OpenWrt Forum Archive

Topic: Creating separate network - routing problems

The content of this topic has been archived on 20 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
jaros1024
30 Jun 2017, 13:02

Hello.
I need to create separate WAN and LAN for IPTV. It should work simultaneously with the Internet. In fact, I need something like 2 routers in one. I've created 2 new VLANs, configured the networks, created new rules in firewall (they should forward all the traffic) and created dhcp entries.
My configuration:
/etc/config/network

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fd0b:7b69:597a::/48'

config interface 'lan'
    option ifname 'eth0.1'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option ipaddr '192.168.3.1'
    option dns '208.67.222.222 208.67.220.220'

config interface 'wan'
    option ifname 'eth0.2'
    option proto 'dhcp'

config interface 'wan6'
    option ifname 'eth0.2'
    option proto 'dhcpv6'

config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'
    option mirror_source_port '0'
    option mirror_monitor_port '0'
    option enable_vlan4k '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '1 2 5t'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '0 5t'

config switch_vlan
    option device 'switch0'
    option vlan '3'
    option ports '3 5t'

config switch_vlan
    option device 'switch0'
    option vlan '4'
    option ports '4 5t'

config interface 'wan_tv'
    option proto 'dhcp'
    option ifname 'eth0.4'
    option macaddr 'XX:XX:XX:XX:XX:XX'

config interface 'lan_tv'
    option type 'bridge'
    option proto 'static'
    option ifname 'eth0.3'
    option ipaddr '192.168.4.1'
    option netmask '255.255.255.0'
    option igmp_snooping '1'

/etc/config/firewall

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    option network 'lan'

config zone
    option name 'wan'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'
    option network 'wan wan6'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config include
    option path '/etc/firewall.user'

config rule
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config rule
    option src 'wan'
    option proto 'igmp'
    option target 'ACCEPT'

config rule
    option src 'wan'
    option proto 'udp'
    option dest 'lan'
    option dest_ip '224.0.0.0/4'
    option target 'ACCEPT'
    option family 'ipv4'

config zone
    option input 'ACCEPT'
    option output 'ACCEPT'
    option name 'wan_tv'
    option forward 'ACCEPT'
    option masq '1'
    option mtu_fix '1'
    option network 'wan_tv'

config zone
    option input 'ACCEPT'
    option output 'ACCEPT'
    option name 'lan_tv'
    option forward 'ACCEPT'
    option network 'lan_tv'

config forwarding
    option dest 'wan_tv'
    option src 'lan_tv'

config forwarding
    option dest 'lan_tv'
    option src 'wan_tv'

/etc/config/dhcp

config dnsmasq
    option domainneeded '1'
    option boguspriv '1'
    option filterwin2k '0'
    option localise_queries '1'
    option rebind_protection '1'
    option rebind_localhost '1'
    option local '/lan/'
    option domain 'lan'
    option expandhosts '1'
    option nonegcache '0'
    option authoritative '1'
    option readethers '1'
    option leasefile '/tmp/dhcp.leases'
    option resolvfile '/tmp/resolv.conf.auto'
    option localservice '1'

config dhcp 'lan'
    option interface 'lan'
    option start '100'
    option limit '150'
    option leasetime '12h'
    option dhcpv6 'server'
    option ra 'server'
    option ra_management '1'

config dhcp 'wan'
    option interface 'wan'
    option ignore '1'

config odhcpd 'odhcpd'
    option maindhcp '0'
    option leasefile '/tmp/hosts/odhcpd'
    option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'lan_tv'
    option start '100'
    option leasetime '12h'
    option limit '150'
    option interface 'lan_tv'

/etc/config/wireless

config wifi-device 'radio0'
    option type 'mac80211'
    option hwmode '11g'
    option path 'platform/ath9k'
    option htmode 'HT40'
    option txpower '23'
    option country 'US'
    option channel '10'

config wifi-iface
    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option ssid 'WR1043ND'
    option encryption 'psk2'
    option key 'xxxxxxxx'

config wifi-iface
    option device 'radio0'
    option mode 'ap'
    option ssid 'WR1043ND_TV'
    option network 'lan_tv'
    option encryption 'psk2'
    option key 'xxxxxxxxx'

However, the configuration does not work properly. When I use only the Internet (and the IPTV cable is unplugged), everything is ok. When I unplug the Internet cable and plug the IPTV one, it also works. But, if I try to plug them both, everything stops working.

My device is TP-LINK TL-WR1043ND V1 with Chaos Calmer 15.05.1, r48532.
So, any ideas what might be wrong?

(Last edited by jaros1024 on 2 Jul 2017, 23:00)

Post #2
Antek
30 Jun 2017, 20:02

From your initial post, it is not clear who is providing the IPTV and Internet-access services to you. How are these services delivered, and what are the exact delivery parameters?

Also, did you see this Wiki page: https://wiki.openwrt.org/doc/howto/udp_multicast?

jaros1024 wrote:

When I connect to WR1043ND network, DHCP gives me an address of lan-tv network (192.168.4.XXX). I can't understand how it is even possible.

I assume that by "me", you refer to some client computer that you plug into a port on the router.

The 'ignore' option in the /etc/config/dhcp is zero, thus you have enabled a DHCP server on the 'lan-tv' network, and given it an IP-address pool of 150 addresses, starting from 192.168.4.100 upwards. If you plug a cable to whatever the switch port 3 is wired to on your router, and your client computer uses DHCP to obtain an IP address, then you get one, just like you have configured it. Or did I misunderstand something?

Post #3
jaros1024
2 Jul 2017, 17:01

I've decided to replace Gargoyle with original OpenWRT. With Luci, I've managed to configure it, but now I face another problem. I've edited the first post and described what is the problem now.

Post #4
mk24
2 Jul 2017, 17:27

The usual approach is to let the TV box communicate directly with the modem by using VLANs in the switch.  That VLAN is not attached to the router CPU at all.  The router CPU uses another VLAN to get internet from the modem.

Post #5
jaros1024
2 Jul 2017, 17:51

Yes of course, but I would like to attach second STB, and my ISP is checking MAC addresses. So I definitely need NAT.
Anyway, if I know how to create second network, I will find out what to do next.

(Last edited by jaros1024 on 2 Jul 2017, 18:55)

Post #6
Antek
2 Jul 2017, 20:21

You're missing dnsmasq settings for 'wan_tv'. Try adding a similar section for 'wan_tv' as you already have for 'wan' and see if that changes things.

You might also want to check the VLAN identifiers that the Internet and IPTV services are using, and adjust the 'vid' identifiers of your 'switch_vlan' sections accordingly. You might want to ensure that at least the VLAN identifiers associated with the IPTV network remain intact through the router and to the STBs. It is not always required, but I've seen a few STBs that expect a specific VLAN identifier in order to handle the traffic correctly.

Post #7
jaros1024
2 Jul 2017, 21:46

I've added 'wan_tv' section in /etc/config/dhcp, but it hasn't changed anything.

The traffic from IPTV is not tagged, so that isn't our problem.

EDIT: I've thought about masquerading and added masq_src options to "wan" and "wan_tv" zones. No effect. I've added also masq_dest options and set their values the same as masq_src. None of the network worked. Then, I've removed masq_dest and added "subnet" options. Now, all the traffic goes to the "wan" interface. It's clear that there is a problem with routing.

(Last edited by jaros1024 on 2 Jul 2017, 23:00)

Post #8
Antek
3 Jul 2017, 06:13
jaros1024 wrote:

The traffic from IPTV is not tagged, so that isn't our problem.

Ok, that rules out one possible cause.

Perhaps your IPTV service provider is using IGMP or other multicast protocols, and you'll need to configure your router accordingly? Here's a link on an OpenWRT how-to regarding this issue: https://wiki.openwrt.org/doc/howto/udp_multicast

Post #9
jaros1024
5 Jul 2017, 12:58

I have created second routing table using iproute2 and separate network works now. But I have another problem with IPTV. The STB is sending TCP packets and there are some problems.

ht tp://i.imgur.com/2fWOlcM.png

(remove space in the url)
Looks like the STB doesn't recognise ACKs and starts retransmissions. What could it be caused by? If I connect internet to the "virtual router" used usually by IPTV, there aren't any problems, so it can't be caused by iproute2 tables.
Is there a possibility that my router is too slow to route the packets? I have also WR1043ND V2 which has a bit faster CPU, so I could exchange them.

(Last edited by jaros1024 on 5 Jul 2017, 13:22)

The discussion might have continued from here.