multi-WAN setup using interfaces and firewall zone

I am trying to setup multi-WAN.
It seems the manufacturer had made use of PBR and VLAN so I cannot touch them.
I don’t need load-balance or fail-over so I am not using mwan3.

I want to route some LAN IP through ISP-A and otheres through ISP-B.

My router comes with 5 ports:
eth0: ISP-A
eth1: ISP-B
eth2: switch
eth3: PC
eth4: PC

I am trying to route eth3 and eth4 through ISP-A, and eth2 through ISP-B.

In the configuration below, ISP-A is “wan” and “wan6”, ISP-B is “HKT4” and “HKT6”.

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'dd16:8314:83b0::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	option multicast_to_unicast '0'
	list ports 'eth3'
	list ports 'eth4'

config device
	option name 'eth1'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth2'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth3'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth4'
	option macaddr '94:83:c4:18:9d:18'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option isolate '0'
	option ipaddr '192.168.50.1'
	option ip6assign '64'
	option ip6hint '0000'
	option ip6ifaceid '::1'
	list ip6class 'local'

config device
	option name 'eth0'
	option macaddr '94:83:c4:18:9d:17'

config interface 'wan'
	option device 'eth0'
	option proto 'dhcp'
	option ipv6 '1'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option disabled '0'
	option device '@wan'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'
	list dns '2606:4700:4700::64'
	list dns '2606:4700:4700::6400'

config switch
	option name 'switch0'
	option reset '0'
	option enable_vlan '0'

config interface 'tethering6'
	option proto 'dhcpv6'
	option disabled '0'
	option device '@tethering'

config interface 'wwan6'
	option proto 'dhcpv6'
	option disabled '0'
	option device '@wwan'

config interface 'guest'
	option force_link '1'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.9.1'
	option netmask '255.255.255.0'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option ip6prefix 'dd16:8314:83b0::/48'
	option ip6assign '64'
	option ip6hint '0001'
	option ip6ifaceid '::1'
	option ip6class 'guest'

config interface 'wwan'
	option proto 'dhcp'

config rule 'policy_bypass_vpn'
	option mark '0x60000/0x60000'
	option lookup '53'
	option priority '53'

config rule 'policy_via_vpn'
	option mark '0x80000/0x80000'
	option lookup '52'
	option priority '52'

config rule 'policy_dns'
	option mark '0x100000/0x100000'
	option lookup '51'
	option priority '51'

config interface 'wgserver'
	option proto 'wgserver'
	option config 'main_server'
	option disabled '0'

config device
	option name 'br-hkt'
	option type 'bridge'
	list ports 'eth2'

config interface 'HKT4'
	option proto 'dhcp'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'
	option device 'eth1'

config interface 'HKT'
	option type 'bridge'
	option device 'br-hkt'
	option proto 'static'
	option ipaddr '192.168.55.1'
	option netmask '255.255.255.0'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option ip6assign '64'
	option ip6hint '0002'
	option ip6ifaceid '::1'
	list ip6class 'HKT6'

config interface 'HKT6'
	option device '@HKT4'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option rebind_protection '0'
	option noresolv '1'
	list server '127.0.0.1'
	list server '::ffff:7f00:1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ra_management '1'
	list ra_flags 'none'
	option ra 'relay'
	option dhcpv6 'relay'
	option ndp 'relay'

config dhcp 'HKT'
	option interface 'HKT'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	option ra_default '1'
	list dns 'dd16:8314:83b0:0002:0000:0000:0000:0001'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	list ra_flags 'none'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	option ra_default '1'
	list dns 'dd16:8314:83b0:0001:0000:0000:0000:0001'
	list ra_flags 'other-config'
	list ra_flags 'managed-config'

config host
	option mac '00:E0:4C:02:27:36'
	option name 'PC-through-Switch'
	option dns '1'
	option ip '192.168.55.2'

config host
	option mac '44:E4:EE:63:39:9E'
	option name 'PC'
	option dns '1'
	option ip '192.168.50.4'

config dhcp 'HKT4'
	option ignore '1'
	option interface 'HKT4'
	list ra_flags 'none'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option input 'ACCEPT'
	option name 'hktlan'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq6 '1'
	list network 'HKT'

config zone
	option name 'wan'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	option input 'DROP'
	option masq '1'
	option masq6 '1'
	list network 'wwan'
	list network 'wan'
	list network 'wan6'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled 'false'

config include
	option path '/etc/firewall.user'

config include 'nat6'
	option path '/etc/firewall.nat6'
	option reload '1'

config rule 'process_mark'
	option name 'process_mark'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 65533'
	option target 'MARK'
	option set_xmark '0x80000/0x80000'

config include 'gls2s'
	option type 'script'
	option path '/var/etc/gls2s.include'
	option reload '1'

config include 'glblock'
	option type 'script'
	option path '/usr/bin/gl_block.sh'
	option reload '1'

config zone
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'DROP'
	option masq '1'
	option mtu_fix '1'
	option name 'hktwan'
	list network 'HKT4'
	list network 'HKT6'

config zone
	option name 'guest'
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Allow-DHCP'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '67-68'

config rule
	option name 'Allow-DNS'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'tcp udp'
	option dest_port '53'

config include 'vpn_server_policy'
	option type 'script'
	option path '/etc/firewall.vpn_server_policy.sh'
	option reload '1'
	option enabled '1'

config rule 'glipv6_guest_dhcp'
	option name 'Allow-DHCP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '546:547'
	option family 'ipv6'

config rule 'glipv6_guest_icmp'
	option name 'Allow-ICMP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'icmp'
	option dest_port '58'
	option family 'ipv6'

config rule 'sambasharewan'
	option src 'wan'
	option dest_port '137 138 139 445'
	option dest_proto 'tcpudp'
	option target 'DROP'

config rule 'sambasharelan'
	option src 'lan'
	option dest_port '137 138 139 445'
	option dest_proto 'tcpudp'
	option target 'ACCEPT'

config rule 'glnas_ser'
	option src 'wan'
	option dest_port '6000-6002'
	option dest_proto 'tcp'
	option target 'DROP'

config rule 'webdav_wan'
	option src 'wan'
	option dest_port '6008'
	option dest_proto 'tcp'
	option target 'DROP'

config rule 'wgserver_allow'
	option name 'wgserver_allow'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'udp tcp'
	option family 'ipv4'
	option dest_port '51820'
	option enabled '1'

config zone 'wgserver'
	option name 'wgserver'
	option output 'ACCEPT'
	option mtu_fix '1'
	option input 'DROP'
	option masq '1'
	option masq6 '1'
	option enabled '1'
	option forward 'REJECT'
	list network 'wgserver'

config forwarding 'wgserver2wan'
	option src 'wgserver'
	option dest 'wan'
	option enabled '1'

config forwarding 'lan2wgserver'
	option src 'lan'
	option dest 'wgserver'
	option enabled '1'

config redirect 'adguard_home'
	option src 'lan'
	option src_dport '53'
	option dest 'lan'
	option dest_port '3053'
	option name 'AdGuard'
	option proto 'tcpudp'

config forwarding
	option dest 'wgserver'
	option src 'hktlan'

config forwarding
	option dest 'hktwan'
	option src 'wgserver'

config forwarding
	option dest 'hktlan'
	option src 'lan'

config forwarding
	option dest 'lan'
	option src 'hktlan'

config redirect
	option src 'hktlan'
	option name 'AdGuard'
	option target 'DNAT'
	option src_dport '53'
	option dest_port '3053'
	option dest 'lan'

config forwarding
	option dest 'hktwan'
	option src 'hktlan'

config forwarding
	option dest 'hktwan'
	option src 'lan'

It appears only one network (ISP) has Internet access only.
May I know what should be fixed?

Thank you very much.

Just to confirm, you are using AX1800 Flint, right?

Two default route of ISP-A and ISP-B in table main will not work.
You need to add IP rule and static route in luci, example configs:

IPV4 rules:
image

Static IPv4 Routes:

Yes. It is Flint AX1800.

What should the “Gateway” be in the second picture?
Should it be the router IP, or HKT4 gateway IP?

Where to specify the source IP?
For example, I want:
Router IP: 192.158.8.1
192.168.8.11 through “HKT”
Any other IP through “WAN”

Thanks.

By the way I have consulted the author of PBR.
He said the OS and the package is too old.

Gateway is HKT4 gateway IP set by dhcp.
Source IP is set in ip rules like the first picture.

I get that picture by flint firmware 4.2 snapshot. Its PBR is updated to 21.02 verison.

The ISP does not provide a static IP. It is allowcated by ISP DHCP.
Is it possible to skip the “gateway” IP?
(To get the default IP from the interface)

PBR should be a package to be installed manually.
Anyway if this routing could be done I don’t need PBR.
PBR is just a package to configure these routing easier.

Thanks.

Yes, gateway is optional on the static route setup page.

My PC IP is 192.168.50.10.

Checked the public IP is “wan” but not “hkt”.

Thanks.

Sorry that I don’t have a device to setup two wan for test. The previous picture is just a clue, you need to change things accordingly. Command:

ip rule
ip route show table 100

can be used to check if luci setup takes effect.
I’ll try this when my device is available at hand.

# ip rule 
0:	from all lookup local
51:	from all fwmark 0x100000/0x100000 lookup 51
52:	from all fwmark 0x80000/0x80000 lookup 52
53:	from all fwmark 0x60000/0x60000 lookup 53
100:	from 192.168.50.10 lookup 100
1001:	from all iif eth0 lookup 1
2001:	from all fwmark 0x100/0x3f00 lookup 1
2061:	from all fwmark 0x3d00/0x3f00 blackhole
2062:	from all fwmark 0x3e00/0x3f00 unreachable
32766:	from all lookup main
32767:	from all lookup default
# ip route show table 100

(Nothing is shown)

According to this page:

I have run these:
xxx.xxx.xxx.xxx is HKT gateway IP. Skipping gateway IP does not work.

ip route add default via xxx.xxx.xxx.xxx dev eth1 table 100
ip rule add fwmark 100 table 100
iptables -A PREROUTING -t mangle -s 192.168.50.10 -j MARK --set-mark 100

May I know how to set the last command on OpenWRT?

Thanks.

不好意思之前漏了这个问题。

刚刚成功配置了你需要的路由规则,可以对比参考修改后的配置文件:
conf.zip (2.2 KB)
其中使能了lan-wan的转发,根据需要确定是否删除。

所有的配置都可以在luci完成:
第一步是添加ip rule:网络 - 路由 - IPv4规则:

第二步是设置HKT4网络的路由表覆盖:网络 - 接口 - HKT4 - 高级设置
image

1 Like

Thank you very much for your demo files.

I have followed to configure my GL-AX1800.
After configuration, pluging my computer into eth2 does not provide any LAN or WAN traffic.
eth3 and eth4 provide LAN and WAN (not HKT) traffic.

May you help to have a look what I have missed please?

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'dd16:8314:83b0::/48'

config device
	option name 'br-lan'
	option type 'bridge'
        option multicast_to_unicast '0'
	list ports 'eth3'
	list ports 'eth4'

config device
	option name 'eth1'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth2'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth3'
	option macaddr '94:83:c4:18:9d:18'

config device
	option name 'eth4'
	option macaddr '94:83:c4:18:9d:18'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option isolate '0'
	option ipaddr '192.168.50.1'
	option ip6assign '64'
	option ip6hint '0000'
	option ip6ifaceid '::1'
        list ip6class 'local'

config device
	option name 'eth0'
	option macaddr '94:83:c4:18:9d:17'

config interface 'wan'
        option device 'eth0'
	option proto 'dhcp'
	option ipv6 '1'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option device '@wan'
	option disabled '0'

config switch
	option name 'switch0'
	option reset '0'
	option enable_vlan '0'

config interface 'tethering6'
	option proto 'dhcpv6'
	option device '@tethering'
	option disabled '0'

config interface 'wwan6'
	option proto 'dhcpv6'
	option device '@wwan'
	option disabled '0'

config interface 'guest'
	option force_link '1'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.9.1'
	option netmask '255.255.255.0'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option ip6prefix 'ddfa:43aa:ca04::/48'
	option ip6assign '64'
	option ip6hint '0001'
	option ip6ifaceid '::1'
	option ip6class 'guest'

config interface 'wwan'
	option proto 'dhcp'

config rule 'policy_bypass_vpn'
	option mark '0x60000/0x60000'
	option lookup '53'
	option priority '53'

config rule 'policy_via_vpn'
	option mark '0x80000/0x80000'
	option lookup '52'
	option priority '52'

config rule 'policy_dns'
	option mark '0x100000/0x100000'
	option lookup '51'
	option priority '51'

config device
	option type 'bridge'
	option name 'br-hkt'
	list ports 'eth2'

config interface 'HKT4'
	option device 'eth1'
	option proto 'dhcp'
	option ip4table '100'
	list dns '1.1.1.1'
	list dns '1.0.0.1'
	option peerdns '0'

config interface 'HKT6'
	option device '@HKT4'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'

config interface 'HKT'
        option type 'bridge'
	option device 'br-hkt'
	option proto 'static'
	option ipaddr '192.168.55.1'
	option netmask '255.255.255.0'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option ip6assign '64'
	option ip6hint '0002'
	option ip6ifaceid '::1'
	list ip6class 'HKT6'

config rule
	option in 'HKT'
	option priority '100'
	option lookup '100'

config interface 'wgserver'
	option proto 'wgserver'
	option config 'main_server'
	option disabled '0'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'hktlan'
	option input 'ACCEPT'
	list network 'HKT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
        option masq6 '1'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	list network 'wwan'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	option input 'DROP'
	option masq '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled 'false'

config include
	option path '/etc/firewall.user'

config include 'nat6'
	option path '/etc/firewall.nat6'
	option reload '1'

config rule 'process_mark'
	option name 'process_mark'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 65533'
	option target 'MARK'
	option set_xmark '0x80000/0x80000'

config rule 'wan_in_conn_mark'
	option name 'wan_in_conn_mark'
	option src 'wan'
	option dest '*'
	option set_xmark '0x80000/0x80000'
	option target 'MARK'
	option extra '-j CONNMARK --set-xmark 0x80000/0x80000'
	option enabled '1'

config rule 'lan_in_conn_mark_restore'
	option name 'lan_in_conn_mark_restore'
	option src 'lan'
	option dest '*'
	option set_xmark '0x80000/0x80000'
	option target 'MARK'
	option extra '-m connmark --mark 0x80000/0x80000 -j CONNMARK --restore-mark'
	option enabled '1'

config rule 'out_conn_mark_restore'
	option name 'out_conn_mark_restore'
	option dest '*'
	option set_xmark '0x80000/0x80000'
	option target 'MARK'
	option extra '-m connmark --mark 0x80000/0x80000 -j CONNMARK --restore-mark'
	option enabled '1'

config include 'gls2s'
	option type 'script'
	option path '/var/etc/gls2s.include'
	option reload '1'

config include 'glblock'
	option type 'script'
	option path '/usr/bin/gl_block.sh'
	option reload '1'

config zone
	list network 'HKT4'
	list network 'HKT6'
	option name 'hktwan'
	option mtu_fix '1'
	option input 'DROP'
	option forward 'REJECT'
	option masq '1'
	option output 'ACCEPT'

config zone
	option name 'guest'
	option network 'guest'
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'REJECT'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Allow-DHCP'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '67-68'

config rule
	option name 'Allow-DNS'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'tcp udp'
	option dest_port '53'

config include 'vpn_server_policy'
	option type 'script'
	option path '/etc/firewall.vpn_server_policy.sh'
	option reload '1'
	option enabled '1'

config forwarding
	option dest 'hktwan'
	option src 'hktlan'

config forwarding
	option dest 'hktwan'
	option src 'guest'

config rule 'wgserver_allow'
	option name 'wgserver_allow'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'udp tcp'
	option family 'ipv4'
	option dest_port '51820'
	option enabled '1'

config zone 'wgserver'
	option name 'wgserver'
	option output 'ACCEPT'
	option mtu_fix '1'
	option network 'wgserver'
	option input 'DROP'
	option masq '1'
	option masq6 '1'
	option enabled '1'
	option forward 'REJECT'

config forwarding 'wgserver2wan'
	option src 'wgserver'
	option dest 'wan'
	option enabled '1'

config forwarding 'lan2wgserver'
	option src 'lan'
	option dest 'wgserver'
	option enabled '1'

config forwarding
	option dest 'wgserver'
	option src 'hktlan'

config forwarding
	option dest 'hktwan'
	option src 'wgserver'

config rule 'glipv6_guest_dhcp'
	option name 'Allow-DHCP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '546:547'
	option family 'ipv6'

config rule 'glipv6_guest_icmp'
	option name 'Allow-ICMP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'icmp'
	option dest_port '58'
	option family 'ipv6'

config redirect 'adguard_home'
	option name 'Adguard Home'
	option src 'lan'
	option src_dport '53'
	option dest 'lan'
	option dest_port '3053'
	option proto 'tcpudp'

config redirect 'adguard_home_guest'
	option name 'Adguard Home guest'
	option src 'guest'
	option src_dport '53'
	option dest 'guest'
	option dest_port '3053'
	option proto 'tcpudp'

config redirect
	option src 'hktlan'
	option name 'AdGuard'
	option target 'DNAT'
	option src_dport '53'
	option dest_port '3053'
	option dest 'lan'

Thanks again for your help!

Do we need to setup DHCP for hktlan?

I recalled that I stop mwan3 before setting up. Please add that procedure:

/etc/init.d/mwan3 disable
uci set mwan3.globals.enabled='0'
uci commit mwan3
mwan3 stop

Enabling both LAN and hktlan is okay.

What do you mean by “enabling” both LAN and HKTLAN?

Plugging into eth2 there is still no network.
After manual configuration on PC, network access to 192.168.50.1 and WAN (HKT) is normal.

So I believe it is due to DHCP issue.

Seems the HKTLAN DHCP server is off by accident. Turning it on will be okay.

1 Like

Yes. After enabling DHCP on HKTLAN, there is plug-and-play on eth2.

There is no IPv6 access to internet though.
(My ISP does provide IPv6, and I have been using it before)