Access IoT VLAN devices (soundbar and printer) from main VLAN

TomaszG1 · September 13, 2024, 9:20pm

Hi, I'm quite new in OpenWRT, but I managed to make the following setup based on two Xiaomi AX3000T devices with OpenWrt 23.05:

First device that acts as a router and has two VLANs and two firewall zones configured. One main lan and one for IoT devices.
Two wireless APs, one for lan (5GHz) and one for IoT (2.4GHz)
Dumb AP that extends wireless APs + also allows connecting wired IoT devices.
The idea is that devices from lan can access wan and IoT, but IoT can only access wan
The issues I have is that despite the firewall zones configuration that allows forwarding from lan to IoT I'm not able to connect from lan to my HEOS soundbar or wireless printer when they are in IoT VLAN.

Here are my configs for router:

ubus call system board

root@router:~# ubus call system board
{
	"kernel": "5.15.164",
	"hostname": "router",
	"system": "ARMv8 Processor rev 4",
	"model": "Xiaomi Mi Router AX3000T",
	"board_name": "xiaomi,mi-router-ax3000t",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05-SNAPSHOT",
		"revision": "r24041-a07a531329",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05-SNAPSHOT r24041-a07a531329"
	}
}

/etc/config/network

root@router:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd60:cbe7:aed7::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.99'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ip6ifaceid '::1'

config device
	option name 'wan'
	option macaddr '50:88:11:52:33:e7'

config interface 'wan'
	option device 'wan'
	option proto 'pppoe'
	option username '<redacted>'
	option password '<redacted>'
	option ipv6 'auto'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option disabled '1'
	option reqaddress 'try'
	option reqprefix 'auto'

config interface 'iot'
	option proto 'static'
	option device 'br-lan.3'
	option ipaddr '172.18.18.1'
	option netmask '255.255.255.0'

config bridge-vlan
	option device 'br-lan'
	option vlan '3'
	list ports 'lan2:u*'
	list ports 'lan3:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'lan3:t'
	list ports 'lan4:u*'

/etc/config/wireless

root@router:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/18000000.wifi'
	option channel 'auto'
	option band '2g'
	option htmode 'HE20'
	option country 'PL'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/18000000.wifi+1'
	option channel 'auto'
	option band '5g'
	option htmode 'HE80'
	option country 'PL'
	option cell_density '0'

config wifi-iface 'wifinet1'
	option device 'radio1'
	option mode 'ap'
	option ssid 'ACME'
	option encryption 'psk2'
	option key '<redacted>'
	option network 'lan'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

config wifi-iface 'wifinet3'
	option device 'radio0'
	option mode 'ap'
	option ssid 'ACME IoT'
	option encryption 'psk2'
	option key '<redacted>'
	option network 'iot'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

## This one is added for troubleshooting, I would like to get rid of it
config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'ACME'
	option encryption 'psk2'
	option key '<redacted>'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option network 'lan'

/etc/config/dhcp

root@router:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
	option interface 'lan'
	option start '5'
	option limit '200'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option force '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'iot'
	option interface 'iot'
	option start '5'
	option limit '200'
	option leasetime '12h'

config host
	option name 'ap1'
	list mac '44:F7:70:23:42:AC'
	option ip '192.168.1.2'
	option duid '0003000144f7702342ac'

/etc/config/firewall

root@router:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'IoTZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'IoTZone'
	option dest 'wan'

config rule
	option name 'Allow IoT DHCP, DNS'
	option src 'IoTZone'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'IoTZone'

Dumb AP config:

ubus call system board

root@ap1:~# ubus call system board
{
	"kernel": "5.15.164",
	"hostname": "ap1",
	"system": "ARMv8 Processor rev 4",
	"model": "Xiaomi Mi Router AX3000T",
	"board_name": "xiaomi,mi-router-ax3000t",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05-SNAPSHOT",
		"revision": "r24041-a07a531329",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05-SNAPSHOT r24041-a07a531329"
	}
}

/etc/config/network

root@ap1:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd46:263e:7579::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'wan'

config interface 'lan'
	option device 'br-lan.99'
	option proto 'dhcp'
	option ip6ifaceid '::2'

config interface 'lan6'
	option proto 'dhcpv6'
	option device '@lan'
	option reqaddress 'try'
	option reqprefix 'auto'

config bridge-vlan
	option device 'br-lan'
	option vlan '3'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'
	list ports 'wan:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'wan:t'

config interface 'iot'
	option proto 'dhcp'
	option device 'br-lan.3'
	option ip6ifaceid '::2'

/etc/config/wireless

root@ap1:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/18000000.wifi'
	option channel '8'
	option band '2g'
	option htmode 'HE20'
	option country 'PL'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'ACME IoT'
	option encryption 'psk2'
	option key '<redacted>'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option network 'iot'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/18000000.wifi+1'
	option channel 'auto'
	option band '5g'
	option htmode 'HE80'
	option country 'PL'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'ACME'
	option encryption 'psk2'
	option key '<redacted>'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'

/etc/config/dhcp

root@ap1:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'
	list rebind_domain 'free.aero2.net.pl'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'hybrid'
	option ra 'hybrid'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

/etc/config/firewall

root@ap1:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'lan6'

psherman · September 13, 2024, 9:27pm

The problem is very likely that they are using mdns or other mechanisms that are expecting the everything to be on the same L2 network. That is to say that the methods they use do not normally work across subnets as they are not routable.

The config looks largely good, although I would recommend that you run a stable release build instead of snapshot (23.05.4 is current as of right now).

On the AP, make the iot network interface unmanaged like this:

config interface 'iot'
	option proto 'none'
	option device 'br-lan.3'

Then, try installing avahi so you can setup an mdns reflector/repeater -- this happens on the main router.

TomaszG1 · September 14, 2024, 8:46am

Thanks for that, I have to read more about avahi and mdns on how to setup these. When it comes to the soundbar, I suspected that app can only work for devices within the same vlan. However, I'm quite surprised that wifi printer is not found neither by Macos nor Android devices when it's in a different vlan.

I've also noticed that I had masquerade turned off in the firewall for the IoTZone. It helped with connecting by IP to the other devices but not for soundbar nor printer.

psherman · September 14, 2024, 4:31pm

Again, this likely uses mdns (I.e. AirPrint) for auto-discovery and configuration.
However, you should be able to reach the printer if you reference it via IP address directly.