0

I have a situation in which I have to create an isolated subnet that has Internet access through another subnet. The picture might show it more clearly.

                                  192.168.5.1
                    LAN               LAN
Internet  +----------+       +----------+      +--------+
     <----+ Router 1 +-------+ Router 2 +------+Device 2|
          | No access|       | OpenWRT  |      |        |
          +------+---+       +----------+      +--------+
              LAN|          WAN                192.168.5.5
                 |       192.168.1.20
            +----+---+
            |Device 1|
            |        |
            +--------+
         192.168.1.50-100

I need Device 2 not to have any access to any device on the 192.168.1.0 network, but still have Internet access.

I can't touch Router 1 and this needs to be achieved by settings on Router 2.

The default settings in /etc/config/firewall forward everything from LAN to WAN, which results in Device 1 being able to ping Device 2.

I have tried to limit this with the following rule:

config rule                                 
        option src lan                                     
        option dest wan                         
        option dest_ip 192.168.1.50            
        option target REJECT

But that didn't do the trick. Can you please point me in a correct direction?

Besides setting firewall settings, could this (conceptually) be hacked by static routing by setting all the routes to 192.168.1.0/24 to some fake point?

  • 1
    So “I have a situation in which I have to create an isolated subnet that has Internet access through another subnet.” you want this isolated network to have internet access because that sentence contradicts “I need "Device 2" not to have any access to any device in the 192.168.1.0 network, but still have Internet access.” So which is it? Edit your question – Ramhound Jan 19 '18 at 7:27
  • There is networking se too. Also first picture is not clear to me. – marshal craft Jan 19 '18 at 7:35
  • @Ramhound Device 2 not being able to directly access any of the other devices on 192.168.1.0 doesn't prevent Router 2 to correctly route packets designated for Internet. – TheMeaningfulEngineer Jan 19 '18 at 8:02
  • Will be migrating this to Networking SE, didn't know about it. Update: Opted not to. There isn't an openWRT tag there which is the essential tag to describe the question. @marshalcraft Please say what isn't clear and I'll update. – TheMeaningfulEngineer Jan 19 '18 at 8:04
  • Please label the network interfaces in your drawing. Is it correct that Router_1 only has one "lan" interface handling both subnets at the same time? – user1686 Jan 19 '18 at 8:20
0

In general, you do assignment of network subnets based on number of bits. For example, from 192.158.1.64 to 192.158.1.128. Your rule however should block the .50 address. If you need to block a subnet, add the number of bits like in the example below:

config rule
    option name     example rule
    option src      lan
    option family   ipv4
    option proto    all
    option dest     wan
    option dest_ip  192.168.1.64/26
    option target   REJECT

In your case: I would probably block the complete 192.168.0/24 network.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.