Main-router connectivity: verify WAN DHCP and PPPoE separately

Outcome

Tell whether WAN uses DHCP or PPPoE and which status to check;
Verify WAN address/gateway/DNS instead of trusting “connected”;
Verify LAN client address, gateway and DNS;
Decide whether a “WAN up, LAN down” failure is forwarding/NAT or DNS;
Know what PPPoE needs and why it cannot be called tested without a real line.

Topology and assumptions

Upstream router/ONT 192.168.50.1
        │
   WAN eth1 (DHCP 192.168.50.166/24)
        │
   OpenWrt VM 200
        │
   LAN br-lan 192.168.10.1/24
        │
   LAN client 192.168.10.191/24

WAN and LAN must be different subnets; do not overlap the upstream.
The main router must NAT/forward; bypass/AP verification is different.
Keep console access; do not rely on one web session while changing WAN.

Identify the WAN protocol

Router shellRead current WAN/LAN config

uci show network.wan
uci show network.wan6 2>/dev/null
uci show network.lan
ip -4 addr show
ip route

The WAN proto decides what to inspect: dhcp → udhcpc, pppoe → pppd/pppoe-wan.

ExpectedYou know whether WAN is dhcp, pppoe or static.

WAN DHCP

LuCISet WAN to DHCP client

Open Network → Interfaces → WAN → Edit:

Protocol: DHCP client;
Save and apply;
On Interfaces, confirm WAN has an IPv4 address, not just “Connected”.

CLI equivalent:

uci set network.wan.proto='dhcp'
uci commit network
/etc/init.d/network reload

ExpectedWAN receives an address, gateway and DNS.

Router shellVerify WAN address/gateway/DNS

ubus call network.interface.wan status
ip -4 addr show eth1
ip route
cat /tmp/resolv.conf.d/resolv.conf.auto
nslookup openwrt.org 192.168.50.1

This lab got:

WAN 192.168.50.166/24;
gateway/DNS 192.168.50.1;
WAN device eth1.

If ubus says up: false or has no ipv4-address, check logread -e udhcpc before touching LAN.

ExpectedWAN has an address, the default route points upstream and DNS works.

ComputerVerify the LAN client

ip addr show
ip route
cat /etc/resolv.conf
ping 192.168.10.1

In this lab the LAN DHCP client got 192.168.10.191/24, gateway 192.168.10.1.

Test beyond the router:

ping -c 3 1.1.1.1
nslookup openwrt.org

This E2 run rechecked WAN DHCP and LAN DHCP; the LAN client’s NAT/DNS path to the public internet was not fully re-run, so “the client can browse” is not marked tested.

ExpectedThe client gets a LAN address, gateway and DNS.

Router shellWAN up but LAN down

uci show firewall
nft list ruleset 2>/dev/null | head -80
logread | grep -i firewall | tail -20

Check:

LAN/WAN in the correct firewall zones;
WAN zone masquerade enabled;
forward allows LAN→WAN;
client gateway/DNS points to OpenWrt;
no second DHCP or subnet conflict.

ExpectedSeparate forwarding/NAT from DNS.

PPPoE (E1, real line required)

ComputerConfirm what information you have

PPPoE usually needs:

ISP account/password (never post to chat/repos/screenshots);
VLAN ID in some regions;
service name/AC name in some regions;
whether the ONT already dials (bridge vs router mode);
MTU/MSS and IPv6 requirements.

Without these, do not call PPPoE tested; never test with someone else’s account.

ExpectedAccount, password, VLAN/service name are available and lawfully obtained.

LuCIConfigure PPPoE in LuCI (example, no real password)

Network → Interfaces → WAN → Edit → Protocol: PPPoE:

Username/Password: your ISP credentials;
configure VLAN at the device/interface layer if required;
Keepalive can start at 5 3;
Save and apply.

CLI shape (do not put a real password into shell history/repos):

uci set network.wan.proto='pppoe'
uci set network.wan.username='<your-account>'
uci set network.wan.password='<your-password>'
uci set network.wan.keepalive='5 3'
uci commit network
/etc/init.d/network reload

ExpectedWAN protocol becomes PPPoE; credentials stay on the device.

Router shellVerify PPPoE status

ubus call network.interface.wan status
ip -4 addr show pppoe-wan
ip route
logread | grep -Ei 'pppd|pppoe' | tail -30

Check:

IPv4 on pppoe-wan;
default route via pppoe-wan;
DNS works;
MTU around 1492 (common for PPPoE);
auth failure/timeout/service-name errors in the log.

This page has no real ISP account, so PPPoE stays E1 and makes no “dial succeeded” claim.

Expectedpppoe-wan has an address, default route and DNS.

Common failures

WAN DHCP gets no address

Wrong port (WAN vs LAN);
upstream DHCP disabled;
MAC binding/authentication upstream;
VLAN required;
check logread -e udhcpc for discover/offer;
do not guess the upstream subnet with a static IP.

PPPoE authentication fails

Wrong account/password (case/suffix);
VLAN/service name required;
the ONT is still dialing (double dial);
account bound to MAC/port;
repeated retries may trigger ISP limits; read the log instead of hammering.

WAN has an address, LAN has no internet

firewall zone/forward/masquerade;
client gateway/DNS;
upstream allows only one device/MAC;
subnet conflict/double NAT;
IPv6 vs IPv4 differences.

DNS fails

Test WAN-side DNS (nslookup ... 192.168.50.1);
then the router itself (nslookup ... 127.0.0.1);
then the LAN client (cat /etc/resolv.conf);
do not blame WAN for every DNS failure.

E2/E1 record

WAN DHCP (E2)

Environment: OpenWrt 25.12.6 x86 VM 200; WAN eth1; upstream 192.168.50.1.
Result: WAN 192.168.50.166/24, gateway/DNS 192.168.50.1; LAN 192.168.10.1/24.
LAN DHCP: netns client 192.168.10.191/24, gateway 192.168.10.1.
Not re-run: LAN client → public internet NAT/DNS end-to-end, IPv6, physical WAN.

PPPoE (E1)

No real ISP account/line; no dial, auth, MTU or DNS verification.
Readers must test with their own lawful account and device/ISP docs; never publish credentials.

Sources and review

WAN DHCP is E2; PPPoE is E1. Do not merge them into “main router fully tested”.
Recipe: tests/recipes/wan-dhcp-pppoe-25.12.md.
No independent reviewer; conclusions are limited to this VM/upstream environment.

Sources

Router.Homes

Independent OpenWrt notes. Every page states the firmware, device, package manager and way back.

Icons: Solar by 480 Design, CC BY 4.0