How to configure OpenWrt as Firewall for your home network and Guest Wifi and IPTables explained
Vložit
- čas přidán 28. 05. 2024
- MANY THANKS TO ALL MY PATRONS on / onemarcfifty !!!
Guest Wifi in your home network can easily be done with OpenWrt. How to configure OpenWrt as Firewall, how to build a firewall for your home network, How to make a Guest Wifi and a separate IOT Wifi and Firewall zone ? IPTables explained in the middle part.
0:00 Intro
0:48 Creating the IOT and Guest Firewall zones
1:32 Explaining the desired setup (IOT/LAN/GUEST)
2:20 Firewall zones in OpenWrt / Luci
2:35 IPTables explained
5:10 Setting the policies in the OpenWrt Interface
7:59 DNS and DHCP for the guest network
9:15 Masquerading and NAT, private IP addresses
10:17 adding and assigning the interfaces
11:48 adding the wireless interfaces
12:42 summary
Please support me on patreon: / onemarcfifty
My youtube channel: / onemarcfifty
Marc on Twitter: / onemarcfifty
Marc on Facebook: / onemarcfifty
Marc on Reddit: / onemarcfifty
Chat with me on Discord: / discord
Licence-free music on / Lizenzfreie Musik von www.terrasound.de/lizenzfreie... - Věda a technologie
You definitely have some of the best videos I have come across on OpenWRT.
Wow, thanks!
Still true! Great stuff.
Yeah! Far less CZcams content on OpenWRT than on pfSense. Marc is a blessing!
Hey man, are you a teacher?! This video is the one that I was looking for and Your explanations are GREAT! OpenWrt is not that simple (and the wiki is confusing IMO) but you make things easier. Keep it up, please !
Hi Francesco, no I am not a teacher 😉, I just love to explain things - all I’m doing on this channel is that I share my own learnings really.
Wow.. just incredible the clear, simple, and well detailed explainations you give to whip a segmented home network that probably will apply to the 99% of us out here... big fan and love what your doing!
Many thanks for the friendly feedback!
@@OneMarcFifty will be sure to check out your discord and patreon options!
@@OneMarcFifty man, you're great, thank you sooooo much for this straightforward explanation!
I've been needing this video for months. I've found OpenWRT to be so confusing. This is explaining exactly what I wanted to know. Thank you so much.
This is such an awsome video! I am just getting started with OpenWRT and LUCI and I have been looking for this kind of video for weeks. Love the level of detail and the screen captures.
Hi Lionel, many thanks - I am glad that you like it !
Best set up video for beginner to achieve a perfect network settings with full understanding of how the os does this.
OMG! Your explanation of the firewall in OpenWRT was the final piece in the puzzle for me - it all clicked with this video, thank you
Awesome - I am glad it helped ;-)
This is such an incredibly helpful video for newcomers to OpenWRT. Very high quality an informative. The way you explain things is so clear. Thank you!
Many thanks Colin !
Just the video I needed - can't wait for the VLAN to 2nd access point episode! I've just set up a two OpenWRT router system because of your fast roaming video.
Many thanks Colin! Perfect timing ;-) I hope that I get this ready until next monday. But it will come _very_ soon.
Simple and effective explanation by covering the audience from beginners to advanced.
Thank you very much for your feedback ;-)
Thanks, this was really helpful. Your explanations gave me enough info to be able to tailor everything to my own needs without being completely lost. The screens shown are a little out of date for the latest version of OpenWrt but are still quite usable.
Hi, many thanks for the feedback - there's newer videos on OpenWrt 21 on my channel https:/czcams.com/users/onemarcfifty
You are doing exactly what I am trying to do. Thank you for the clear explanation!
Awesome- thanks a lot!
Darn, your videos are so clear and well-presented.
great video, clear and amazingly helpful. in openwrt 22.03.5, the "bridge interfaces" checkbox in the "add new interface" menu is no longer there, is there something i need to do in this version to acheive the same thing?
They moved the functionality to the "devices" tab in Network > Interfaces. Create a new device. Select "bridge interface" in interface type and select the port/vlan you want.
Thank you for that great explanation of firewall rules! I really needed this. Great work!
You're very welcome! Glad you liked it !
Kudos. Very informative video and without substantive errors on the topic, and showing the proper understanding of underlying mechanisms This is the proper way in which OpenWrt configuration should be explained.
Many thanks for your friendly feedback!!!
Thanks so much for being so clarified, Mr.!☺
After many hours of struggling with OpenWRT in the past months, finally came back to it and re-watched your series on OpenWRT, I think I have a handle on it now (which probably means I don't understand it 🙂 ), and now have Guest Access points and its all working well..... its a steep learning curve with Openwrt, didn't get the fundamental building blocks of "interfaces" and how they relate to the router, to physicall ports and other network dark arts, but its now making much more sense. Many thanks Marc....
Hi Tony, glad to hear that the videos helped bringing pieces together. It's true that every software has their own look and feel and also - I'd say "philosophy" of looking at things. the main thing I personally struggle with products that are new to me seems to be exactly what you describe - getting my head around the "way of thinking" - or building blocks like you called it. Don't give up ;-)
To be honest, brilliant!
It's not only that you explain it simple and brilliant, in addition you really lern!
Hi Christian, many thanks - glad you like it ;-)
Thanks so much for all those great video Marc.. It's really helping me to go everyday a step further on my home network. It takes time, but I will get there...
Awesome, many thanks for your feedback!
Definetly one of the best videos on OpenWrt Firewall settings. Thanks a lot! brillant.
Thank you very much !
Hi Marc. I would like to see another video in this series and I believe it is a must. Setup of IGMP snooping and mDNS so devices and services can be discovered across the network. This would provide a seamless experience for the users.
Hi, definitely. mdns and IGMP are on my list - but unfortunately not at the very top ;-( The use case would be airprint / airplay etc.
@@OneMarcFifty also this would be beneficial when using smart home apps like home-assistant, where devices discovery is very convenient
First of all, I would like to thank you. And I would like to ad just one small thing. I forgot the rule for the IOT-DHCP part in the firewall configuration section. Without it the IOT devices will never get the IP addresses 😀
That was excellent - thank you for demystifying openwrt firewall settings
Thank you very much!
This is the best channel on Openwrt and some more, please continue !
Many thanks for your kind feedback. There will be more to come. I have taken some days off in August and will definitely produce more ;-)
Thank you for this superb video. I finally could understand the firewall in OpenWRT easily!. Subscribed and waiting for more OpenWRT master classes 😉
Awesome, thank you!
i'm from indonesia, i didnt speak english well, need more focus to understand what the meaning of
so i've watch this video again and again
great job, thank for your explaining video
Hi, many thanks for your feedback. Please check out the subtitles. You should be able to use automatic translation to Indonesian.
So good. Thank you for clear explanation!
Many thanks Anatoli.
Thank you so much for the effort you put to create this video.
Many thanks ;-)
I am *completely* in agreement with you about the need to block IOT devices from phoning home.
Many thanks for the feedback ;-)
Awesome content! Thank you… I see many new projects in my future. New sub!!! 👍🏾❤️
Awesome - many thanks for watching and subscribing !
Great openwrt videos,same case in my home,i want to trunk two openwrt routers with diferent vlans,thanks!!
Many thanks for your feedback!
Thank you very much 😊
Great explanation
Thank you
Another great video.
I've been reading documentation for days to find out what and how I have to configure a OpenWrt router. Just like Franceso Pocci, I find the OpenWrt documentary very confusing. Only when you understand how it works can you understand it :(
And like Colin Nicholson, I'm excited about the expansion to include VLANs.
You have a talent for explaining complicated things simply. Great. And that with the proverbial "German thoroughness"
Last night I managed to flash my Archer C7 on OpenWrt. Had the latest TP-Link firmware and unfortunately only worked with TFTP. It took me a long time to find out that media sensing was the problem to get TFTP to work. :(
I'm going to do the configuration right now. I will try myself to get VLAN working too...
Many greetings from Braunschweig to Berlin
Many thanks for your kind feedback!
@@OneMarcFifty
Got VLAN's for IOT / Guest work on my Archer C7 :)
LAN Ports and Wireless works as expected. Thanks to your video "Building a managed switch with OpenWrt on old Wifi Router"
Next step is to add an additional dump AP with VLAN support, fast roaming, ...
I would like to see another episode on the topic. Extended firewall configuration according to the blacklist principle when using VLANs.
E.g. allow HTTP / HTTPS from LAN / Guest zones, but stop sending SMB packets over the WAN interface.
Very helpful, Thank you!
Great video, clear. Thank you.
Thank you very much !
This channel is a treasure! Thanks you!
This is so good. Thank you very much for sharing.
Hi Josh, thank you very much !
@@OneMarcFifty it’s silly but after a 15 year career at big tech companies in Silicon Valley, this is the video which made iptables finally click in my head! Would love to see a deeper dive, I feel like you have a lot to share.
This is am outstanding video. I hope your channel is successful. You deserve it. I am subscribing.
Hey Brian, many thanks for your kind feedback and for subscribing!
The best video for openwrt. Thanks you so so much for this.
Many thanks for your kind feedback ;-) czcams.com/channels/G5Ph9Mm6UEQLJJ-kGIC2AQ.html
thank you for such amazing videos.😍
Many thanks Andy
So good! Congratulations.
Really well organized and informative! Thanks so much!
Just wanted to clarify around the 8:52 mark: If I want to separate these rules, wouldn’t DNS be using UDP and DHCP using TCP? I think you might have flipped them.
I am actually simplifying the rule in order to just use one. I open both protocols tcp and udp on both ports. But because there is nothing else on the opposite protocol there should be no risk to that.
@@OneMarcFifty According Wikipedia, looks only need open port 67 for DHCP cause port 68 only use to reply to client, so it not necessary. zh.wikipedia.org/wiki/%E5%8A%A8%E6%80%81%E4%B8%BB%E6%9C%BA%E8%AE%BE%E7%BD%AE%E5%8D%8F%E8%AE%AE
@@OneMarcFifty You said that DNS uses only TCP. False! DNS uses UDP unless answer is too big to be delivered over UDP, in which case server tells client to connect again using TCP.
Thank you for the great content! I would like to know a bit more, how do you configure the provider's router LAN output and the first OpenWRT WAN input area? Do you allow the provider's router to make the NAT? Or will it be done also in the OperWRT?
In my case, I just set the WAN interface of OpenWrt to DHCP, i.e. I let the ISP do NAT. From a performance standpoint not the best solution but the easiest to implement as from the ISP router's standpoint it looks like there is just one client.
Thanks for the explanation, it was very clear. I have been fooled by that double "forward" setting! If I can ask, what hardware did you use to install OpenWRT on?
Yeah, that one is hard to explain because the terms are so similar. Honestly I can’t remember which hardware I used for the video - one of Archer C7, D-Link dir2660 or potentially a VM.
Well explained and sumarized the firewall concept of openwrt, not available in utube though it is in openwrt forum scattered in bits and pieces. Looking for videos on :
1. parent contro traffic rules, esp this pandemic season it all the more imperative. Kids are smart with their whack a mole device outwits the tagged IP or MAC in traffic rules.
2. Access openwrt router from internet (we have one of the wifi tagged to OpenVPN). No videos on this in you tube.
Hope there would be enough requests for these and would be helpful to mmany openwrt users. Thanks in advance.
Many thanks for your feedback @Ranish and thank you for the suggestions - port forwarding is on my list but parental control was not - I‘ll have a look into options (hint: give your kids a separate Wifi in a separate FW zone, this is resistant against ip/mac changes)
Great video, i'm often refering to it whenever my memory fail me :) I do have a question: On my iot zone, how would you enable smtp only to go through wan so my wireless cameras can send me emails on events. Your instructions on iot zone restrict access globally under zone forwarding proving no wan access. Would you go the by the trafics rules instead to permit only smtp protocol. Thank again for your great tutorial.
Please visit my channel page: czcams.com/users/onemarcfifty
Want to talk to me? Join my Discord Server: discord.com/invite/DXnfBUG
Thank you so much 👍👍👍
You’re welcome;-)
very nice, thank you sir...
Hi thank you - glad you liked it ;-)
Great tutorial
Thank you !
Awesome Thank you!
You're welcome!
Thank you Sir
This is a great video, and I used it to setup my home network with just a few customizations, but I just tried this again using OpenWRT 22.x and the changes are just too important, especially the missing "Bridge Interfaces" option which also breaks the wireless network setup. Can you please consider updating this video with a 22.x version? Thank you.
It’s true - things have changed a bit. I’ll probably do some follow up as soon as the remaining dependencies to iptables will have been removed
@@OneMarcFifty Please confirm can we overcome this by using a specified bridge e.g. br-lan? or I am missing something
Very enlightening! What if i have an NVR and connected it the IOT wifi, will it be able to notify me incase I turned on the Detect Motion and Notify me. Thanks and More Power!
Hi, thanks for your comment - I personally like to do notifications over network boundaries with MQTT - for this I have Mosquitto running on my router which is accessible from all network segments
Great video helped out a lot as openwrt does things differently than other custom firmwares. One thing though my tv won’t connect to the IOT wifi I created is it due to way the forwarding because the tv needs an wan connection? Or am I understanding this wrong.
It might need a default gateway- or maybe it’s checking internet access? Dificult to say from a distance
great video once again
Many thanks!
@OneMarcFifty at the 10:39 mark you ticked the bridge interface box, in 22.03 that box no longer appears and we have to manually create a device to configure. What physical devices are you bridging by ticking that box?
Hi Randy - as such you're just creating an empty bridge where you can add devices later. In Versions 21 and later you would create a bridge under devices and then add the devices you want to the bridge.
Wonderful.
Hi, thank you for sharing this info, question, is there a way for Block access using MAC Filtering , I just want to allow wireless connection for those devices with MAC address in my list. Regards !
Hi, you can do that on the "Security"tab of the Wireless. Another possibility would be to just not give them IP addresses over DHCP.
I took inspiration from my video... 😀
Hi, I assume you meant "for" your video ? That's totally OK ;-) All the best and good luck for your channel !!!
Hey Marc, first of all thanks for this very good tutorial, which helped me very much!
Also I got a question: I would like to specify a firewall zone for a specific port on my router. Is that possible? How? Thanks a lot in advance!
Yes that’s possible. You would just have to assign a port untagged to a VLAN and then define an interface that is using the specific VLAN. With DSA on version 21 you could also just define an interface that has the port device (e.g. lan2) as the physical device and assign it to the desired zone. Just make sure the port is not on any other bridge or the like.
Thank you.
And thank you for watching ;-)
Great video again Marc :-) I have a question, is it possible to put one or more of the ethernet ports in a zone that way putting it on a seperate real network like you did with the firewall zones as opposed to a vlan?
Thanks mate! What you are looking for _is_ effectively VLAN, you can‘t assign a switch port to a firewall zone without eth.x interface.
@10:30 what does the enabling "Bridge interfaces" here actually do? How did it help in the "next episode" and what would have happened if we didn't enable it?
BTW: GREAT OpenWRT explanation. Firewall Zones on OpenWRT is a hard topic for me, but now I more or less get it.
Mainly "enabling bridge" in OpenWrt 19 links the interface to a bridge rather than one single interface. The advantage is that you can add multiple devices (Ethernet, VLANs, Wireless) to one single interface rather than have one single interface. Things have changed in OpenWrt 21 as well w/r to the separation of "interface" and "device"
Marc - great content really enjoyed it. Just one observation in relation to the OpenWrt firewall gui screen and your comments around 6:30. Earlier in the video you explained nicely about the different tables and chains involved but your comment about ignoring the forward chain setting on the right hand side of the screen threw me at first. You are basically saying ignore it (in fact I could just set the forward action to reject) as it has no effect at all as you should actually control forwarding through the edit menu function and by how you configure the two drop down menus at the bottom of the screen i.e. "allow forward to destination zones" and "allow forward from source zones". Just thought I would check my understanding is correct? thanks again
Hi - many thanks for asking ! I had to look it up before I made the video ;-) the third setting on the right is actually forwarding WITHIN the zone, i.e. if you had multiple networks inside the LAN zone and would want to allow or deny forwarding between them. So it's INSIDE one given zone. The setting that we change in the vieo is the forwarding BETWEEN zones, i.e. from one zone to another ;-) Great question - many thanks for your feedback !!!!
Hi, you are a great trainer. Your explanations are clear and calm.
I do have a problem.. I followed your steps but I run into some issues:
1) any cable I plug in the router LAN ports seem to be routed to guest lan.
2) also the normal wifi is routed to Guest lan.
I checked and rechecked your video and I dont seem to do anything different.
I use Luci 21.02. Do you think that has different settings?
I must say that the GUI is just a bit different an so some of the options.
Any chance you can review this tutorial with the latest Luci? or give me some suggestions?
Thank you
That's true there is new framework called DSA instead swconfig from video. it's quite embarrassing for newcomers like me too.
Hi, first off - many thanks for your feed-back! Actually yes, things have changed in OpenWrt 21 and more importantly with Linux Kerne 5 and the way VLANs are handled - the new DSA architecture is customized on the interface itself, there is no "switch" menu item any more. I'l see if I can update the series.
Ah - saw your reply - yes correct - DSA requires configuration on the interface itself. I'll take a note of this and update as soon as I can.
Hello, excellent your lessons! :)
any lesson to configure "Nat 1:1 in openwrt " or netmap - Dnetmap "??
Hi JB, many thanks ;-) I'll need to have a look at NAT networks and possible videos on that - comes up quite often. But none for the time being I'm afraid ;-( czcams.com/channels/G5Ph9Mm6UEQLJJ-kGIC2AQ.html
Hi Marc, quick question for you. @10:30 you mention to Bridge Interfaces, but now on latest 22.03 version that isn't there anymore. Do we need to do something different now? The only thing I could see in regards to bridging was to select the device to "Bridge: "br-lan" (lan)" but that seems to do something different...Thank you.
Yes, you can use br-lan or any other bridge that you create under the devices tab. That does the same.
@@OneMarcFifty Thanks for looping back around to this! Is there any benefit to setting up a separate bridge for the guest and iot interfaces, or can they all safely use the same bridge? (i.e. why would you have set up separate ones in earlier versions?)
Would you mind sharing what router models you use/suggest for the Router/Firewall and Access Point Devices? Thanks for these videos, I've been struggling in vain to do a similar setup using dd-wrt.
Hi Andrew, in the video I had been using Archer C7's but I have replaced them with D-Link DIR-2660's these days. You might want to check my video on Router models here: czcams.com/video/wP1ZcQBLL1k/video.html
Marc, great video, convinced me to move to OpenWRT with all my thought to restrict the local devices I have as much as possible. One question though - why not restricting IoT devices to access my router? I'm not an expert, but doesn't those smart plugs represent a trojan horse for someone who knows what to do with them once they can ssh to my router? What if we "reject their input" and create the same rules as for Guest Network with DHCP rule only?
Hi Vadim, valid approach. There is no 100% Security ;-) If someone takes over your router then you might have a whole bunch of other problems as well ;-)
Thank you for this tutorial good Sir! This is verify helpful to me. Just want to add 1 question Sir. Is there a way to separate browsing (wanA) and gaming (wanB) on different wan interfaces with a failover option?
Yes you can do that. Just define two lan interfaces, attach a wifi to each one and define the same or different firewall rules for each (basically allow forward to wan)
Thank you so much for this wonderful video!
At 10:25, I'm not seeing a "Bridge Interfaces" option in the current version of Luci. Proceeding to create an interface without that option shows "Device: Not Present" under status. Any idea what could be wrong?
I have the same problem. Did you resolved?
Things have changed in OpenWrt 21 - video is in the making and will come out in December !
@@sidbyron210 Yes, I managed to resolve it. I created separate VLANs and used them.
@@OneMarcFifty Am I correct that I can just create a custom device named br-GUEST and br-IOT?
@@OneMarcFifty Hello, did you ever make this video? I am stuck at this part. Thank you!
Thank you very much for your videos, they were really helpful for setting up OpenWRT :)
Quick question: How can we isolate devices from each other in the guest network? I have created a bridge device br-guest bridging br-lan.3 and bat0.3 (I use batman-adv) and added it to the guest network. Communication between lan and guest is blocked, however the devices in guest can see and access each other. Checking AP isolation on the radios and bat0 seems to change nothing. On DD-WRT i had to manually setup ebtables. Is there any way to set this up with luci? Thanks a lot!
I have not yet found a good way to do this. If you set up Wi-fi isolation, it will work on one AP but not over many APs. Firewall-wise you can't really define such a rule in LuCI. You would need to come up with some rule based on the MAC addresses (deny all traffic from GUEST except to the router itself).
@@OneMarcFifty Thanks for your response! I have researched a bit and found some ways to achieve this. One easy and efficient way would be to enable VLAN filtering in the br-guest settings and simply setting 1 PVID Egress untagged on each Port there. This would effectively deny all local communication on that bridge. However there are two problems: Using batman-adv on nodes, this would also deny communication to the gateway router via bat0.3. Also, there is currently a problem with the bcm4366 driver (?), where wifi does not work on bridges with VLAN filtering enabled.
I did the following to achieve this goal:
- Enable AP isolation on guest Wifis on each node
- Install ebtables-nft and add the following to the startup of the gateway router:
ebtables -A FORWARD -logical-in br-guest -logical-out br-guest -j DROP
- Add this to the startup of all other nodes that are connected via batman-adv:
ebtables -A FORWARD -logical-in br-guest -logical-out br-guest -in-if ! bat0.3 -out-if ! bat0.3 -j DROP
I read a lot online that ebtables is quite inefficient, however this is the only way that worked for me. I didn’t notice any performance degradation doing this.
Great one! I’ll add that to my router for testing as soon as I can - thanks for sharing!
Excellent
Thank you!
Marc, do I need to add a new interface for each Vlan ID I want my router to recognize or is adding it on the "Switch" page enough?
And also do i add firewall zone settings for each? I may be thinking too complicated for this and it's much simpler than I thought
It depends on the OpenWrt version. I briefly touch on this in the "VLANs in OpenWrt 21" video.
Hi, great videos. One question though, why does your IoT network have access to the router interface/login page? I had a rogue IoT device previously attempting user/Pw combinations, I really want to avoid this. How would I block them from seeing my router?
You also said you don't want devices on your IoT network to phone home. How would they continue to work if blocked from WAN? E.g blink cameras, nest doorbells etc as they need Internet?
Hi Will, mainly this was just for the sake of simplification. You could as well set the default Input to "drop" and then enable only needed services (such as DNS, DHCP, maybe NTP). W/r to internet access - the IOT devices that I use are no cloud devices. They are mainly DIY devices built with ESP8266 or ESP32 micro controllers and don't need internet access. My vacuum cleaner is an exception. It does need internet access and is in a separate DMZ.
Hi thanks for the tutorial. Very well done.
I have a question: since I follow the tutoria and created the 2interfaces for IOT and guest, all my physical ports seems to fall under the IOT DHCP server.
What am I doing wrong?
Hi Cattivello, difficult to say from a distance - are you using OpenWrt 19 or 21 ? in 21, the configuration of the VLANs is different.
@@OneMarcFifty 21 (yes, i noticed some differences) for the rest it all works. But at the moment i have to create static leases to make sure my devices stay in the correct subnet
@@cattivello You may be allowed to forward between firewall zones.
I had an IOT WiFI access point, with its own SSID and password but associated with LAN (so not network separation). I followed most of the setup here to use a separate zone: ping works but my Kasa switches are no longer acessible. This is because broadcast is used to retrieve the switches, but local broadcast does not reach the IOT (different address space).
I found the udp-broadcast-relay-redux package, which does exactly what I need. If I launch it by hand to forward LAN broadcat requests to the IOT zone, then everything works. I checked and found that this was installed as a service, with a UCI-style configuration in /etc/config. However, no matter how I configure it, it does not start any instance of udp-broadcast-relay-redux. No error shown in the log either. After looking at the init script, I found that I needed to fill the "Service" attribute of the IOT interface: now "uci get network.IOT.device" returns the proper value, but the service instance still does not start.
My contribution to call to action: a tutorial on how to make udp-broadcast-relay-redux work would be really nice.
PS: I followed the demonstrated setup, and it worked fine (beside the broadcast issue, which I should have anticipated), even while the "Bridge Interface" option was not visible in Lucy. I understand this option was only enabled for future setups, and I guess that this is no longer needed.
Many thanks for the thorough feedback and sharing your solution
@@OneMarcFifty I am sorry to report that I did undo the separate firewall zone, and hooked my IOT access point back to the LAN interface.
The main issue has been how to setup new devices without access to the Internet. A secondary issue are the difficulties with configuring or using udp-broadcast-relay-redux.
I could have setup temporary firewall rules to allow Internet access while installing new devices, but that represents an additional headache.
Call to action: a video to explain the best approaches for installing new home automation devices on an IOT network without Internet access. 🙂
Hello,
Your explanation is amazing, can you make a video about UPnP in openwrt 21.
Hi Issam, what's the use case for UPNP ? Is it subnets with DLNA/UPNP Servers and clients spread over the subnets, i.e. let's say Airplay, Airprint and the like over network boundaries ?
@@OneMarcFifty Hello, I want to know about the the relations between the UPnP binary and iptables rules and zones. How does the UPnP add the rules to open ports between lan and wan zone.
This video only made me realize I do not have the basic skills. This is gonna take a while. But hey, that's the fun of it!
Hi, many thanks for your comment! Oh yes - I know the feeling ;-) You know, many of my videos are born out of ideas where I had absolutely no clue before I started producing the video! I take a lot of inspiration from the discussions on Discord - basically I am only sharing my learnings ;-) If you do however have an idea on how to support with a video on basics or the like then please let me know!
Hi! Actions ACCEPT, REJECT ... etc. are used when we talk about rules in the chain (with appropriate criteria for a packet in these rules) but not to the chain itself. How it can be understood? Does it mean that chosen action is applied for all rules in the chain? Thank you!
Hi Aleksandr, those rules are default settings, i.e. they apply for everything. If you want then you can have exceptions in the traffic rules and be more specific on Source IP, Destination IP and many more.
Hi Marc, thanks for the video, it really helped me a lot! I have one question about my specific setup. I have one device which needs to be able to talk to all iot devices, the iot devices need to be able to talk to that one device and this but only this one device needs to be able to access the wan zone. Right now I located that one device in the iot zone but don't know how to setup a rule so that this one device can access the wan. Can you help me with this one? Thank you!
Go to Network-Firewall-Traffic rules, add a new rule. Name "IOT exception", protocol : TCP/UDP or whatever you need, Source Zone: IOT, Source Address: Select the device that should be able to talk to the internet. Destination Zone: WAN, Action: accept. Mae sure that rule is at the top of the list or at least before any deny rule, save and apply ;-)
@@OneMarcFifty Thanks for the quick reply. What I was missing was that I just allowed TCP/UDP and I was testing my connection via a ping 🤦♂️
@@Raukze Perhaps you had to indicate the protocol as "Any".
i want to open the iot network for mqtt at port 1883 for the lan network, so that my iot devices can send packages to a mqtt broker which is in lan. I dont know how to handle it.
Hi Mark!
In openwrt version 22.0.3, when creating a network interface, you need to select a device. Apparently for the guest and IOT you need to create a new device?
Either you create a device for each VLAN (eth0.44 or the like), add it to a new bridge or you can use Distributed Switch architecture DSA. There is a video about VLANs on version 21 on my channel page
Thanks for the videos! I am trying to follow you to achieve the dumb AP vlan over one cable, but when I try to create the new interface I do not see the "Bridge Interfaces" checkbox (video @ 10:44) and then when adding Interface my status shows "Device: Not Present" while you show "br-GUEST" (video @ 10:54). I am on the Belkin RT3200 snapshot r21517-d7876daf65. Anyhow, it seems maybe I missed where the device br-GUEST was created. Any ideas?
This has changed in OpenWrt 21. You now create a bridge device under Network-Interfaces-devices tab, add the Ethernet ports to it. Define an interface and attach it to the bridge. When you create a Wifi you can then attach it to the network.
Nice explanation. I just flashed openwrt to my router. I have a raspberry Pi running multiple applications on docker connected via ethernet. They all have unique IP's on my LAN ( by creating a macvlan network). Is it possible to isolate one application (using one unique lan ip) so that it cannot access other LAN devices?
Hi Aditya, that scenario would require the implementation of VLANs on the host and then binding the docker containers to the separate VLANs (e.g. eth0.3 / eth0.4)
is the defalt firewall settings good sucurity?
Thanks for the great content. I followed the procedure and put iot devices as well as my printer into a different subnet. Now my computer can't find the printer. Could you please tell me how to make my printer accessible by my computer and mobile phones?
You'd need an mdns repeater/IGMP proxy style of software in order to use Airprint and the like so that your phone sees the printer. Omcproxy might do the trick or else mdns-repeater in a linux container or Avahi with echo function. Plus you need to allow ports 9100, 631, 443 TCP and 5353 UDP to the printer
Is there to still block devices on the iot firewall from the internet, but also certain ones. For example a smart TV, Google home, or HA server
You could add another zone and call it "Multimedia" or the like
question, would you class android streaming boxes and Chromecast googletv as IOTZone worthy and what about making casting work in this type of configuration?
Hi, I have added my Multimedia devices (Kodi, bluray player, TV Sets and the like) into a separate Multimedia Zone. Getting mDNS and broadcasts to work requires a lot of fine tuning and configuration... not easy ;-(
Can you possibly cover how to set that up please?
Hi Marc. First of all your videos are very helpful and I'm great full for you putting in the time in teaching. However, I'm having an issue that didn't work on my end (7:08 mark). I followed everything on the guest zone, then I tried on that zone with my laptop to see if it works but, it let me ssh. I must've missed a step. I watched the video over a bunch of times. And I can't seem to get out of this loop.
Hi Drew, are you saying that you _can_ ssh into the router's guest IP even though your expectation is that you can't ? Presumably then you are connecting to the router over the LAN and not the GUEST network ? Even connecting to another IP _on_ the router would NOT go through the forward chain but through the INPUT chain of the network that you are connecting from. So if you connect from LAN, then yes - you can ssh to the guest's IP address. ut you can't do that if you come FROM guest.
Yes, as Marc has said, simply put: your laptop needs to be connected ONLY on your Guest Network for this to work (well, not work for the SSH part heh)
if you're plugged in with ethernet, you need to make sure that port is a Guest only port and not a LAN port (via Switch>VLAN ID).
@OneMarcFifty Do you have plans to cover traffic queuing/queue management for Bandwidth Control? OpenWRT has some good algorithms but deep dives would be very useful!
Yes I do. With regards to the current situation (many of us working from home) I was thinking about two subjects - one is internet line availability/fail over and one is QoS.
@@OneMarcFifty Very nice. For the internet line availability/fail over series, could you consider WAN Bonding with ROOter and OpenMPTCProuter? I ask because you did a very similar video a month ago and this could continue that but using OpenMPTCProuter.
I am thinking about doing stuff with multipath tcp and OpenMPTCPRouter. Maybe use mptcp with client certificates...
@@OneMarcFifty YES! I just left a comment on your bonding video to see how others react to the suggestion. ROOter is very well built for cellular/wisp usecase (failover for when wired internet backhaul might die)
What is actually the advantage of using ROOter? As far as I understand it‘s based on OpenWrt?
Thank you for the video! I have set up a guest wifi on my Openwrt 19.07 router. Everything works as it should, and the guest clients connected to the guest SSID cannot ping LuCi or any other IPs in the LAN zone. BUT I want the guests to be able to communicate with one IP in the LAN zone, a brother network printer. I checked what common ports are used for network printers and I have set up a traffic rule allowing use use of those ports only to the IP of the printer in the LAN zone. But I cannot access it from the guest clients.
Only if I allow "Forward to destination zone LAN" in the firewall zone settings in the guest zone, the devices in the guest zone is allowed to reach the printer, but then they can access the rest of the IPs in the LAN zone as well. How can I make the traffic rule somehow override the Firewall zone settings?
Create a traffic rule (Network - Firewall - Traffic rules). Set the protocol to TCP. Source Zone to GUEST, do NOT add a source IP. Set the destination Zone to LAN, specify the IP of your printer in the "Destination address" drop down. Specify the destination ports (e.g. "9100 631 515 443") and set the Action to "accept". Make sure that the rule is ABOVE any other deny rule (i.e. move it to the top of the list).
Marc, I have a use case where a guest on the Guest lan needs access to a printer on the LAN lan. I've tried adding a firewall traffic rule to allow access to the printer ip address from the Guest lan. This doesn't work as it appears the general lan to guestZone forwarding rule is executed first and blocks all traffic from the Guest lan to the LAN lan. How do you handle forwarding exceptions to the general zone forwarding rules?
The general setting should not be evaluated before a traffic rule. However, if there is a traffic rule above then this goes first
@@OneMarcFifty You were spot on, there was another conflicting traffic rule.
Hey Mac, question you might be able to answer - I have my access point set to AC mode on 5Ghz, but my devices don't seem to connect on that mode. I have one device with an AX WiFi chip which connects via 802.11a band and a device with an AC WiFi chip which connects on 802.11n. How can I make them connect on AC, and how can I confirm my access point is correctly broadcasting AC?
Hi - in order to check what the access points are broadcasting I suggest running "iw scan" on a Linux workstation with Wifi hardware. That will show you everything.
Would love to learn how to enable IPv6 on my Guest and IOT zones.
Hi Rafael, I will do IPv6 episodes this year.
@@OneMarcFifty I would also love to understand IPv6 in OpenWrt. It is very necessary today.
Thank you very much for the video. It's a pitty, it is outdated. I cannot follow with the video, because in the new openwrt version things are different, starting with creating interfaces. Is it possible to update the instructions?
Running 22.03, and setting up a zone to reject input, let's say from a guest network, is yielding all devices on the interface, in that zone, with the inability to get a IP from the DHCP server. In order for the devices to connect to the internet, they need to be configured on the device end to have a static IP within the range... I think openWRT in a update changed the way these firewall zone rules work?
You are genous
Thank you ;-)