표적

2024-5-29 • tag-icon

표적

두 개의 LAN이 필요합니다: lan0및 lan1. lan0암호화되지 않은 트래픽은 lan1항상 활성화된 VPN입니다. 아직 VPN을 구성하지 않았으므로 지금은 두 번째 암호화되지 않은 네트워크일 뿐입니다.

다음과 같이 구성하고 싶습니다.

징후

불행히도 lan1( LAN1_INTERFACE구성 파일에 이름이 지정됨)은 작동하지 않습니다.

WiFi 네트워크에 연결할 수 없습니다:

lan1 인터페이스(LAN1_INTERFACE)에는 IP 주소가 없습니다.

방화벽이 올바르게 구성되지 않은 것 같습니다.

내가 무엇을 놓치고 있나요? 해결해야 할 다른 질문이 있습니까?

구성 파일

/etc/config/network:

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fd22:91e8:0e0f::/48'

config interface 'wan'
  option ifname 'eth1.201'
    option proto 'pppoe'
    option username 'user_name'
    option password 'password'
    option ipv6 '0'
    option _orig_ifname 'eth1'
    option _orig_bridge 'false'
    option mtu '1492'

config interface 'lan'
  option ifname 'eth0'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'
  option _orig_ifname 'eth0 wlan0'
    option _orig_bridge 'true'

config interface 'lan1_interface'
  option ifname 'eth2'
  option force_link '1'
  option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.2.1'
    option netmask '255.255.255.0'
  option _orig_ifname 'eth2 wlan1'
  option _orig_bridge 'true'

config interface 'vpn_interface'
  option ifname 'tun0'
  option proto 'none'

config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '0 1 2 3 5'
    option vid '1'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '4 6'
    option vid '2'

/etc/config/wireless:

config wifi-device 'radio0'
    option type 'mac80211'
    option channel '36'
    option hwmode '11a'
    option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:02.0/0000:02:00.0'
    option htmode 'VHT80'
    option disabled '0'
    option txpower '23'
    option country 'US'

config wifi-iface
    option device 'radio0'
    option mode 'ap'
    option disabled '0'
    option encryption 'psk2+tkip+aes'
    option key 'password'
    option network 'lan'
    option ssid 'Router'

config wifi-device 'radio1'
    option type 'mac80211'
    option channel '11'
    option country 'US'
    option hwmode '11g'
    option path 'platform/soc/soc:pcie-controller/pci0000:00/0000:00:01.0/0000:01:00.0'
    option htmode 'HT20'
    option disabled '0'
    option txpower '19'

config wifi-iface
    option device 'radio1'
    option mode 'ap'
    option disabled '0'
    option encryption 'psk2+tkip+aes'
    option key 'password'
    option network 'lan1_interface'
    option ssid 'Router [VPN]'

/etc/config/dhcp:

config dnsmasq
    option domainneeded '1'
    option boguspriv '1'
    option localise_queries '1'
    option rebind_protection '1'
    option rebind_localhost '1'
    option local '/lan/'
    option expandhosts '1'
    option authoritative '1'
    option readethers '1'
    option leasefile '/tmp/dhcp.leases'
    option resolvfile '/tmp/resolv.conf.auto'
    option localservice '1'
    option nonwildcard '0'
    option domain 'lan'
    option port '5353'
    option dhcpscript '/etc/resolver/dhcp_host_domain_ng.py'

config dhcp 'lan'
    option interface 'lan'
    option start '100'
    option limit '150'
    option leasetime '12h'
    option dhcpv6 'server'
    option ra 'server'
    option ra_management '1'
    list dhcp_option '6,192.168.1.1'

config dhcp 'wan'
    option interface 'wan'
    option ignore '1'

config odhcpd 'odhcpd'
    option maindhcp '0'
    option leasefile '/tmp/hosts/odhcpd'
    option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'lan1_interface'
    option start '100'
    option leasetime '12h'
    option limit '150'
    option interface 'lan1_interface'
    list dhcp_option '6,192.168.2.1'

/etc/config/firewall:

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

#
# includes
#
config include
    option path '/etc/firewall.user'

config include
    option path '/usr/share/firewall/turris'
    option reload '1'

config include
    option path '/etc/firewall.d/with_reload/firewall.include.sh'
    option reload '1'

config include
    option path '/etc/firewall.d/without_reload/firewall.include.sh'
    option reload '0'

config include 'miniupnpd'
    option type 'script'
    option path '/usr/share/miniupnpd/firewall.include'
    option family 'any'
    option reload '1'

#
# zones
#
config zone
    option name 'wan'
    option network 'wan wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config zone
    option name 'vpn_zone'
    option network 'vpn_interface'
    option input 'REJECT'
    option forward 'REJECT'
    option output 'ACCEPT'
    option masq '1'
    option mtu_fix '1'

config zone
    option name 'lan'
    option network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'

config zone
    option name 'lan1_zone'
    option network 'lan1_interface'
    option output 'ACCEPT'
    option input 'ACCEPT'
    option forward 'ACCEPT'

#
# fowarding
#

config forwarding
    option dest 'wan'
    option src 'lan'

config forwarding
    option dest 'vpn_zone'
    option src 'lan1_zone'

config forwarding
    option dest 'wan'
    option src 'lan1_zone'

#
# IPv4 rules
#
config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

#
# IPv6 rules
#
config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

#
# rules
#
config rule
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config rule
    option target 'ACCEPT'
    option proto 'tcp udp'
    option dest_port '5353'
    option name 'Allow Guest DNS Access'
    option src 'lan1_zone'

config rule
    option target 'ACCEPT'
    option proto 'udp'
    option dest_port '67-68'
    option name 'Allow Guest DHCP Access'
    option src 'lan1_zone'

** 편집하다**

라우터:탈리스 옴니아

두 번째 LAN은 실제로 정지 상태여야 dhcp_option합니까 ? 나도 이것이 무엇을 하는지 이해하지 못한다 .'6,192.168.2.1''6,192.168.1.1'6

답변1

dhcp_option에 대한 두 번째 질문과 관련하여 "6"은 dhcp 서버가 클라이언트가 사용할 수 있도록 나열된 IP 주소를 DNS 서버로 푸시하라는 명령입니다. DHCP 서버가 클라이언트에 푸시하는 각 옵션에는 숫자 지시어가 있습니다. 여기서 6은 DNS 서버에 대한 지시어입니다.

답변2

몇 가지 사항을 변경하여 문제가 해결되었습니다.

/etc/config/network:

config interface 'lan'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option _orig_ifname 'eth0 eth2 wlan0 wlan1' # needed?
    option _orig_bridge 'true' # needed?
    option ifname 'eth0'

config interface 'lan1_interface'
    option enabled '1'
    option type 'bridge'
    option proto 'static'
    option netmask '255.255.255.0'
    option bridge_empty '1'
    option _orig_ifname 'wlan1' # needed?
    option _orig_bridge 'true' # needed?
    option ifname 'eth2'
    option ipaddr '192.168.2.1'

표적

징후

구성 파일

답변1

답변2

관련 정보