OpenWRT – Network configuration

Firewall, port forwarding, etc.? What and how should this get configured to make our services available?

This article describes describes exemplary how to make the necessary adjustmenzs to the firewall

---

Go to all articles of this series and the description of the test setup:

➡ OpenWRT – Overview

---

• OpenWRT – Network Configuration
  • AVM FRITZ!Box 4040
    • AVM FRITZ!Box 4040 – front
    • AVM FRITZ!Box 4040 – back
  • OpenWRT – Overview
  • Interfaces Configuration
    • WAN Interface
    • LAN Interface
    • DMZ Interface
    • Wireguard Interface
  • Wireless
  • Switches
  • Routing
  • DHCP and DNS
  • Firewall – General Settings
    • Firewall – Zone wan
    • Firewall – Zone lan
    • Firewall – Zone dmz
    • Firewall – Zone wg
  • Firewall – Port Forwards
    • Firewall – Port Forwards nextcloud-80
    • Firewall – Port Forwards nextcloud-443
    • Firewall – Port Forwards nextcloud-20000
  • Firewall – Traffic Rules
    • Firewall – Traffic Rules – Allow-Wireguard-Inbound
    • Firewall – Traffic Rules – dmz-dhcp
    • Firewall – Traffic Rules – dmz-dns-53
    • Firewall – Traffic Rules – dmz-dns-853
    • Firewall – Traffic Rules – dmz-allow-smtp
    • Firewall – Traffic Rules – dmz-http-https
    • Firewall – Traffic Rules – dmz-icmp
    • Firewall – Traffic Rules – ssh-from-lan-into-dmz
    • Firewall – Traffic Rules – block-all-dmz
  • Firewall – NAT Rules

---

AVM FRITZ!Box 4040

AVM FRITZ!Box 4040 – front

AVM FRITZ!Box 4040 – back

➡ AVM FRITZ!Box 4040

OpenWRT – Overview

Interfaces Configuration

OpenWRT universally distinguishes between two types of software network interfaces:

• Physical devices
• Virtual Network Interfaces (see ➡ Switches)

Links:

➡ https://openwrt.org/docs/guide-developer/networking/network.interfaces

The OpenWRT setup uses the interfaces as shown in the screenshot.

---

WAN Interface

The WAN interface is the connection between the OpenWRT device (= AVM FRITZ!Box 4040) and the network router (= AVM FRITZ!Box 7490)

The IP address of the OpenWRT device is configured in the router’s network settings to 192.168.xxx.xxx.

General Settings

The option Masquerading must be checked otherwise the WireGuard interface is not able to use the networks DNS server.

The DNS server is redirected to the local DNS server 127.0.0.1.

The DNS documentation is explained in detail in the manual

➡ OpenWRT – Stubby & DNSMASQ

Advanced Settings

Firewall Settings

DHCP Server – General Settings

DHCP Server – Advanced Settings

IPv6 is not in use in the network.

DHCP Server – IPv6 Settings

---

LAN Interface

The IP address of the OpenWRT device is set to a static address which is configured in Interfaces - LAN - General Settings

IP address: 192.168.200.1

The IP range is 192.168.200.1 - 192.168.200.255

The network interface lan is a is a bridge from one network segment to the other.

The IPv4 gateway is the IP address of the router. (please refer to ➡ AMV Router Configuration)

General Settings

Advanced Settings

Firewall Settings

DHCP Server – General Setup

DHCP Server – Advanced Setup

DHCP Server – IPv6 Settings

DHCP Server – IPv6 RA Settings

DMZ Interface

A DMZ is only recommended when a server shall be accessible from the internet.

In this example an Nextcloud server is set into DMZ and made accessible from the internet.

The DMZ uses the VLAN configuration. The Device must be set to the respective VLAN.

➡ Switches

General Settings

The Device should be the VLAN.

Advanced Settings

Firewall Settings

DHCP Server – General Settings

DHCP Server – Advanced Settings

IPv6 Settings

---

Wireguard Interface

Please refer to the detailed WireGuard descriptions:

• ➡ OpenWRT – WireGuard VPN
• ➡ WireGuard – Peer configuration

---

Wireless

The two wireless interfaces are deactivated.

---

Switches

Standard switch configuration of OpenWRT after a fresh OpenWRT installation.

A new VLAN is created to make all devices plugged in to LAN 3 of AVM FRITZ!Box 4040 accessible from the internet, in this example a Nextcloud server.

➡ DMZ Interface

It is important that the CPU port (= WAN port of the AVM FRITZ!Box 4040) is set to tagged. The port to which the device is connected (eth3 in this example) is set to untagged.

Menu: Netzwerk -> Switch

• CPU needs to be set to tagged
• LAN connection needs to be set to untagged. This is the ethernet port where the device / network is plugged in.

---

!!! The purpose of a tagged port is to pass traffic for multiple VLANs, whereas an untagged port accepts traffic for only a single VLAN. Generally speaking, tagged ports will link switches, and untagged ports will link to end devices.

!!! Der Zweck eines getaggten Ports ist es, Datenverkehr für mehrere VLANs durchzulassen, während ein nicht getaggter Port nur Datenverkehr für ein einziges VLAN akzeptiert. Im Allgemeinen verbinden getaggte Ports Switches und nicht getaggte Ports Endgeräte.

➡ https://openwrt.org/docs/guide-user/network/vlan/switch_configuration<

---

Routing

Static IPv4 Routes

Static IPv6 Routes

Static IPv4 Rules

Static IPv6 Rules

---

DHCP and DNS

The DNS settings are configured for Stubby and DNSMAQS ➡ OpenWRT – Stubby & DNSMASQ

If you don’t have Stubby DNSMAQS installed on your OpenWRT device, keep the default settings.

General Settings

Resolv and Host Files

PXE/TFTP Settings

Advanced Settings

Static Leases

Hostnames

IP Sets

Firewall – General Settings

The OpenWRT setup uses the Firewall Zones as shown in the screenshot.

Firewall – Zone wan

!!! ************************************************ !!!

When input is set to reject it is not possible to access OpenWRT from wan!!!

!!! ************************************************ !!!

General Settings

Advanced Settings

Conntrack Settings

Firewall – Zone lan

General Settings

Advanced Settings

Comtrack Settings

---

Firewall – Zone dmz

General Settings

Advanced Settings

Comtrack Settings

---

Firewall – Zone wg

Interface for the WireGuard VPN.

General Settings

Advanced Settings

Comtrack Settings

---

Firewall – Port Forwards

Port forwards are necessary that the device in the DMZ os accessible via defined ports from WAN. (The device is accessible from the internet. Please make sure that the respective ports are open on the router (= AVM FRITZ!Box 7490). ➡ Portfreigaben

Port Forwards

Firewall – Port Forwards nextcloud-80

This rule is only required for the renewal of Let’s Encrypt certificate.

Port Forwards 80 – General Settings

Port Forwards 80 – Advanced Settings

---

Firewall – Port Forwards nextcloud-443

This rule is only required for the renewal of Let’s Encrypt certificate.

Port Forwards 443 – General Settings

Port Forwards 443 – Advanced Settings

Firewall – Port Forwards nextcloud-20000

This rule makes the share.strobel.cloud device accessible from the internet via port 20.000. When this rule is deactivated the Nextcloud won’t be visible in the internet.

General Settings

Advanced Settings

<img src="pics/firewall/openwrt-network-firewall-portforwards-07.png" width="550">

More Port Forward Rules are configured for DNS. Please refer to ?? Hijack DNS for a detailed description.

---

Firewall – Traffic Rules

The traffic rules are hierarchically organized. The firewall goes from top to bottom. If it finds a match it stops regardless of the successive rules. The following rule will be ignored.

Traffic Rules – Overview

The screenshots show is an example. It shows not all rules described in this section.

This block-all-dmz rule shall be the last active rule in your list. If you define new rules place them above this rule.

At the bottom all OpenWRT standard rules are listed. The rules are DISABLED.

---

Firewall – Traffic Rules – Allow-Wireguard-Inbound

Allow-Wireguard-Inbound – General Settings

Allow-Wireguard-Inbound – Advanced Settings

Allow-Wireguard-Inbound – Time Restrictions

---

Firewall – Traffic Rules – dmz-dhcp

Traffic Rules – dmz-dhcp – General Settings

Traffic Rules – dmz-dhcp – Advanced Settings

Traffic Rules – dmz-dhcp – Time Restrictions

---

Firewall – Traffic Rules – dmz-dns-53

Traffic Rules – dmz-dns-53 – General Settings

Traffic Rules – dmz-dns-53 – Advanced Settings

Traffic Rules – dmz-dns-53 – Time Restrictions

---

Firewall – Traffic Rules – dmz-dns-853

Traffic Rules – dmz-dns-53 – General Settings

Traffic Rules – dmz-dns-853 – Advanced Settings

Traffic Rules – dmz-dns-853 – Time Restrictions

---

Firewall – Traffic Rules – dmz-allow-smtp

Traffic Rules – dmz-allow-smtp – General Settings

Traffic Rules – dmz-allow-smtp – – Advanced Settings

Traffic Rules – dmz-allow-smtp – Time Restriction

---

Firewall – Traffic Rules – dmz-http-https

This rule allows the Nextcloud server which runs on a Raspberry Pi to communicate with the repositories to update / upgrade installed software packages.

Without this rule the Raspberry Pi isn’t able to thr the current lists.

Traffic Rules – dmz-http-https – General Settings

Traffic Rules – dmz-http-https – – Advanced Settings

Traffic Rules – dmz-http-https – Time Restriction

The rule is time restricted! The devices in dmz can only access the wan is the specified time slot.

---

Firewall – Traffic Rules – dmz-icmp

Traffic Rules – dmz-icmp – General Settings

Traffic Rules – dmz-icmp – Advanced Settings

Traffic Rules – dmz-icmp – Time Restrictions

---

Firewall – Traffic Rules – ssh-from-lan-into-dmz

Traffic Rules – ssh-from-lan-into-dmz – General Settings

Traffic Rules – ssh-from-lan-into-dmz – Advanced Settings

Traffic Rules – ssh-from-lan-into-dmz – Time Restrictions

---

Firewall – Traffic Rules – block-all-dmz

This is a important rule. It will block all traffic which is no explicitly allowed to pass from dmz to any other network.

Traffic Rules – block-all-dmz – General Settings

Traffic Rules – block-all-dmz – General Settings

Traffic Rules – block-all-dmz – General Settings

---

Firewall – NAT Rules

---

See all articles of this series …

… on strobelstefan.org
➡ Overview of all OpenWRT Articles/

Source:
– https://openwrt.org/
– https://openwrt.org/_media/docs/guide-graphic-designer/openwrt-logo-usage-guidelines.pdf