023, 10:02am

I didn't recommend you remove the lan from the main table. So I'm not able to advise you on this.

I only suggested:

It's still not clear if you did or didn't alter an interface to use table 2 - hence deleting its route from table main. Please clarify - as the information is important to assist you.

cat /etc/config/network
ip -4 route
ip -4 rule