Poddałem się. Sytuacja wygląda tak, że na OpenWRT są 3 sieci LAN, jedną z niech jest sieć "LAN TV" pod którą zmuszony byłem zamontować komputer z Windows OS. Komputer ten pobiera adres z DHCP ale DNS ma przypisane ręcznie. Na tym komputerze została uruchomiona maszyna wirtualna i połączona poprzez NAT. Do tego momentu wszystko działa.
W chwili, gdy zaczynam używać trybu mostkowego maszyna wirtualna traci połączenie z siecią internet. Ale po wyłączeniu FW na OpenWRT zaczyna hulać.
W /etc/firewall.user było coś, ale niezwiązane z problemem i zostało to zakomentowane i zrestartowana usługa FW. Wiem, że blokuję strefę LAN_TV we wszystkich kierunkach, a jednak dwa urządzenia w tej sieci tj. TV oraz komputer stacjonarny działają bez problemów, internet mają. Dlaczego więc gdy pojawia się nowa wirtualna maszyna w sieci w trybie bridge ruch do niej, a w szczególności DHCP jest blokowany?
root@LEDE:~# grep -v '#' /etc/config/firewall
config defaults
option syn_flood 1
option input ACCEPT
option output ACCEPT
option forward REJECT
option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name lan_ap
list network 'lan_ap'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name lan_tv
list network 'lan_tv'
option input REJECT
option output REJECT
option forward REJECT
config zone
option name wan_opt
list network 'wan_opt'
option input ACCEPT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config zone
option name wan
list network 'wan'
option input ACCEPT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
config forwarding
option src lan
option dest wan_opt
config forwarding
option src lan_ap
option dest wan
config forwarding
option src lan_ap
option dest wan_opt
config forwarding
option src lan_ap
option dest lan
config forwarding
option src lan
option dest lan_ap
config forwarding
option src lan_tv
option dest wan
config forwarding
option src lan_tv
option dest wan_opt
config rule
option name PPTP
option src lan_tv
option dest_port 1723
option proto tcp
option target ACCEPT
config rule
option src lan_ap
option dest_ip 192.168.11.1
option dest_port 53
option target ACCEPT
config rule
option src lan_ap
option proto udp
option dest_port 67
option target ACCEPT
option family ipv4
config rule
option src lan_ap
option src_ip 192.168.11.7
option dest_ip 192.168.11.1
option target REJEC
config rule
option src lan_ap
option dest lan
option src_mac 78:11:dc:5f:b8:ef
option target REJEC
config rule
option src lan_ap
option dest lan
option src_ip 192.168.11.7
option target REJEC
config rule
option src lan_tv
option dest_ip 192.168.12.1
option dest_port 53
option target ACCEPT
config rule
option src lan_tv
option proto udp
option dest_port 67
option target ACCEPT
option family ipv4
config rule
option dest lan_tv
option dest_ip 255.255.255.255
option target ACCEPT
config rule
option src lan_ap
option dest lan
option proto udp
option dest_port 7
option target ACCEPT
option dest_ip 255.255.255.255
config rule
option name Allow-DHCP-Renew
option src wan
option src lan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
config rule
option name Allow-DHCP-Renew
option src lan_ap
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-Ping
option src lan_ap
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option src_ip fc00::/6
option dest_ip fc00::/6
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config include
option path /etc/firewall.user
