4.8.2 upgrade & LAN Access within Different Subnets

[agreeing_slashing]

I have two subnets at home, 192.168.1.x and 192.168.9.x. The 9.x is the “guest” network, but within the security settings I have AP Isolation disabled.

I just upgraded from 4.7.7 to 4.8.2. After doing this, my network is acting like the subnets are isolated and I can no longer ping across the subnets. Unfortunately, I did not get a backup of my settings before upgrading the firmware and I worry if I downgraded, I’d break even more aspects of my network.

I am an amateur when it comes to networking and my head hurts after using ChatGPT for the last few hours trying to help resolve this.

Any advice or assistance is much appreciated.

[9b9e69c2-4b75-4420]

So does 192.168.1.0/24 (LAN) requires one or two way to 192.168.9.0/24? As it's the guest subnet I assume one way so guest client devices don't have access to your LAN proper.

If you jump into LuCI (GL GUI -> System -> Advanced Settings) & go to its Network -> Firewall you should see a 'zone' where you can define the flow. 'Allow forward from source zones: LAN' should do the trick for one-way traffic from LAN. You'll probably need Masquerading & MSS Clamping too due to the different subnets. DROP, ACCEPT, DROP is more secure than REJECT, ACCEPT, REJECT but the latter is faster to notify downstream clients they can't connect.

---

Yeah, you've got a mess to contend with; the v4.8.x series introduced new VPN routing features & apart of that underlying ability is related to the DHCP daemon dnsmasq. Any previous configurations aren't backwards compatible. You're going to have to rebuild your setup from scratch.

Here's a script to help you quickly save 'snapshot' backups while you get it all sorted:

Issue resolving hosts by name

Weird. I hate to say it but I'd nuke it all & start over. It ain't much but here's something handy to help save states as you build up a clean config: #!/bin/sh HOST="$(uci show system.@system[0].hostname | cut -d "'" -f '2')" DOMAIN="$(uci show dhcp.@dnsmasq[0].domain | cut -d "'" -f '2')" timestamp="$(env TZ=UTC date +'%Y%m%dT%H%M%Z')" sysupgrade --create-backup /tmp/backup-"${HOST}"."${DOMAIN}"-"${timestamp}".tar.gz exit 0 Throw that into a script file & run it as a check point any time …

New firmware version 4.8 being released for beta testing

It appears On the MT3000/MT6000 closed-source (op21) firmware. Since multiple dnsmasq instances on v4.8.x firmware, but Luci (op21) is incomplete, resulting in multiple identical untitled (interface) options. Don't worry, and don't change them. This is normal behavior.

[agreeing_slashing]

Thanks. I will give that a shot. The backup script is quite useful too.
I’m pretty sure my previous setup didn’t really make sense. So I might have to just re-think what it is I exactly want and why I even have two different subnets.

[9b9e69c2-4b75-4420]

Your OP makes sense. If you want to have LAN -> Guest traffic you'd need to set the firewall zones/rules accordingly. Usually Guest is completely isolated to just have WAN/Internet access.

One way/incoming traffic from LAN to a VLAN is very common to manage a IOT VLAN, for example.

---

A correction: you'll need openssh-sftp-server (not openssh-server) to pull down the tarballs via SFTP.