Let me start with the fact that I know this isn't a great idea and that there is a not insignificant security risk to it. Think, however, of the person owning the computer using the MAC address as a "mother in law" type person - you somehow trust her but you really don't want her easily accessing your private network.
The situation: Very basic OpenWrt setup for a wired and wireless private network (10.0.0.x) plus a guest network (10.20.0.x) as per Guest Wi-Fi. There is an unmanaged switch connected to the OpenWrt router to which most of the devices in the private network are connected to. Everything is working fine.
The challenge: A room with very limited wifi reception but a wired connection to above mentioned switch (which is not, because I know this comment will come, the prison cell or dungeon I put my mother in law in). I know the MAC of the laptop. Is there an easy way to configure a static lease for said MAC address and then route it through the guest wifi?
Instead, I would suggest that the easiest way to approach the goal would be to replace the switch with a managed switch (although I recommend against the very entry level models, as long as they are managed, you can do this; alternatively, an all-in-one wifi router running OpenWrt can usually be setup as a managed switch). This way you can send VLANs through it and configure the port that leads to your MIL's room to connect to be a member of the guest network.
Too bad. I was actually hoping to "just" statically assign an IP address from guest network to this MAC and then find a way to route this address to the guest network.
Anyway, thanks for looking into this!
So is the OpenWRT device in proximity to your un-managed switch? If so does it have more than one LAN port? If so, why not just move the cable from your "mother-in-law" room directly to a LAN port on the router - then VLAN that port / isolate it?
Yes, this is my fallback solution but will mean I need to run yet another cable from the basement, which is where the switch and all the other stuff is, to my living room, which is where the router is.
Ok, so I went ahead and bought a new switch, CBS250-16P-2G to be exact, to replace the existing dump switch. I configured two of the LAN ports to tag them for VLAN 20.
All the descriptions I found for guest-wifi and VLAN assume that the tagging is happening on OpenWRT, not on a separate switch. I tried adding the VLAN 20 to my br-guest device but this somehow didn't work. Any chance you can point me towards something that helps me resolve this
I'm using OpenWrt 23.05.2 r23630-842932a63d btw.
let's take a look at your main router's configuration:
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Ok... so we need to make bridge VLANs to setup the guest network on ethernet. What port (on the router) is used to connect to the switch? And can we use one of the other ports on the router as a test port for the guest network (if so, which one)?
Restart your router. Plug a device into port lan2 and you should get an address in the guest network. When plugged into port 1 or 3, you should get a normal lan address.
Then, on your switch, you need to configure vlan 20 to be tagged on the trunk (the port that uplinks to the router), and it should be untagged + PVID on the port that connects to your MIL's room.
Thanks for this. I try to understand what you're doing, this is all fairly new to me
You're bridging port lan1, lan3, and lan4 into vlan1
You're bridging lan2 (untagged) and lan4 (tagged) to vlan20
Result: Everything that goes through lan1 and lan3 will see vlan1 added to it. Everything that goes through port 2 will see vlan20 added to it. Everything goes through port 4 will either see vlan1 added to it or checked and routed for vlan20.
Summary:
I get a guest IP on Port 2 and internet is working
My guest wifi is still working. I, however, don't understand how as this is possible without the bridge
Access from guest wifi to private network is blocked
A PC connected to any of the non vlan ports on the second switch still works
A PC connected through the switch, which I believe is configured as described above for vlan 20 does not yet work. I need to toy with the router a bit before I can say more.
There is a bridge... just a different form. It is the bridge-vlan, which is mapped against a bridge device. When you use a bridge-vlan (i.e. br-lan.20) as the device for a network, you are indeed connecting the network to a bridge, so wifi will still work.
If you implemented what I suggested (and it sounds like you did), the problem is almost certainly on your switch, not the router. Verify the VLAN configuration of your switch to ensure that VLAN 20 is configured appropriately on both the uplink and downlink ports.
I believe I mostly got it (still need to read about a few things). Thank you very much for your help
One last question if I may: Wouldn't it have been enough to configure the Ethernet connection on the PC to vlan20 - I see there is an option in the windows driver - to achieve the same result but with the dump switch?
You still need a managed switch and the VLANs setup on the router. Simply setting up the PC on VLAN 20 (in the Windows environment) would not provide the security you desire as the main trusted lan would still be physically present at the physical network interface (and likely still active as a logical network interface in Windows).
In case someone finds this topic later. This is how I configured the Cisco router for vlan20. All ports to which "guest" PCs are connected to are in vlan20 untagged
