openwrt无法ping通内网设备

kiddliao

群晖docker挂了一个openwrt 网关配置的路由器可以正常上网
安装open克拉什配置规则后 连接旁路由的设备可以正常分流

同时用lucky进行反代 lucky也是一切正常 成功反代了十几个服务 但是openwrt的端口反代后无法打开 显示bad host
openwrt的端口可以直接通过路由器端口转发,然后在公网访问

然后进一步排查发现内网nas之间都可以相互ping通 但是都无法ping通openwrt
进openwrt后台发现只能ping通路由器 其他设备都无法ping通

显示root@KIDDLIAO:~# ping 192.168.50.2
PING 192.168.50.2 (192.168.50.2) 56(84) bytes of data.
From 192.168.50.119 icmp_seq=1 Destination Host Unreachable
From 192.168.50.119 icmp_seq=2 Destination Host Unreachable
From 192.168.50.119 icmp_seq=3 Destination Host Unreachable
From 192.168.50.119 icmp_seq=4 Destination Host Unreachable

关openwrt的防火墙也没用 只允许内网访问已经关闭

安装是参考https://blog.csdn.net/wbsu2004/article/details/132443501 主要是设置了混杂网络

求助各位大佬

kiddliao

另外我的网络接口只有一个virtual**0和lan口 没有wan口

kiddliao

我的手机wifi网关设置的openwrt 可以正常的上外网进行分流
手机可以ping通openwrt 因为连在openwrt下

kiddliao

openwrt也可以ping通公网 比如baidu 但是局域网内其他设备就是没法ping通

kiddliao

network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.50.2'
        option gateway '192.168.50.1'
        option dns '192.168.50.1'

config interface 'virtual**0'
        option ifname 'tun0'
        option proto 'none'

kiddliao

firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option flow_offloading '0'
        option flow_offloading_hw '0'
        option fullcone '0'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'utun lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'
        option src '*'
        option dest '*'

config rule
        option name 'Allow-Ping'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option src '*'
        option dest '*'

config rule
        option name 'Allow-IGMP'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'
        option src '*'
        option dest '*'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled 'false'

config include
        option path '/etc/firewall.user'

config include 'zerotier'
        option type 'script'
        option path '/etc/zerotier.start'
        option reload '1'

config include 'gowebdav'
        option type 'script'
        option path '/var/etc/gowebdav.include'
        option reload '1'

config include '“师夷长技以制夷”'
        option type 'script'
        option path '/var/etc/“师夷长技以制夷”.include'
        option reload '1'

config include '“师夷长技以制夷”_server'
        option type 'script'
        option path '/var/etc/“师夷长技以制夷”_server.include'
        option reload '1'

config include 'softethervirtual**'
        option type 'script'
        option path '/usr/share/softethervirtual**/firewall.include'
        option reload '1'

config include '“师夷长技以制夷”r'
        option type 'script'
        option path '/var/etc/“师夷长技以制夷”r.include'
        option reload '1'

config include 'wrtbwmon'
        option type 'script'
        option path '/etc/wrtbwmon.include'
        option reload '1'

config include 'open克拉什'
        option type 'script'
        option path '/var/etc/open克拉什.include'
        option reload '1'

kiddliao

求助各位大佬