search

opentechinstitute / commotion-router

The build system for the OpenWRT-based Commotion firmware.
https://commotionwireless.net
GNU General Public License v3.0
121 stars 43 forks source link

Firewall rule preventing routing between ethernet mesh and wifi mesh #128

Closed dismantl closed 10 years ago

dismantl commented 10 years ago

At the AMC MagicNet, we have nodes meshing both over ethernet and wirelessly. Node A at the "end" of the network is meshed to node B over wifi, and B is then meshed to the rest of the network over ethernet. From further inside the network, as a client on an access point, I am not able to route traffic to/from node A. I was able to fix this by changing the following firewall rules in /etc/config/firewall on node B:

config zone
        option name 'mesh'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'DROP'
        list network 'commotionwireless_46net'
        list network 'mesh'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        list network 'wired'

to:

config zone
        option name 'mesh'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'commotionwireless_46net'
        list network 'mesh'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'wired'

Perhaps, once we add an option to the basic config to mesh over ethernet, turning that on should change the firewall rules of the node accordingly.

dismantl commented 10 years ago

the solution to this requires 2 changes:

1) adding a forwarding rule from wan to mesh zone on nodes that are meshing over both ethernet and wireless 2) adding a forwarding rule from wan to lan on all nodes, so that their clients can be reached from nodes on the other side of the ethernet mesh. For instance: client A => node A => ethernet switch => node B => client B

Number 2 is especially problematic since it requires a change to all nodes on any network that has at least some portion meshed over ethernet.

@jheretic, any thoughts on how we can do this?

jheretic commented 10 years ago

Fixed per https://github.com/opentechinstitute/commotiond/issues/121