Is Diversion supposed to work with Vlans?
I have a main AC-RT68U router connected to a secondary AC-R68U acting just as AP. Since you cannot use guest networks properly when in AP mode, I created a vlan instead for the guest networks (using the same idea as here
https://www.snbforums.com/threads/expand-the-guest-network-to-two-merlin-routers.61231/)
Basically all the packets from the devices connected to the guest networks on the AP are tagged vlan101 and using br1 on the main router, and the main router is using dnsmasq to assign dhcp addresses in the 192.168.20.x range (main addresses are 192.168.1.x) with
Code:
admin@RT-AC68U-7BA8:/tmp/home/root# cat /jffs/configs/dnsmasq.conf.add
interface=br1
dhcp-range=br1,192.168.20.3,192.168.20.149,255.255.255.0,86400s
dhcp-option=br1,3,192.168.20.1
dhcp-option=br1,6,192.168.20.1
and a change in iptables as follows
Code:
# Allow BR1 to access WAN
iptables -D FORWARD -i br1 -m state --state NEW -j ACCEPT >/dev/null 2>&1
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
# Prevent BR1 from accessing BR0 and vice versa
iptables -D FORWARD -i br1 -o br0 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
iptables -D FORWARD -i br0 -o br1 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
#
iptables -D INPUT -i br1 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I INPUT -i br1 -m state --state NEW -j DROP
# Allow DNSMASQ to distribute IP addresses for br1.
iptables -D INPUT -i br1 -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
# Allow DNSMASQ to distribute IP addresses for br1.
iptables -D INPUT -i br1 -p udp -m multiport --dport 53,67 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -p udp -m multiport --dport 53,67 -j ACCEPT
I have to admit that the IPTABLES part is a bit of a black magic to me. I understand everything else just fine, but I simply copied the IPTABLES part (and I also saw someone else using EBTABLES instead). I was also surprised to see that the devices on the guest network also use Diversion and Diversion blocks everything in my block list even for guest devices
For a while everything worked just fine, but I started noticing that some webpages are not loading properly when on the guest network. Disabling Diversion then re-enabling it, seems to fix things for a while. But I don't know if it's because of Diversion or simply because disabling and re-enabling Diversion also restarts a few services
Is my setup even supposed to work, given that Diversion also uses dnsmasq? I do see in dnsmasq.log all the requests coming from the clients on 192.168.20.x, and those seem to be redirected properly or blocked as appropriate... Is there anything I can to to help troubleshoot the connectivity problems?
