wireless

FIX for Netgear Orbi Router / Firewall blocks additional subnets

Posted on Updated on

Last April my trusty Netgear Switch finally gave in.  I bought a nifty Dell PowerConnect 6224 switch and have been working with it off an on.  About the same time, I decided to update my home network with the Orbi WiFi System (RBK50) AC3000 by Netgear.  My previous Netgear Wifi router worked quite well but I really needed something to support multiple locations seamlessly.

The Orbi Mesh has a primary device and allows for satellites to be connected to it.  It creates a Wifi mesh that allows devices to go from room to room or building to building seamlessly.  I’ve had it up for a while now and its been working out great – that is until I decided to ask it to route more than one subnet.   In this blog I’ll show you the steps I took to over come this feature limitation but like all content on my blog this is for my reference – travel, use, or follow at your own risk.

To understand the problem we need to first understand the network layout.   My Orbi Router is the Gateway of last resort and it supplies DHCP and DNS services. In my network I have two subnets which are untagged VLANS known as VLAN 74 – 172.16.74.x/24 and VLAN 75 – 172.16.75.x/24.   VLAN 74 is used by my home devices and VLAN 75 is where I manage my ESXi hosts.  I have enabled RIP v2 on the Orbi and on the PC6224 switch.  The routing tables are populated correctly, and I can ping from any subnet to any host without issue.

Issue:  Hosts on VLAN 75 are not able to get to the internet.  Hosts on VLAN 75 can resolve DNS names (example: yahoo.com) but it cannot ping any host on the Inet, where VLAN 74 can ping Inet hosts and get to the internet.  I’d like for my hosts on VLAN 75 to have all the same functionally as my hosts on VLAN 74.

Findings:  By default, the primary Orbi router is blocking any host that is not on VLAN 74 from getting to the INET.  I believe Netgear enable this block to limit the number of devices the Orbi could NAT.  I can only guess that either the router just can’t handle the load or this was a maximum Netger tested it to.  I found this block out by logging into the routers CLI and looking at the IPTables settings.  There I could clearly see there was firewall rule blocking hosts that were not part of VLAN 74.

Solution:  Adjust the Orbi to allow all VLAN traffic (USE AT YOUR OWN RISK)

  1. Enable Telnet access on your Primary Orbi Router.
    1. Go to http://{your orbi ip address}/debug.htm
    2. Choose ‘Enable Telnet’ (**reminder to disable this when done**)
    3. Telnet into the Orbi Router
  2. I issued the command ‘iptables -t filter -L loc2net’. In the output of this command you can see where its dropping all traffic that is not (!) VLAN74
  3. Let’s remove this firewall rule. The one I want to target is 5th in the list, yours may vary.  This command will remove it ‘iptables -t filter -D loc2net 5’
  4. Next, we need to clean up some post routing issues ‘iptables -t nat -I POSTROUTING 1 -o brwan -j MASQUERADE’
  5. A quick test and I can now PING and get to the internet.
  6. Disconnect from Telnet and Disable it on your router.

Note:  Unfortunately, this is not a permanent fix.  Once you reboot your router the old settings come back.  The good news is, its only two to three lines to fix this problem.  Check out the links below for more information and a script.

If you like my ‘no-nonsense’ blog articles that get straight to the point… then post a comment or let me know… Else, I’ll start writing boring blog content.

REF:

 

 

Review: Wireless Network Devices All in One vs. Standalone

Posted on Updated on

I’m sure like most of my fellow computer geeks we get asked quite a bit around home wireless networks etc. Well, I’ve been in the market for a new Cable Modem and Router and in the past I’ve never recommended the “all in one” solution (meaning Cable Modem and Router/Firewall in one unit). Mainly this recommendation was based on my field experience back in 2007 and seeing so many of them fail. This week, going against my own advice, I gave the Netgear C3700-100NAS all in one a try for $99. Not a bad deal as it means not as many cables, it has an integrated DOCSIS 3.0 cable modem, and it’s on COX Phoenix AZ supported list. This unit worked well for about 20 mins and as I was reading reviews around its issues, it started having them. Over and Over again it slows down. You’d think by 2016 they’d have the all in one finally figured out, but alas they don’t. My recommendation still stands, avoid the all in one.

What I have been recommending for home users in the Phoenix Area with Cox Cable running their 60-100Mbs Internet are the Arris Motorolla SB6141 Cable Modem and the NETGEAR WNDR4500-100PAS N900 wireless router. I’ve had the combo since 2012 and it’s been very rock solid. If I do have an issue with this combo it is usually outside of their control, meaning the cable company is having an issue.

I bought my pair at NewEgg — WNDR4500 for $89 and the SB6141 for $69,

When I bought mine (Feb-2016) NewEgg gave me a TP-LINK TL-WR841N and a N150 wireless routers.

If there is enough interest in the post, I’ll post up how the other 2 routers work out. Enjoy!

If you like my ‘no-nonsense’ blog articles that get straight to the point… then post a comment or let me know… Else, I’ll start writing boring blog content.