Adding a pi-hole to guest network on two R7000s (SOLVED)

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page 1, 2, 3  Next
Author Message
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 12:05    Post subject: Adding a pi-hole to guest network on two R7000s (SOLVED) Reply with quote
Hi,
I would like to add a pi hole as DNS server to my guest network, which consists of 4 virtual interfaces on two R7000s:
Primary device wl0.1 (10.0.10.1/255.255.255.0)
Primary device wl1.1 (10.0.20.1/255.255.255.0)
Secundary device wl0.1 (10.0.30.1/255.255.255.0)
Secundary device wl1.1 (10.0.40.1/255.255.255.0)

These four subnets do no need to be isolated from each other, as long as they are isolated from the private network.
How do i get these (isolated) subnets to talk to a single pi-hole device?

I already have a pi-hole running on the private network as DHCP and DNS server. From what I understand it is not possible to also use this device as an DNS server on the guest network at the same time. So I am looking to run a secondary pi-hole for the guest network.

My current working setup is described below.

So far, I've tried to assign wl0.1 and wl1.1 on the secondary router to a bridge (br1) together with the free WAN-port (vlan2). With the idea to connect the pi-hole (10.0.0.3) on this WAN-port.
wl0.1/wl1.1/vlan2 are all set as "Bridge Assignment = Default".
Br1 is unbridged, IP = 10.0.0.1 and I have assigned DHCPD to br1.
Furthermore I have changed the firewall rules (see below) to match br1 instead of wl0.1/wl1.1:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to $(nvram get lan_ipaddr)
iptables -I FORWARD -i br1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j REJECT
iptables -I INPUT -i br1 -m state --state NEW -j REJECT
iptables -I INPUT -i br1 -p udp -m multiport --dports 53,67 -j ACCEPT

However, this resulted in not being able to connect to the guest network on the secondary R7000.
All ports on the primary R7000 are in use, that's why I opted to use a free port on the secondary R7000.

-----------------------

My current working setup is as follows:
• two R7000s connected LAN-LAN
• both devices are running the DD-WRT v3.0-r39960M kongac (06/08/19) firmware.
• the primary R7000 (1st floor) functions as a router, WAN-port is connected to modem.
• the secondary R7000 (3rd floor) functions as access point.
• Private wireless network (wl0 & wl1) on both R7000s
• Guest wireless network (wl0.1 & wl1.1) on both R7000s, traffic is routed through a VPN (Open VPN client in DD-WRT). I had help with getting the guest network operational on the secondary R7000 here: https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1166356#1166356

Primary R7000:
• IP is 192.168.178.1
• DHCP is OFF
• VPN setup in the Open VPN Client: https://www.privateinternetaccess.com/helpdesk/guides/routers/dd-wrt-3/dd-wrt-openvpn-setup-2 step 13 and further.
• Guest networks setup as described here: https://medium.com/@libertylocked/dd-wrt-tricks-dedicated-wireless-virtual-access-point-for-openvpn-the-easy-way-6399fca14916 (no kill switch yet)
Interface wl0.1: IP 10.0.10.1/255.255.255.0
Interface wl1.1: IP 10.0.20.1/255.255.255.0
• With Policy based Routing (within Open VPN Client) wl0.1/wl1.1 traffic is routed through the VPN:
10.0.10.128/25
10.0.20.128/25
• Firewall rules:
# not sure with which purpose I added the next three lines
iptables -I FORWARD 1 –source 192.168.178.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
# to prevent android devices to bypass the pi-hole
iptables -I FORWARD -d 8.8.8.8 -j DROP
iptables -I FORWARD -d 8.8.4.4 -j DROP

Secondary R7000:
• IP of device is 192.168.178.2
• DHCP is OFF
• VPN setup in the Open VPN Client: https://www.privateinternetaccess.com/helpdesk/guides/routers/dd-wrt-3/dd-wrt-openvpn-setup-2 step 13 and further.
• Guest networks setup as described here: https://medium.com/@libertylocked/dd-wrt-tricks-dedicated-wireless-virtual-access-point-for-openvpn-the-easy-way-6399fca14916 (no kill switch yet)
Interface wl0.1: IP 10.0.30.1/255.255.255.0
Interface wl1.1: IP 10.0.40.1/255.255.255.0
• With Policy based Routing (within Open VPN Client) wl0.1/wl1.1 traffic is routed through the VPN:
10.0.30.128/25
10.0.40.128/25
• Firewall rules:
# to secure the private network and give the guest network internet access
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to $(nvram get lan_ipaddr)
iptables -I FORWARD -i wl0.1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j REJECT
iptables -I FORWARD -i wl1.1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j REJECT
# not sure with which purpose I added the next four lines
iptables -I INPUT -i wl0.1 -m state --state NEW -j REJECT
iptables -I INPUT -i wl1.1 -m state --state NEW -j REJECT
iptables -I INPUT -i wl0.1 -p udp -m multiport --dports 53,67 -j ACCEPT
iptables -I INPUT -i wl1.1 -p udp -m multiport --dports 53,67 -j ACCEPT

Pi-hole (192.168.178.3) acts as DHCP and DNS server on the private network


Last edited by Mozzy77 on Sat Aug 10, 2019 10:02; edited 1 time in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3765
Location: Netherlands

PostPosted: Tue Aug 06, 2019 12:57    Post subject: Reply with quote
Wow a complicated setup Smile

I see no obstacles at first glance why you can not use the pi as DNS server for the unbridged VAP's

You are blocking local access for the VAP's at the moment but just punch a hole for the Pi.

The most common mistake is over configuration, i.e adding to much rules.

All the rules on your primary router seem redundant to me and I would start ditching them.
the tun rules are not necessary if you are using default VPN setup (which is recommended)

The android DNS rules should be done with forced DNS redirection, i.e forcing all DNS queries through your Pi with the following rule:
Code:
iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53


On the unbridged VAP's you can not reach your PI as local access is rejected (that is the net isolation) with your firewall rules.

You can open up this net isolation by adding (as last rule) the following rule
Code:
iptables -I FORWARD –d 192.168.178.3 -p tcp --dport 53 -j ACCEPT
on both routers.

The last step is indicating your unbridged VAP's to use the Pi as DNS server.
On the Wl0.1 virtual interface (and all other unbridged interfaces) enable "Forced DNS redirection" and enter the IP address of the Pi 192.168.178.3

Have not test anything so the chance of actually working as I descibed is slim, but it maybe gives you ideas how to proceed Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 13:45    Post subject: Reply with quote
Thanks for helping me clean up my firewall rules on the primary R7000.
In now reduced it to:
iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -I FORWARD –d 192.168.178.3 -p tcp --dport 53 -j ACCEPT

and everything seems to be working just fine.

No luck with using the pi-hole (192.168.178.3) on the unbridged VAPs however.

I am a noob with iptables commands, I just reuse code from others.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3765
Location: Netherlands

PostPosted: Tue Aug 06, 2019 14:32    Post subject: Reply with quote
Mozzy77 wrote:
Thanks for helping me clean up my firewall rules on the primary R7000.
In now reduced it to:
iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -I FORWARD –d 192.168.178.3 -p tcp --dport 53 -j ACCEPT

and everything seems to be working just fine.

No luck with using the pi-hole (192.168.178.3) on the unbridged VAPs however.

I am a noob with iptables commands, I just reuse code from others.


Well it is not strange that it is not working Sad
I only allowed tcp traffic, you should also allow udp traffic so also add:
Code:
iptables -I FORWARD –d 192.168.178.3 -p udp --dport 53 -j ACCEPT

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 15:27    Post subject: Reply with quote
Tried it on the primary R7000. My android phone reports "no internet connection" on the guest wifi, websites are unreachable.

Example of setting on the guest VAP:
Wireless SSID Broadcast = Enable
AP Isolation = Enable
Network Configuration = Unbridged
Multicast forwarding = Disable
Masquerade / NAT = Enable
Net Isolation = Enable
Forced DNS Redirection = Enable
Optional DNS Target = 192.168.178.3
IP Address = 10.0.10.1
Subnet Mask = 255.255.255.0
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3765
Location: Netherlands

PostPosted: Tue Aug 06, 2019 15:53    Post subject: Reply with quote
Add the following to administration commands (as last commands) and save Firewall, reboot afterwards:

iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p udp --dport 53 -j DNAT --to 192.168.178.3:53

iptables -I FORWARD –d 192.168.178.3 -p tcp --dport 53 -j ACCEPT
iptables -I FORWARD –d 192.168.178.3 -p udp --dport 53 -j ACCEPT

Show output of:
iptables -vnL -t nat
iptables -vnL FORWARD

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 16:39    Post subject: Reply with quote
Here the requested output. I've hidden my IP address with xx.xx.xx.xx:

root@DD-WRT:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 844 packets, 146K bytes)
pkts bytes target prot opt in out source destination
310 20388 DNAT udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:192.168.178.1
0 0 DNAT tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:192.168.178.1
0 0 DNAT udp -- wl0.1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:192.168.178.3
0 0 DNAT tcp -- wl0.1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:192.168.178.3
0 0 DNAT udp -- wl1.1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:208.67.222.123
0 0 DNAT tcp -- wl1.1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:208.67.222.123
0 0 DNAT icmp -- * * 0.0.0.0/0 xx.xx.xx.xx to:192.168.178.1
7 320 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:80 to:192.168.178.221:80

2 120 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:443 to:192.168.178.221:4
43
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:873 to:192.168.178.221:8
73
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:22 to:192.168.178.221:22

0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:6281 to:192.168.178.221:
6281
0 0 DNAT udp -- * * 0.0.0.0/0 xx.xx.xx.xx udp dpt:6281 to:192.168.178.221:
6281
2 120 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:5001 to:192.168.178.221:
5001
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:6690 to:192.168.178.221:
6690
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:25565 to:192.168.178.198
:25565
0 0 DNAT udp -- * * 0.0.0.0/0 xx.xx.xx.xx udp dpt:25565 to:192.168.178.198
:25565
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:1194 to:192.168.178.221:
1194
0 0 DNAT udp -- * * 0.0.0.0/0 xx.xx.xx.xx udp dpt:1194 to:192.168.178.221:
1194
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:21 to:192.168.178.221:21

149 25111 TRIGGER 0 -- * * 0.0.0.0/0 xx.xx.xx.xx TRIGGER type:dnat match:0 relate
:0

Chain INPUT (policy ACCEPT 485 packets, 40757 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 398 packets, 27627 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 407 packets, 28015 bytes)
pkts bytes target prot opt in out source destination
94 18261 MASQUERADE 0 -- * tun1 0.0.0.0/0 0.0.0.0/0
232 21878 SNAT 0 -- * vlan2 192.168.178.0/24 0.0.0.0/0 to:xx.xx.xx.xx
0 0 SNAT 0 -- * vlan2 10.0.10.0/24 0.0.0.0/0 to:xx.xx.xx.xx
1 96 SNAT 0 -- * vlan2 10.0.20.0/24 0.0.0.0/0 to:xx.xx.xx.xx
1 96 SNAT 0 -- * vlan2 10.0.60.0/24 0.0.0.0/0 to:xx.xx.xx.xx
0 0 MASQUERADE 0 -- * * 0.0.0.0/0 0.0.0.0/0 mark match 0x80000000/0x8000000
0
root@DD-WRT:~# iptables -vnL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7161 4888K ACCEPT 0 -- * tun1 0.0.0.0/0 0.0.0.0/0
6605 2689K ACCEPT 0 -- tun1 * 0.0.0.0/0 0.0.0.0/0
115K 110M ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP 0 -- wl1.2 * 0.0.0.0/0 192.168.178.0/24 state NEW
0 0 DROP 0 -- wl1.1 * 0.0.0.0/0 192.168.178.0/24 state NEW
0 0 DROP 0 -- wl0.1 * 0.0.0.0/0 192.168.178.0/24 state NEW
0 0 ACCEPT 47 -- * vlan2 192.168.178.0/24 0.0.0.0/0
0 0 ACCEPT tcp -- * vlan2 192.168.178.0/24 0.0.0.0/0 tcp dpt:1723
0 0 lan2wan 0 -- wl0.1 * 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan 0 -- wl1.1 * 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan 0 -- wl1.2 * 0.0.0.0/0 0.0.0.0/0
787 162K lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
763 160K ACCEPT 0 -- br0 vlan2 0.0.0.0/0 0.0.0.0/0
12 624 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:80
6 360 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:873
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:6281
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.178.221 udp dpt:6281
6 360 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:5001
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:6690
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.198 tcp dpt:25565
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.178.198 udp dpt:25565
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:1194
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.178.221 udp dpt:1194
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:21
0 0 TRIGGER 0 -- vlan2 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
0 0 TRIGGER 0 -- vlan2 eth0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 eth1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 eth2 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- eth2 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 vlan1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- vlan1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- br0 wl0.1 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 wl0.1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- wl0.1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- wl0.1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- br0 wl1.1 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 wl1.1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- wl1.1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- wl1.1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- br0 wl1.2 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 wl1.2 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- wl1.2 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- wl1.2 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 18:35    Post subject: Reply with quote
How about DNSmasq settings? It was turned on, because I followed this guide to setup PIA VPN: https://www.privateinternetaccess.com/helpdesk/guides/routers/dd-wrt-3/dd-wrt-openvpn-setup-2

Turning DNAmasq OFF in the Service tab does not seem to change anything.

wl0.1 on the primary R7000 (Forced DNS redirection to 192.168.178.3, pi-hole) has no internet connection,
while wl1.1 (Forced DNS redirection to 208.67.222.123, OpenDNS) does have internet via the VPN.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3765
Location: Netherlands

PostPosted: Tue Aug 06, 2019 20:46    Post subject: Reply with quote
I do not see any of the rules I send to you working in the iptables.
Either you have not installed them or they are not working.

What I do see is:
Code:
310 20388 DNAT udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:192.168.178.1
0 0 DNAT tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:192.168.178.1


Have you enabled Forced DNS redirection on setup page?.
This is not what you want because this forces your DNS queries to your router and not to your Pi which is 192.168.178.3 (if I am not mistaken).
So if you enabled that disable it

You are forcing wl0.1 to the PI but have not openend up the firewall with the rules I send you so it can not work.

Enable the rules I send and then show again the output of
iptables -vnL FORWARD
iptables -vnL -t nat

Just to make it easy, disable Net isolation and see if it works, then you know that the Pi itself is working and that it is indeed the net isolation which is blocking the DNS requests (and for which the FORWARD rules I send you must punch a hole to allow access to the Pi)

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 21:10    Post subject: Reply with quote
I did enter the firewall rules you suggested, saved changes and rebooted the R7000.
However, Forced DNS redirection was indeed enabled on setup page. Turned this OFF, also DNSmasq is OFF on service tab. Ones more rebooted the R7000.

Still no internet connection on wl0.1, but still working on wl1.1

To be clear, the only rules in the firewall are now:
iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -t nat -I PREROUTING -i br0 –s ! 192.168.178.3 -p udp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -I FORWARD –d 192.168.178.3 -p tcp --dport 53 -j ACCEPT
iptables -I FORWARD –d 192.168.178.3 -p udp --dport 53 -j ACCEPT


The requested output is now:

root@DD-WRT:~# iptables -vnL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
10020 6708K ACCEPT 0 -- * tun1 0.0.0.0/0 0.0.0.0/0
9125 3980K ACCEPT 0 -- tun1 * 0.0.0.0/0 0.0.0.0/0
37032 41M ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP 0 -- wl1.2 * 0.0.0.0/0 192.168.178.0/24 state NEW
0 0 DROP 0 -- wl1.1 * 0.0.0.0/0 192.168.178.0/24 state NEW
0 0 DROP 0 -- wl0.1 * 0.0.0.0/0 192.168.178.0/24 state NEW
0 0 ACCEPT 47 -- * vlan2 192.168.178.0/24 0.0.0.0/0
0 0 ACCEPT tcp -- * vlan2 192.168.178.0/24 0.0.0.0/0 tcp dpt:1723
0 0 lan2wan 0 -- wl0.1 * 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan 0 -- wl1.1 * 0.0.0.0/0 0.0.0.0/0
0 0 lan2wan 0 -- wl1.2 * 0.0.0.0/0 0.0.0.0/0
595 118K lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
2 120 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
586 118K ACCEPT 0 -- br0 vlan2 0.0.0.0/0 0.0.0.0/0
7 308 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:873
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:6281
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.178.221 udp dpt:6281
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:5001
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:6690
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.198 tcp dpt:25565
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.178.198 udp dpt:25565
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:1194
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.178.221 udp dpt:1194
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.178.221 tcp dpt:21
0 0 TRIGGER 0 -- vlan2 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
0 0 TRIGGER 0 -- vlan2 eth0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 eth1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 eth2 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- eth2 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 vlan1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- vlan1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- br0 wl0.1 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 wl0.1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- wl0.1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- wl0.1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- br0 wl1.1 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 wl1.1 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- wl1.1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- wl1.1 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- br0 wl1.2 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 TRIGGER 0 -- vlan2 wl1.2 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0

0 0 trigger_out 0 -- wl1.2 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- wl1.2 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
root@DD-WRT:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 1346 packets, 233K bytes)
pkts bytes target prot opt in out source destination
70 4747 DNAT udp -- wl0.1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:192.168.178.3
0 0 DNAT tcp -- wl0.1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:192.168.178.3
0 0 DNAT udp -- wl1.1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 to:208.67.222.123
0 0 DNAT tcp -- wl1.1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 to:208.67.222.123
0 0 DNAT icmp -- * * 0.0.0.0/0 xx.xx.xx.xx to:192.168.178.1
7 280 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:80 to:192.168.178.221:80

0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:443 to:192.168.178.221:4
43
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:873 to:192.168.178.221:8
73
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:22 to:192.168.178.221:22

0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:6281 to:192.168.178.221:
6281
0 0 DNAT udp -- * * 0.0.0.0/0 xx.xx.xx.xx udp dpt:6281 to:192.168.178.221:
6281
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:5001 to:192.168.178.221:
5001
2 120 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:6690 to:192.168.178.221:
6690
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:25565 to:192.168.178.198
:25565
0 0 DNAT udp -- * * 0.0.0.0/0 xx.xx.xx.xx udp dpt:25565 to:192.168.178.198
:25565
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:1194 to:192.168.178.221:
1194
0 0 DNAT udp -- * * 0.0.0.0/0 xx.xx.xx.xx udp dpt:1194 to:192.168.178.221:
1194
0 0 DNAT tcp -- * * 0.0.0.0/0 xx.xx.xx.xx tcp dpt:21 to:192.168.178.221:21

184 38278 TRIGGER 0 -- * * 0.0.0.0/0 xx.xx.xx.xx TRIGGER type:dnat match:0 relate
:0

Chain INPUT (policy ACCEPT 37 packets, 4228 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 18 packets, 2839 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 25 packets, 3147 bytes)
pkts bytes target prot opt in out source destination
223 41217 MASQUERADE 0 -- * tun1 0.0.0.0/0 0.0.0.0/0
249 29827 SNAT 0 -- * vlan2 192.168.178.0/24 0.0.0.0/0 to:xx.xx.xx.xx
0 0 SNAT 0 -- * vlan2 10.0.10.0/24 0.0.0.0/0 to:xx.xx.xx.xx
0 0 SNAT 0 -- * vlan2 10.0.20.0/24 0.0.0.0/0 to:xx.xx.xx.xx
0 0 SNAT 0 -- * vlan2 10.0.60.0/24 0.0.0.0/0 to:xx.xx.xx.xx
2 120 MASQUERADE 0 -- * * 0.0.0.0/0 0.0.0.0/0 mark match 0x80000000/0x8000000
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 21:23    Post subject: Reply with quote
On a second note, connecting to wl0.1 now takes way longer than it should. And is sometimes even unsuccesful, getting an IP address seems to be the problem.

The pi hole also doubles as DHCP server on the private network, could that be the problem here?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3765
Location: Netherlands

PostPosted: Tue Aug 06, 2019 21:28    Post subject: Reply with quote
Keep DNSMAsq enabled but DHCP should be off.

Not any of the firewall rules are applied, very strange.
Will have a fresh look tomorrow

In the mean time disable net isolation, you should have internet access if the Pi is working

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Tue Aug 06, 2019 21:52    Post subject: Reply with quote
Disabling net isolation on wl0.1 did not give me internet connection on this VAP, but it did give me access to the R7000 dd-wrt GUI on 192.168.178.1. So at least disabling net isolation worked.

Also, my android phone now also is having connection problems with wl1.1. My laptop does not really seem to care much.

Thanks for today!
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3765
Location: Netherlands

PostPosted: Wed Aug 07, 2019 9:42    Post subject: Reply with quote
Somehwere the correct hyphens are lost in translation

Try these rules from command line with copy /paste and if they are throwing an error retype them

Code:
iptables -t nat -I PREROUTING -i br0 -s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -t nat -I PREROUTING -i br0 -s ! 192.168.178.3 -p udp --dport 53 -j DNAT --to 192.168.178.3:53

iptables -I FORWARD -d 192.168.178.3 -p tcp --dport 53 -j ACCEPT
iptables -I FORWARD -d 192.168.178.3 -p udp --dport 53 -j ACCEPT


Edit to be sure, do not enable "Forced DNS redirection" on Setup tab and do not enable "No DNS rebind" on Services tab (this will stop rebinding DNS servers to a local address if enabled)

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Mozzy77
DD-WRT Novice


Joined: 30 May 2019
Posts: 21

PostPosted: Wed Aug 07, 2019 12:17    Post subject: Reply with quote
I retyped all hyphens, just to be sure.
On (Basic)Setup tab "Use DNSMasq for DNS" is enabled and "Forced DNS Redirection" is disabled.
Net isolation is enbaled.
On Services tab "Dnsmasq" is enabled
The fire wall on the primary R7000 now looks like (copy-paste):
iptables -t nat -I PREROUTING -i br0 -s ! 192.168.178.3 -p tcp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -t nat -I PREROUTING -i br0 -s ! 192.168.178.3 -p udp --dport 53 -j DNAT --to 192.168.178.3:53
iptables -I FORWARD -d 192.168.178.3 -p tcp --dport 53 -j ACCEPT
iptables -I FORWARD -d 192.168.178.3 -p udp --dport 53 -j ACCEPT


It now works, but only when I do NOT route the wl0.1 IP-range through the VPN.
Enabling "Local DNS" under Services tab "Dnsmasq" does not change anything. And also still allows internet connection when not using VPN.

Same for the secondary R7000, guest network is working with pi-hole as long as traffic is not routed through VPN.

So routing the guest network through the VPN is the problem. Any idea's on how to solve this?
Routing traffic from the private network and using pi-hole at the same time is not a problem.
Goto page 1, 2, 3  Next Display posts from previous:    Page 1 of 3
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum