So, I have been trying to get this to work for what feels like forever, and yet it's still not working as expected. And yes, I have trolled the internet high and low to no avail.
The go to link appears to be:
Introduction to 802.1X
[OpenWrt Wiki] Introduction to 802.1X
Which I have read and reread. However, this is for swconfig and it appears my router has moved across to DSA.
What I have working currently:
I have created two SSIDs linked to each of the VLAN networks created, and when connected to each, would get the correct IP range from that VLAN.
When creating a SSID based on EAP, can see in the packetfence logs that the AP is reaching out authenticating correctly, being sent the correct vlan ID back to the AP, however, it would either now get an IP at all or would only get an IP of one or the other vlan regardless of which user is authenticated.
Yes, I have installed, wpad-openssl and hostapd-openssl to support dynamic vlans.
Questions I'm not sure about:
Under the wireless setup, do I need to specify the "Network" and I'm assuming from the examples I have seem, option network would be present, which its' not. So currently it's unspecified.
Under the interfaces setup, for the br-lan device, for bridge vlan filtering, does vlan id need to be tagged and is primary, or just tagged? Or untagged?
vi /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'soc@0/20000000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option band '5g'
option channel '36'
option htmode 'VHT80'
option disabled '1'
option country 'US'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi'
option band '5g'
option channel '36'
option htmode 'HE160'
option country 'AU'
option cell_density '0'
option txpower '23'
config wifi-device 'radio2'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi+1'
option band '2g'
option channel '1'
option htmode 'HE20'
option disabled '0'
option country 'US'
config wifi-iface 'wifinet0'
option device 'radio1'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'wpa3-mixed'
option auth_server '192.168.0.224'
option auth_secret 'mysecret'
option acct_server '192.168.0.224'
option acct_secret 'mysecret'
option dynamic_vlan '2'
option vlan_tagged_interface 'br-lan'
option vlan_bridge 'br-vlan'
option ocv '0'
config wifi-iface 'wifinet1'
option device 'radio1'
option mode 'ap'
option ssid 'OpenWrt40'
option encryption 'sae-mixed'
option key 'mykey'
option ocv '0'
option network 'vlan40'
config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option ssid 'OpenWrt1'
option encryption 'psk-mixed'
option key 'mykey'
option network 'vlan1'
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option ula_prefix 'fd09:d615:9a10::/48'
option packet_steering '0'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'wan'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan1:t*'
list ports 'lan2:t*'
list ports 'lan3:t*'
list ports 'wan:t*'
config bridge-vlan
option device 'br-lan'
option vlan '40'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'wan:t'
config interface 'vlan40'
option proto 'static'
option device 'br-vlan40'
option ipaddr '192.168.40.5'
option netmask '255.255.255.0'
config interface 'vlan1'
option proto 'static'
option device 'br-vlan1'
option ipaddr '192.168.0.5'
option netmask '255.255.255.0'
option gateway '192.168.0.1'
list dns '192.168.0.1'
list dns_search 'techco.net.au'
config device
option type 'bridge'
option name 'br-vlan1'
list ports 'br-lan.1'
config device
option type 'bridge'
option name 'br-vlan40'
list ports 'br-lan.40'