Broken VLAN setup

Hello, I am new to OpenWrt. I am using OpenWrt 22.03.3 r20028-43d71ad93e on a 4port wireless router.

Trying to setup two VLANs.one for general use and one for iot devices

  • Have used switch menu to create a VLAN (#3) with port no 4 (all other ports are with VLAN1)
  • Have created a device with eth0 of type VLAN (802.1q)
  • Have created an interface to use this device, with static IP and DHCP configured
  • Have configured 802.bgn wireless to use that interface

Here are current observations

  • I get the two networks and can connect to those using the ports on the router
  • I get 192.168.1.x on first three ports and get 192.168.3.x on the fort port as configured in the switch
  • However I expected isolation between the two, while I am able to ping one from other
  • I do not get ip via wireless network on either of the interfaces

I must have done something wrong in the configuration.

Can someone help?
Avinash

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/firewall

here are the network details

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd61:5d64:d2da::/48'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'
	option bridge_empty '1'
	option ipv6 '0'

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option device 'eth0.1'
	option type 'bridge'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '1'
	option ports '0t 2 3 4'

config device
	option type '8021q'
	option ifname 'eth0'
	option vid '3'
	option name 'eth0.3'
	option ipv6 '0'

config interface 'iotvlan'
	option proto 'static'
	option device 'eth0.3'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'
	option type 'bridge'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 1'
	option vid '3'

here are the firewall details

	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'iot'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'iotvlan'
	option forward 'ACCEPT'

config forwarding
	option src 'iot'
	option dest 'wan'

Your lan has a few errors... make it look like this (remove the option type bridge, change the device to br-lan:

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option device 'br-lan'

Remove the option type bridge from the iotvlan network, create a new bridge devicce and then use that in the IoT network... it'll look like this:

config device
	option name 'br-iot'
	option type 'bridge'
	list ports 'eth0.3'

config interface 'iotvlan'
	option proto 'static'
	option device 'br-iot'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

Next, on the firewall, everything looks fine except for the fact that the IoT network has access to the router itself. Typically, untrusted networks should not have access to the router except for DHCP (and optionally DNS) services. If you'd like to make this change, it's fairly simple, shown below (hold off on this particular thing until you have verified that your networks are working properly based on the above changes):

config zone
	option name 'iot'
	option input 'REJECT'
	option output 'ACCEPT'
	list network 'iotvlan'
	option forward 'REJECT'

config rule
        option name 'IoT DHCP and DNS'
        option dest_port '53 67 68'
        option target 'ACCEPT'
        option src 'iot'
2 Likes

Great help @psherman I followed your guidance and now all my networks are up and running including wifi on the VLAN.

You have been quick and precise, really appreciate it.

Great! Glad it is all working now!

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.