☰

目标

tag-icon • tag-icon firewall openwrt
目标

目标

我想要两个 LAN：lan0和lan1。 lan0是未加密的流量；lan1将是一个始终活跃的 VPN。我尚未配置 VPN，因此它目前只是第二个未加密的网络。

我希望将其配置为这样：

在此输入图像描述

症状

不幸的是，lan1（LAN1_INTERFACE在配置文件中命名）不起作用。

  • 无法加入WiFi网络：

在此输入图像描述

  • lan1 接口 (LAN1_INTERFACE) 没有 IP 地址：

在此输入图像描述

我怀疑防火墙配置不正确。

我缺少什么？我还有其他问题需要解决吗？

配置文件

/etc/config/network：

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fd22:91e8:0e0f::/48'

config interface 'wan'
  option ifname 'eth1.201'
    option proto 'pppoe'
    option username 'user_name'
    option password 'password'
    option ipv6 '0'
    option _orig_ifname 'eth1'
    option _orig_bridge 'false'
    option mtu '1492'

config interface 'lan'
  option ifname 'eth0'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'
  option _orig_ifname 'eth0 wlan0'
    option _orig_bridge 'true'

config interface 'lan1_interface'
  option ifname 'eth2'
  option force_link '1'
  option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.2.1'
    option netmask '255.255.255.0'
  option _orig_ifname 'eth2 wlan1'
  option _orig_bridge 'true'

config interface 'vpn_interface'
  option ifname 'tun0'
  option proto 'none'

config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '0 1 2 3 5'
    option vid '1'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '4 6'
    option vid '2'

/etc/config/wireless：

config wifi-device 'radio0'
    option type 'mac80211'
    option channel '36'
    option hwmode '11a'
    option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:02.0/0000:02:00.0'
    option htmode 'VHT80'
    option disabled '0'
    option txpower '23'
    option country 'US'

config wifi-iface
    option device 'radio0'
    option mode 'ap'
    option disabled '0'
    option encryption 'psk2+tkip+aes'
    option key 'password'
    option network 'lan'
    option ssid 'Router'

config wifi-device 'radio1'
    option type 'mac80211'
    option channel '11'
    option country 'US'
    option hwmode '11g'
    option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:01.0/0000:01:00.0'
    option htmode 'HT20'
    option disabled '0'
    option txpower '19'

config wifi-iface
    option device 'radio1'
    option mode 'ap'
    option disabled '0'
    option encryption 'psk2+tkip+aes'
    option key 'password'
    option network 'lan1_interface'
    option ssid 'Router [VPN]'

/etc/config/dhcp：

config dnsmasq
    option domainneeded '1'
    option boguspriv '1'
    option localise_queries '1'
    option rebind_protection '1'
    option rebind_localhost '1'
    option local '/lan/'
    option expandhosts '1'
    option authoritative '1'
    option readethers '1'
    option leasefile '/tmp/dhcp.leases'
    option resolvfile '/tmp/resolv.conf.auto'
    option localservice '1'
    option nonwildcard '0'
    option domain 'lan'
    option port '5353'
    option dhcpscript '/etc/resolver/dhcp_host_domain_ng.py'

config dhcp 'lan'
    option interface 'lan'
    option start '100'
    option limit '150'
    option leasetime '12h'
    option dhcpv6 'server'
    option ra 'server'
    option ra_management '1'
    list dhcp_option '6,192.168.1.1'

config dhcp 'wan'
    option interface 'wan'
    option ignore '1'

config odhcpd 'odhcpd'
    option maindhcp '0'
    option leasefile '/tmp/hosts/odhcpd'
    option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'lan1_interface'
    option start '100'
    option leasetime '12h'
    option limit '150'
    option interface 'lan1_interface'
    list dhcp_option '6,192.168.2.1'

/etc/config/firewall：

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

#
# includes
#
config include
    option path '/etc/firewall.user'

config include
    option path '/usr/share/firewall/turris'
    option reload '1'

config include
    option path '/etc/firewall.d/with_reload/firewall.include.sh'
    option reload '1'

config include
    option path '/etc/firewall.d/without_reload/firewall.include.sh'
    option reload '0'

config include 'miniupnpd'
    option type 'script'
    option path '/usr/share/miniupnpd/firewall.include'
    option family 'any'
    option reload '1'

#
# zones
#
config zone
    option name 'wan'
    option network 'wan wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config zone
    option name 'vpn_zone'
    option network 'vpn_interface'
    option input 'REJECT'
    option forward 'REJECT'
    option output 'ACCEPT'
    option masq '1'
    option mtu_fix '1'

config zone
    option name 'lan'
    option network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'

config zone
    option name 'lan1_zone'
    option network 'lan1_interface'
    option output 'ACCEPT'
    option input 'ACCEPT'
    option forward 'ACCEPT'

#
# fowarding
#

config forwarding
    option dest 'wan'
    option src 'lan'

config forwarding
    option dest 'vpn_zone'
    option src 'lan1_zone'

config forwarding
    option dest 'wan'
    option src 'lan1_zone'

#
# IPv4 rules
#
config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

#
# IPv6 rules
#
config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

#
# rules
#
config rule
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config rule
    option target 'ACCEPT'
    option proto 'tcp udp'
    option dest_port '5353'
    option name 'Allow Guest DNS Access'
    option src 'lan1_zone'

config rule
    option target 'ACCEPT'
    option proto 'udp'
    option dest_port '67-68'
    option name 'Allow Guest DHCP Access'
    option src 'lan1_zone'

** 编辑 **

路由器：塔里斯奥姆尼亚

第二个 LANdhcp_option真的应该是'6,192.168.2.1'还是'6,192.168.1.1'？我也不明白这是6做什么的。

答案1

关于有关 dhcp_option 的第二个问题，“6”是 dhcp 服务器的指令，用于将列出的 IP 地址推送为 DNS 服务器以供客户端使用。 dhcp 服务器推送到客户端的每个选项都有一个数字指令，其中 6 是 DNS 服务器的指令。

答案2

通过进行一些更改解决了问题：

/etc/config/network：

config interface 'lan'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option _orig_ifname 'eth0 eth2 wlan0 wlan1' # needed?
    option _orig_bridge 'true' # needed?
    option ifname 'eth0'

config interface 'lan1_interface'
    option enabled '1'
    option type 'bridge'
    option proto 'static'
    option netmask '255.255.255.0'
    option bridge_empty '1'
    option _orig_ifname 'wlan1' # needed?
    option _orig_bridge 'true' # needed?
    option ifname 'eth2'
    option ipaddr '192.168.2.1'

相关内容