URL: https://linuxfr.org/forums/linux-embarque/posts/resolu_solved_routeur-openwrt-acces-internet-impossible
Title: Résolu_Solved_Routeur OpenWrt: accès internet impossible
Authors: Maderios
Date: 2015年02月21日T18:05:16+01:00
License: CC By-SA
Tags: openwrt, debian, livebox et réseau
Score: 0
Bonjour
J'ai installé Openwrt sur un routeur TP-Link WDR3600. 
Le routeur est derrière une livebox 3 Sagem . 
La connection est cablée et en statique. Aucun serveur DHCP
internet <-> adsl Livebox 3 Sagem <-> Openwrt router <-> PC, TV, imprimante
Le port wan du routeur est connecté à un port ethernet de la Livebox
Je peux accéder aux périphériques dans le subnet 192.168.2.0 mais je ne peux ni accéder à la Livebox ni accéder à internet. 
Par contre, dès que je reviens dans le réseau 192.168.1.0, je peux me connecter au net à travers le routeur Openwrt mais évidemment, je ne peux plus accéder à ce dernier.
J'ai cherché un cas similaire sur le net, pas grand chose, la majorité des configurations se faisant avec DHCP.
Où se cache l'erreur, (les erreurs)? Merci d'avance pour toute piste.
Mon fichier Debian /etc/network/network/interfaces
```sh
auto lo
iface lo inet loopback
auto eth1
iface eth1 inet static
	address 192.168.2.23
	network 192.168.2.0
	netmask 255.255.255.0
	broadcast 192.168.2.255
 gateway 192.168.2.1
 up route add -host 192.168.2.7 dev eth1 
 up route add -host 192.168.2.10 dev eth1 
mtu 1492
allow-hotplug eth1
```
Openwrt /etc/config/network
```sh
config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
config globals 'globals'
config interface 'lan'
	option force_link '1'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.2.4'
	option _orig_ifname 'eth0.1 radio0.network1 radio1.network1'
	option _orig_bridge 'true'
	option ifname 'eth0.1 eth0.2'
	option gateway '192.168.2.1'
	option dns '192.168.1.1'
config interface 'wan'
	option _orig_ifname 'eth0.2'
	option _orig_bridge 'false'
	option proto 'static'
	option netmask '255.255.255.0'
	option ifname 'eth0.2'
	option gateway '192.168.1.1'
	option ipaddr '192.168.1.19'
	option dns '192.168.1.1'
config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 1t 2 3 4 5'
	option vid '1'
config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 1'
	option vid '2'
config route
	option interface 'wan'
	option target '192.168.1.0'
	option netmask '255.255.255.0'
	option gateway '192.168.1.1'
```
```sh
#Openwrt /etc/config/firewall
config rule
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '80'
	option name 'http'
	option dest 'lan'
	option src_port '80'
	option dest_ip '192.168.2.4'
config rule
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '443'
	option name 'https'
	option dest 'lan'
	option src_port '443'
	option dest_ip '192.168.2.4'
config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'
	option enabled '0'
config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option mtu_fix '1'
	option masq '1'
	option forward 'REJECT'
	option network 'lan'
config zone
	option name 'wan'
	option output 'ACCEPT'
	option mtu_fix '1'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option network 'wan'
config include
	option path '/etc/firewall.user'
config redirect
	option target 'DNAT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '80'
	option name 'http'
	option src_port '80'
	option dest 'lan'
	option dest_ip '192.168.2.4'
config redirect
	option target 'DNAT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '443'
	option name 'https'
	option src_port '443'
	option dest 'lan'
	option dest_ip '192.168.2.4'
config redirect
	option target 'DNAT'
	option dest 'lan'
	option proto 'tcp'
	option dest_port '2049'
	option name 'NFS'
	option src 'lan'
	option src_port '2049'
	option dest_ip '192.168.2.4'
config forwarding
	option dest 'wan'
	option src 'lan'
config forwarding
	option dest 'lan'
	option src 'wan'
```
**Problème résolu de la façon suivante (cf commentaires)**
Résumé des changements:
* gateway de Debian /etc/network/interfaces= adresse IP du lan (192.168.2.4). L'IP de la gateway coté wan est celle de la Livebox (192.168.1.1)
* changer le routage sur OpenWrt
* ajouter les DNS, ajuster MTU
* désactiver le bridge sur le lan
* retirer "option masq '1' " de la zone lan et ajouter cette option à la zone wan
Le masquerading permet de contourner le problème de la Livebox 3 Sagem d'Orange qui n'offre plus la possibilité du routage.
Cette expérience de configuration OpenWrt m'a beaucoup apporté concernant la compréhension du fonctionnement du réseau. Merci à tous ceux qui, ici et ailleurs, m'ont aidé à corriger les erreurs.
** Ci dessous la conf minimum qui marche mais qui est certainement à améliorer, notamment du coté du firewall:**
```sh
#Openwrt /etc/config/network
config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
config globals 'globals'
config interface 'lan'
	option force_link '1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.2.4'
	option _orig_ifname 'eth0.1 radio0.network1 radio1.network1'
	option _orig_bridge 'true'
	option mtu '1492'
	option ifname 'eth0.1'
config interface 'wan'
	option _orig_ifname 'eth0.2'
	option _orig_bridge 'false'
	option proto 'static'
	option netmask '255.255.255.0'
	option ifname 'eth0.2'
	option gateway '192.168.1.1'
	option ipaddr '192.168.1.19'
	option mtu '1492'
	option dns '81.253.149.9 80.10.246.1'
config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 1t 2 3 4 5'
	option vid '1'
config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 1'
	option vid '2'
config route
	option interface 'wan'
	option gateway '192.168.1.1'
	option target '0.0.0.0'
	option netmask '0.0.0.0'
```
```sh
#Openwrt /etc/config/firewall
config rule
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '80'
	option name 'http'
	option dest 'lan'
	option src_port '80'
	option dest_ip '192.168.2.4'
config rule
	option target 'ACCEPT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '443'
	option name 'https'
	option dest 'lan'
	option src_port '443'
	option dest_ip '192.168.2.4'
config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'
	option enabled '0'
config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option mtu_fix '1'
	option network 'lan'
	option forward 'ACCEPT'
config zone
	option name 'wan'
	option output 'ACCEPT'
	option mtu_fix '1'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option network 'wan'
	option masq '1'
config include
	option path '/etc/firewall.user'
config redirect
	option target 'DNAT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '80'
	option name 'http'
	option src_port '80'
	option dest 'lan'
	option dest_ip '192.168.2.4'
config redirect
	option target 'DNAT'
	option src 'wan'
	option proto 'tcp'
	option dest_port '443'
	option name 'https'
	option src_port '443'
	option dest 'lan'
	option dest_ip '192.168.2.4'
config redirect
	option target 'DNAT'
	option dest 'lan'
	option proto 'tcp'
	option dest_port '2049'
	option name 'NFS'
	option src 'lan'
	option src_port '2049'
	option dest_ip '192.168.2.4'
config forwarding
	option dest 'lan'
	option src 'wan'
config forwarding
	option dest 'wan'
	option src 'lan'
config redirect
	option target 'SNAT'
	option src 'lan'
	option dest 'wan'
	option proto 'all'
	option name 'subnetpriv'
	option src_ip '192.168.2.4'
	option dest_ip '192.168.1.19'
	option src_dip '192.168.1.19'
	option src_port '1-65000'
	option dest_port '1-65000'
```
```sh
#Debian /etc/network/interfaces
auto lo
iface lo inet loopback
auto eth1
iface eth1 inet static
	address 192.168.2.23
	network 192.168.2.0
	netmask 255.255.255.0
	broadcast 192.168.2.255
 gateway 192.168.2.4
mtu 1492
allow-hotplug eth1
```
</div><div class="naked_ctrl">
<form action="/index.cgi/contrast" method="get" name="gate">
<p><a href="http://altstyle.alfasado.net">AltStyle</a> によって変換されたページ <a href="httpS://linuxfr.org/forums/linux-embarque/posts/resolu_solved_routeur-openwrt-acces-internet-impossible.md">(-&gt;オリジナル)</a>
/ <label>アドレス: <input type="text" name="naked_post_url" value="httpS://linuxfr.org/forums/linux-embarque/posts/resolu_solved_routeur-openwrt-acces-internet-impossible.md" size="22" /></label> <label>モード: <select name="naked_post_mode">
<option value="default">デフォルト</option>
<option value="speech">音声ブラウザ</option>
<option value="ruby">ルビ付き</option>
<option value="contrast" selected="selected">配色反転</option>
<option value="larger-text">文字拡大</option>
<option value="mobile">モバイル</option>
</select>
<input type="submit" value="表示" />
</p>
</form>
</div>