Hello, I am new to OpenWrt. I am using OpenWrt 22.03.3 r20028-43d71ad93e on a 4port wireless router.
Trying to setup two VLANs.one for general use and one for iot devices
Have used switch menu to create a VLAN (#3 ) with port no 4 (all other ports are with VLAN1)
Have created a device with eth0 of type VLAN (802.1q)
Have created an interface to use this device, with static IP and DHCP configured
Have configured 802.bgn wireless to use that interface
Here are current observations
I get the two networks and can connect to those using the ports on the router
I get 192.168.1.x on first three ports and get 192.168.3.x on the fort port as configured in the switch
However I expected isolation between the two, while I am able to ping one from other
I do not get ip via wireless network on either of the interfaces
I must have done something wrong in the configuration.
Can someone help?
Avinash
Please copy the output of the following commands and post it here using the "Preformatted text </>
" button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
cat /etc/config/network
cat /etc/config/firewall
here are the network details
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd61:5d64:d2da::/48'
config interface 'wan'
option device 'eth1'
option proto 'dhcp'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
option bridge_empty '1'
option ipv6 '0'
config interface 'lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option device 'eth0.1'
option type 'bridge'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '0t 2 3 4'
config device
option type '8021q'
option ifname 'eth0'
option vid '3'
option name 'eth0.3'
option ipv6 '0'
config interface 'iotvlan'
option proto 'static'
option device 'eth0.3'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
option type 'bridge'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1'
option vid '3'
here are the firewall details
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
list network 'iotvlan'
option forward 'ACCEPT'
config forwarding
option src 'iot'
option dest 'wan'
Your lan has a few errors... make it look like this (remove the option type bridge, change the device to br-lan:
config interface 'lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option device 'br-lan'
Remove the option type bridge from the iotvlan network, create a new bridge devicce and then use that in the IoT network... it'll look like this:
config device
option name 'br-iot'
option type 'bridge'
list ports 'eth0.3'
config interface 'iotvlan'
option proto 'static'
option device 'br-iot'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'
Next, on the firewall, everything looks fine except for the fact that the IoT network has access to the router itself. Typically, untrusted networks should not have access to the router except for DHCP (and optionally DNS) services. If you'd like to make this change, it's fairly simple, shown below (hold off on this particular thing until you have verified that your networks are working properly based on the above changes):
config zone
option name 'iot'
option input 'REJECT'
option output 'ACCEPT'
list network 'iotvlan'
option forward 'REJECT'
config rule
option name 'IoT DHCP and DNS'
option dest_port '53 67 68'
option target 'ACCEPT'
option src 'iot'
2 Likes
Great help @psherman I followed your guidance and now all my networks are up and running including wifi on the VLAN.
You have been quick and precise, really appreciate it.
Great! Glad it is all working now!
system
Closed
January 25, 2023, 7:51am
7
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.