To enable internet access for devices connected to an OpenWrt router via LuCI, you must configure the WAN interface with valid upstream DNS servers and ensure the firewall zone is set to accept traffic. Additionally, verify that DHCP settings on the LAN interface provide correct gateway addresses to clients, allowing them to route traffic through the router to the external network.
Configuring the WAN Interface
The primary requirement for internet connectivity is a properly configured Wide Area Network (WAN) interface. In the LuCI web interface, navigate to Network and then select Interfaces. You will see a list of existing interfaces; locate the one labeled wan or create a new interface if none exists.
Select the WAN interface and click Edit. Ensure the Protocol is set correctly for your connection type. For most residential connections, this will be DHCP client if your ISP provides an IP address dynamically, or PPPoE if you require authentication credentials. If using PPPoE, enter the username and password provided by your service provider. Under the General Settings tab, ensure the Device field corresponds to the physical port connected to your modem or upstream router, such as eth0 or eth1.
A common mistake is leaving the DNS fields blank. While some protocols fetch DNS automatically, it is best practice to manually specify reliable public DNS servers. Scroll down to the DNS Server field and enter primary and secondary servers like 8.8.8.8 and 1.1.1.1. This ensures that even if the upstream provider fails to push DNS information, your router can resolve domain names. After making these changes, click Save and then Save & Apply to commit the configuration.
Verifying Firewall Zone Settings
OpenWrt uses a strict default firewall policy where traffic from untrusted zones (like WAN) to trusted zones (like LAN) is dropped unless explicitly allowed. To allow internet access, the WAN zone must be permitted to forward traffic to the LAN zone. Go to Network > Firewall and select the Zones tab.
Locate the lan zone and ensure its Output setting is set to Accept. Similarly, check the wan zone. The critical setting here is the Forward rule between zones. Navigate to the Rules tab. You should see a rule that allows forwarding from wan to lan. If this rule is missing or disabled, internet access will be blocked. Ensure the Source zone is wan, the Destination zone is lan, and the Action is set to Accept. Without this explicit permission, packets from your WiFi or Ethernet devices cannot traverse the router to reach the internet.
Checking LAN DHCP and Gateway Configuration
Even with a working WAN connection, local devices may fail to connect if they do not know how to reach the gateway. Navigate to Network > Interfaces and edit the lan interface. Under the DHCP Server tab, verify that DHCPv4 is enabled. The Gateway field should point to the IP address of the LAN interface itself, typically 192.168.1.1 or 192.168.0.1, depending on your subnet mask.
If the gateway is misconfigured, devices will receive an IP address but lack a route to the outside world. Also, check the DNS field in the LAN DHCP settings. It is advisable to set this to the same public DNS servers used in the WAN configuration, ensuring consistency. Save the changes and restart the DHCP service by clicking Restart next to the interface, or simply reboot the router to apply all network changes cleanly.
Troubleshooting Connectivity Issues
If devices still cannot access the internet after these configurations, check the physical link status. Ensure the cable connecting the modem to the router's WAN port shows solid lights. Sometimes, the issue lies with the upstream device rather than the OpenWrt configuration. For more detailed diagnostics, you might need to investigate why SSH is not functioning correctly if remote management is required, as seen in Why doesn't SSH work if WiFi is on while ethernet is connected?. This can help isolate whether the problem is strictly routing-related or involves broader network stack issues.
Another potential pitfall is incorrect MTU (Maximum Transmission Unit) settings, which can cause packet fragmentation and loss. If you suspect this, you can test connectivity using ping commands from the router's command line. Log in via SSH and run ping -s 1472 8.8.8.8. If this fails but smaller pings succeed, you may need to adjust the MTU size in the WAN interface settings under the Advanced Settings tab.
Testing and Validation
Once all settings are applied, validate the setup by connecting a device to either the WiFi or an Ethernet port on the LAN side. Open a browser and attempt to load any website. If the page loads, the configuration is successful. You can also use the LuCI dashboard to monitor traffic statistics under Status > Routing to see if packets are being routed out through the WAN interface.
If you encounter issues where devices are reachable locally but have no internet, refer to guides on Troubleshooting Linux Device Not Reachable During Network (Ping) to diagnose layer 2 or layer 3 isolation problems. This often helps distinguish between a routing error and a simple IP conflict or cabling fault.
Frequently Asked Questions
Why can I ping the router but not any websites?
This indicates a DNS resolution failure rather than a routing issue. Check the DNS server entries in both the WAN and LAN interface configurations. Ensure they are set to valid public DNS servers like Google or Cloudflare. Restart the DHCP service on the LAN interface to force clients to request the new DNS settings.
What should I do if the WAN interface shows "No Link"?
Verify that the Ethernet cable is securely plugged into the correct port designated as WAN in the LuCI interface. Check the LED indicators on the router port to confirm physical connectivity. If the link is active but no IP is obtained, try changing the protocol from DHCP to Static if your ISP requires specific IP assignments.
Can I use a different subnet for the LAN interface?
Yes, you can change the LAN IP address and subnet mask in the Interface settings. However, ensure that no other device on your network uses the same IP range to avoid conflicts. Changing the subnet will require reconfiguring any static IP reservations or port forwarding rules previously established.
How do I reset the network configuration if I get locked out?
If you misconfigure the network and lose access, perform a hard reset by holding the reset button on the router for about 10 seconds until the LEDs flash. This restores all settings to factory defaults, including the default LAN IP and password. You can then log in again and reconfigure the WAN settings carefully.
Does enabling IPv6 affect my internet access?
Enabling IPv6 can provide faster direct routes but may complicate firewall rules if not configured correctly. If you experience intermittent connectivity, try disabling IPv6 in the WAN interface settings to isolate whether the issue is related to IPv6 routing or dual-stack compatibility. Most standard web browsing works fine over IPv4 alone.