Config R7800 with VLANs on 25.14.2 Firmware

Installing and Using OpenWrt
1

Hello everyone,

I have an R7800 that I have flashed with the newest firmware and I am having a heck of a time configuring VLANs on it. I was trying to follow this thread here but the port names are different on my device in the default config file (/etc/config/network) than what is in that thread. Hoping someone can help me out here as I have tried everything I can think and I keep getting locked out when trying to config via SSH. Below is the output of my device after a factory reset.

root@OpenWrt:~# cat /etc/config/network



config interface 'loopback'

	option device 'lo'

	option proto 'static'

	list ipaddr '127.0.0.1/8'



config globals 'globals'

	option dhcp_default_duid '00047bc98a9592bd4086b12b395ff0ac63f7'

	option ula_prefix 'fdc8:b005:b0d2::/48'



config device

	option name 'br-lan'

	option type 'bridge'

	list ports 'lan1'

	list ports 'lan2'

	list ports 'lan3'

	list ports 'lan4'



config interface 'lan'

	option device 'br-lan'

	option proto 'static'

	list ipaddr '192.168.1.1/24'

	option ip6assign '60'



config interface 'wan'

	option device 'wan'

	option proto 'dhcp'



config interface 'wan6'

	option device 'wan'

	option proto 'dhcpv6'

I'm hoping someone can give me some direction to get this working properly. I am trying to do VLAN1 on port 1, VLAN20 on port 2, and VLAN21 on port 3. TIA :folded_hands:

2

just to understand will this router become the main router or do you want to turn it into a dump-ap that carries traffic to a main router?

3

This would be the main router. I currently have a pfSense appliance that is handling all routing/etc, so I want to offload that to the R7800 and have the Netgate appliance just act as a perimeter firewall.

4

I'm making a few assumptions:

  • Port lan4 assigned to VLAN 1 (you didn't specify for this port)
  • This is the main and only router & AP
  • There is no need to trunk the VLANs (i.e. multiple networks on a single port which would typically connect to a managed switch or VLAN aware AP).
  • Wifi will be used with these new networks.

With that in mind... it's fairly easy.

Create bridge VLANs:

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan4:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'lan2:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '21'
	list ports 'lan3:u*'

Edit your main lan interface to use device br-lan.1:

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	list ipaddr '192.168.1.1/24'
	option ip6assign '60'

Add the new network interfaces:

config interface 'vlan20'
	option device 'br-lan.20'
	option proto 'static'
	list ipaddr '192.168.20.1/24'

config interface 'vlan21'
	option device 'br-lan.21'
	option proto 'static'
	list ipaddr '192.168.21.1/24'

Beyond this, you'll most likely want to add DHCP servers for each of these networks, and of course they need to be assigned to firewall zones with appropriate rules. If you need help with the later two, please let us know (along with the goals).

5

I'll leave you in good hands. @psherman is much more knowledgeable than me...

6

Hi @psherman thanks for the reply. I saw you in the thread I referenced and was hoping you would reply. I know youre the guru, so stoked for you answering.

I may not use port 4, which is why I didn't include it. Port 1/VLAN1 is where I manage all my servers/APs/etc. Port 2 and 3 will be the main LAN and Guest LAN. All 3 ports will be connected to the proper port on my managed switch (already configured with my pfSense). The new DSA is what throws me for a loop. Like I said, I was trying to apply what you posted in the other thread to my setup and using the port labels from my own device, but just kept getting locked out and had to reset. I'll use what you posted and see if that works, will let you know. And yes, I may need help with the firewall, as I have specific settings on my pfSense so I'll try to mirror that on the R7800.

7

Why not trunk them over a single port/cable since you have a managed switch at the other end?

Port lan4 could be a good candidate for the trunk.

The trick is the sequencing of the changes -- once you create the bridge-vlans, you need to also change the device to match on the lan interface, and this needs to be done such that all of those changes are applied at the same time. If you work directly in the config file, you can do it all at once and then restart the router (or just the network service) and it gets applied properly. In LuCI, you have to be careful about the "save & apply" button because it will reload the network config in a half-working state (which causes the lockout).

8

I guess I could. At one point in pfSense I had the routing between VLANs going but the speeds were halved. This was due to the limitations of the CPU. Now I have basically just segregated all VLANs and attached NICs to each VLANs so devices can connect to what they need (ie; NAS VM, Plex Server, etc). Since I will keep that setup, I guess I can trunk them over a single cable...or have VLAN1 on it's own cable and VLAN20/21 on another trunk cable.

9

Because you're dealing with a built-in switch (rather than individually routed ports), there will be no speed difference when comparing 1-port-per-vlan vs a trunk port.

Here's how you'll trunk using port lan4 (we'll make them all tagged):

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan4:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'lan2:u*'
	list ports 'lan4:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '21'
	list ports 'lan3:u*'
	list ports 'lan4:t'

This configuration will allow you to start with your existing physical topology, but then you can configure a trunk port on your switch (all VLANs tagged), at which point you'll unplug the 3 existing cables and plug in port lan4 into your newly created trunk port on the switch.

10

Is there any reason not to do the VLAN config in Luci? I can by go to Network/Interfaces/Devices/br-lan/Configure/Bridge VLAN filtering, enter your recommended changes in the table, press Save, (but not Save & Apply,) then go back to Interfaces and edit br-lan to use the new br-lan.1 device, press Save, and only then press Save and Apply, and go on from there, entirely in Luci.

11

Fundamentally, LuCI is fine. But the typical reason to that people get locked out or otherwise messed up is regarding sequencing. This is a non-issue when working with the config files directly.

Yes, this should in theory prevent the issue and thus would be fine.

Beyond that, there are three reasons I advise via the text of the config files:

  1. Everything you need to know/see/do is in one place (depending on the details, of course -- sometimes other files are needed: network, dhcp, firewall, wireless). It is far more compact and direct to discuss with the config files as compared to multiple screenshots and/or navigation breadcrumbs via LuCI.
  2. When commenting/advising in the forum, it is easy to directly quote (or edit) individual lines/stanzas of a text config file to draw attention to the specific changes needed.
  3. The text view (and changes discussed) of the config files themselves are easy to use as a reference... once the changes are done, the actual config can be compared against what was discussed in the forum.

But don't get me wrong -- LuCI is great and I do find myself using it quite a bit, too.I just find that config file manipulations are sometimes more efficient. Also, it's important to note a big caveat with the direct config file edits: messed up syntax can bring down the whole system. LuCI will always make sure things are formatted and syntactically correct. However, both LuCI and the direct edits cannot prevent you from syntactically valid but logically incorrect settings.