6

Just installed OpenWRT 12.09 in my router, but became a little confused about interfaces/bridges/vlans. My router

After my first boot, I logged in and set my root password, so I used Luci to activate my Wi-Fi, and took me a little to figure out that I could bridge Wi-Fi with LAN to get access to the internet. But I ended up with two problems:

  1. The DHCP addresses are been provided by my ISP (which is bad since I have to pay an extra fee for each IP)
  2. I can't block SHH access from the Internet/WAN, so my router is a bit vulnerable.

How should I configure—preferably by Luci—to do the following:

  • DHCP provided by this router to my Internal devices, with resolving of DNS
  • My external address (LAN/eth0) provided by the ISP modem (so I can't simple block port 68 in this interface)
  • Properly configure my interfaces so I can allow SSH only on internal (WAN/radio0) interface

Which and why I should choose to use bridge or VLAN? This article, doesn’t explain it, nor provide any clue.


Some notes: - I'm a Gentoo Linux user, so I consider myself a good learner, but haven't yet found any good references for OpenWRT. - My device is TP-Link TL-MR3020 by the way it has only one LAN/eth0 interface and one wirelss/radio0 one.

Update: Here are some of my config files to review; tl;dr

This is my '/etc/config/dhcp' file

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option leasetime '12h'
        option limit '15'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

This is my '/etc/config/network' file

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0'
        option type 'bridge'
        option proto 'static'
        option gateway '192.168.100.1'
        option dns '192.168.100.1'
        option ipaddr '192.168.100.2'
        option netmask '255.255.255.0'

This is my /etc/config/wireless file

config wifi-device 'radio0'
        option type 'mac80211'
        option macaddr '64:66:b3:4d:8b:ce'
        option hwmode '11ng'
        option htmode 'HT20'
        list ht_capab 'SHORT-GI-20'
        list ht_capab 'SHORT-GI-40'
        list ht_capab 'RX-STBC1'
        list ht_capab 'DSSS_CCK-40'
        option txpower '27'
        option country 'US'
        option channel 'auto'

config wifi-iface
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'EDITED'
        option encryption 'psk-mixed'
        option key 'EDITED'

1 Answer 1

2

It seems that you are doing all configurations in command line.

I have tried OpenWRT before and I have installed the WebGUI to help, you may refer to LuCI Essentials for setting up Web User Interface by LuCI. Access through web browser to configure your router such as turning on SSH and set some other configurations will be easier through Web UI.

Edit 1.

So you have 3 questions, I separate them and try to pin point the solution one by one for easy understanding. One things have to declare that, since my Router is turned from OpenWRT to DDWRT and then turned into Tomato. So I used VM(Virtual Machine) for screen capturing and solutions writings. Please forgive if there is 1 or 2 slight points difference. I think it is same most of the case, since I used VM to try OpenWRT before I flash to my router.

Preparations: (in case you haven't done so), the LuCi will be accessed later when your router is configured to be accessible by local area network machines. Extracted from LuCI Essentials

Install LuCi by following commands

opkg update
opkg install luci # without https OR
opkg install luci-ssl # with https support
/etc/init.d/uhttpd start # Start the web server (uHTTPd) manually
/etc/init.d/uhttpd enable # if you wish to start automatically on reboot

1. My external address (lan/eth0) provided by the ISP modem (so I can't simple block port 68 in this interface) I suppose you mean to get the external address, right? Actually, when you setup the router to get the DHCP from your ISP(modem) then your external address will be appeared in LuCi later.

This setting should do the work:

vim /etc/config/network # edit network settings
save

#add the following lines to config
config 'interface' 'wan' # config the interface wan
        option 'proto' 'dhcp' # use protocol DHCP
        option 'ifname' 'eth1' # Physical interface name to assign to, this should be the network port connected to the your ISP modem, may vary eth1 or eth0 or whatever in your case

>>>command
ifup wan # bring WAN interface up

Up to this point, when you open your client computer such as Windows 7, open a browser, type in 192.168.100.1 (your case), then you should see the OpenWRT interface in browser. Password is nothing by default.

Something like this screen:

enter image description here

2. DHCP provided by this router to my internal devices, with resolving of device names (DNS)

When you can connect to your router through client computer browser, you can go to Network -> Hostnames to manually assign hostname to specific devices if those device does not have hostname or does not resolve automatically. (in my case, default have no problem)

3. Properly configure my interfaces so I can allow ssh only on internal (wan/radio0) interface

according to Secure Access document in OpenWRT

"by letting the SSH server dropbear and the web-Server uhttpd not listen on the external/WAN port"

Here is how to do it:

vim /etc/config/dropbear
save

# add the following line to your dropbear
option Interface 'lan' # only listen to lan

>>>command
/etc/init.d/dropbear restart # or reboot if it doesn't work

I think this should illustrate the solution picture to your questions.

Edit 2. Since it is a long time post, I just added the reference link for future audience.

7
  • For sure I've already read LuCI Essentials, actualy I've said before that I prefer that someone helps me to make the config by LuCI (third paragraph) and that I configured a bridge by LuCI (second one) can you help me to understand what I'm supposed to do with my interfaces, to achieve my pointed objectives?
    – Rafareino
    Apr 16, 2014 at 11:58
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Apr 16, 2014 at 12:55
  • Please add the informations from your link to your answer, because if the site is offline, the answer will be useless.
    – Christian
    Apr 16, 2014 at 13:03
  • Sorry for my too short answer. Let me see how to illustrate the answer easier. @Raystafarian and c0dev, thanks for pointing out, acknowledged. Will do it asap after tomorrow for it is too late for me here due to time difference. Apr 16, 2014 at 16:34
  • Wow, your edit seems to help a lot, but I'll need to wait some days ('til the end of brazilian holidays) to have a chance to try. Will post more after that, but It seems very good now. Thanks.
    – Rafareino
    Apr 17, 2014 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .