I would like to be able to access the modem bridge through the router. There is a section in the guide for setting up a static ip interface to access a modem (section 9.20).
The only problem is the Home Hub isn't set up to allow administration access on the bridge WAN port. I don't want to just let that through the fire wall as it is bridged to the DSL and I'm unsure how much of a security risk that would be.
Does anyone have a suggestion of how to set this up in a fairly secure way so I can only access the modem from my LAN?
I don't think that answer my question. I can put the interface on the router to pass packet to the modem, but I need help with getting the modem to accept the connection.
I've got my router on 192.168.41.1 and the modem on 192.168.100.1. I've got the WAN port of my home hub connect to the WAN port of my router.
The other LAN ports of the modem are bridge together and the firewall is set to allow packets to be accepted form them, so I can log on to Luci by plugging into those ports.
My question is how can I security allow a connection to Luci form the router on the WAN port when it is bridged to the DSL line?
Sorry then i don't understand what you're trying to do...
at this point, i realy realy don't understand.
if the BT home hub is the modem, then you have to connect one of its LAN port to the WAN port of the Router (ASUS). From my point of view, the way you're trying to do is not correct.
That's how things have to be connected, and that way you can follow the links i posted above. And everything will be secure.
If you followed the instructions in 9.8 to configure unused red WAN socket to become a dedicated bridge mode only socket, have you tried bridging the two VLANs for the WAN socket, so both bridged and LAN (from web UI) packets appear on same port like a 'regular' modem?
What I did is I configured the modem to use the 192.168.100.0/8 network, then I configured two VLANs on the red WAN port, VLaN7 and VLAN2, let's call these red.7 and red.2. Then I bridged red.7 to dsl0.7. And added red.2 to br-lan.
On the PPPoE router I configured PPPoE to use eth2.7 (eth2 being that router's wan interface) and added another interface eth2.2 with a static address (192.168.100.2) and added that to the WAN zone. And now I can access the HH5A's GUI from my internal network simply by browsing to: http://192.168.100.1.
I think this set-up meets your "fairly secure way" criterion....
My solution is simple but maybe less secure
All eth ports are Lan on router .same on VDSL modem . Then vlan9 bridged to dsl0 in modem . And same vlan9 is set as WAN device in router . This extend my LAN network to where modem is via single 1Gbit link.
If you connect from a router LAN port directly to a modem LAN port, this is indeed less secure. The described method will not expose the home network behind the router to any entity that managed to take over the modem (however who ever took over the OpenWrt modem might also be able to repeat that feat for the OpenWrt router).
Ok so the consensus seems to be to use a VLAN tag to run two connection on the same physical port (WAN).
I'll try and explain in a little more detail what I had setup, sorry I confused people:
HH5A (bridged modem):
I had the DSL port bridged to the WAN port unmanaged and not assosated with any firewall zone. Then I had the 4 LAN ports bridged together running a stactic address protocol (192.168.1.1) along with a DHCP server and assigned to a LAN firewall zone.
I had the standard firewall setings of:
General: input accept, output accept, forward reject
Lan -> Reject: input accept, output accept, forward accept.
My hope is that should let any packets from the WAN port be passed directly to the DSL modem and I can plug in to the LAN ports to do administration with the HH5A having an IP of 192.168.1.1, which did all seem to work.
Although I am worred I've got my firewall set up wrong as I don't see why someone couldn't access the router from the WAN port.
ASUS RT-AX53U (router):
Has the LAN ports bridged together with standard firewall settings as the LAN zone. Then a PPPoE interface running on the WAN port as the LAN zone for the firewall, all setting normal.
I could then add a static interface on the WAN port to allow forwarding of packets for 192.168.1.1 to the HH5A, however it's firewall setting wouldn't allow this to go further. assuming my understanding of the firewall setting on the HH5A is correct.
I think I understand that I can set the WAN port to keep the VLAN tags on the packets and then set up a new firewall zone on the HH5A to allow administration from the WAN port.
Yes that should work, and since the WAN and DSL ports are their own independent bridge there is no real security issue with this setup. I had misunderstood what you did with the WAN port.
However you need to run a second cable which can or can not be a problem. (My modem sits around 12m away from my router so running a second cable was something I wanted to avoid since I did not have that long a cable sitting around).
Well I've set my switch on the HH5A and router to keep the VLAN tags on the WAN ports. I've then set up a new VLAN and added devices so that I can send the PPPoE data on one VLAN and use the other for administation. This all seems to be working just fine now.
My hope and undersanding is that someone would still need phyical access to the WAN port of the HH5A to log on with this set up.
