I was trying to configure two different networks for 2 separate SSID, below is configuration, but SSID fails to connect, what I am doing wrong?
Need help to fix this.
Router D link=DIR-853 A3
Receiving WAN from another AP.
daemon.notice netifd: Wireless device 'radio0' is now up
daemon.info dnsmasq[1]: read /etc/hosts - 12 names
daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 8 names
daemon.info dnsmasq[1]: read /tmp/hosts/odhcpd - 4 names
daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
daemon.warn odhcpd[1605]: A default route is present but there is no public prefix on lan thus we don't announce a default route by overriding ra_lifetime!
daemon.info hostapd: phy0-ap0: STA 42:da:c2:fe:73:52 IEEE 802.11: authenticated
daemon.info hostapd: phy0-ap0: STA 42:da:c2:fe:73:52 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy0-ap0: AP-STA-CONNECTED 42:da:c2:fe:73:52 auth_alg=open
daemon.notice hostapd: phy0-ap0: AP-STA-DISCONNECTED 42:da:c2:fe:73:52
logread | grep -i vlan
kern.info kernel: [ 3.155836] 8021q: 802.1Q VLAN Support v1.8
user.notice : Added device handler type: macvlan
daemon.notice netifd: Interface 'vlan1' is enabled
daemon.notice netifd: Interface 'vlan1' is setting up now
daemon.notice netifd: Interface 'vlan1' is now up
daemon.notice netifd: Interface 'vlan2' is enabled
daemon.notice netifd: Interface 'vlan2' is setting up now
daemon.notice netifd: Interface 'vlan2' is now up
daemon.notice netifd: VLAN 'eth0.1' link is up
daemon.notice netifd: Interface 'vlan1' has link connectivity
daemon.notice netifd: VLAN 'eth0.2' link is up
daemon.notice netifd: Interface 'vlan2' has link connectivity
user.notice firewall: Reloading firewall due to ifup of vlan1 (eth0.1)
user.notice firewall: Reloading firewall due to ifup of vlan2 (eth0.2)
logread | grep firewall
user.notice ucitrack: Setting up /etc/config/luci-splash reload dependency on /etc/config/firewall
user.notice ucitrack: Setting up /etc/config/qos reload dependency on /etc/config/firewall
user.notice ucitrack: Setting up /etc/config/miniupnpd reload dependency on /etc/config/firewall
user.notice firewall: Reloading firewall due to ifup of lan (br-lan)
user.notice firewall: Reloading firewall due to ifup of vlan1 (eth0.1)
user.notice firewall: Reloading firewall due to ifup of vlan2 (eth0.2)
user.notice firewall: Reloading firewall due to ifup of wan (wan)
user.notice firewall: Reloading firewall due to ifup of wan6 (wan)
user.notice firewall: Reloading firewall due to ifupdate of wan6 (wan)
I am sharing things according to my minimal knowledge, may not answering correctly to your questions. I tried myself to go through multiple posts and figured out this configuration. If there is well defined tutorial already existing kindly direct me to that.
Upstream network physically connected via WAN port
wan interfaces : screen shot attached
version of OpenWrt:23.05.5 r24106
logread | grep firewall
Mon Sep 23 12:35:04 2024 user.notice ucitrack: Setting up /etc/config/luci-splas h reload dependency on /etc/config/firewall
Mon Sep 23 12:35:04 2024 user.notice ucitrack: Setting up /etc/config/qos reload dependency on /etc/config/firewall
Mon Sep 23 12:35:04 2024 user.notice ucitrack: Setting up /etc/config/miniupnpd reload dependency on /etc/config/firewall
Mon Sep 23 12:35:06 2024 user.notice firewall: Reloading firewall due to ifup of lan (br-lan)
Mon Sep 23 12:35:27 2024 user.notice firewall: Reloading firewall due to ifup of wan (wan)
Mon Sep 23 12:35:37 2024 user.notice firewall: Reloading firewall due to ifup of wan6 (wan)
Sun Dec 29 05:15:21 2024 user.notice firewall: Reloading firewall due to ifup of wan (wan)
Sun Dec 29 05:15:45 2024 user.notice firewall: Reloading firewall due to ifup of wan6 (wan)
Ok... this looks so much better. The old config was entirely invalid. Now we have a baseline that will work.
Time for some followup questions:
does the upstream router already have VLANs defined?
If not, is it capable of having multiple networks and VLANs?
(if the upstream router runs OpenWrt, the answer is yes for the capabilities and that's where we should actually start; other router vendors/firmware may or may not have VLAN support -- many do, many don't)
If it doesn't have any VLAN functionality available, does the main router support static routes?
You mentioned 2 neworks/SSIDs... is one of them the same as the upstream network (i.e. just a bridged AP)? Or is the intent to have 2 networks that are separate from the upstream (thus making a total of 3 in the equation -- an upstream + 2 downstream)?
3 different SSID with 3 different networks.
1st for the kids with banIP
2nd for others, handling adgurad, SQM/Bufferbloat, SAMBA, DNS-Cloudflare etc
3rd one, unfiltered (IPTV, news and other stuff)
if router need to be changed, I have an additional Linksys AC3200.
logread | grep network
Sat Dec 28 09:26:11 2024 user.notice ucitrack: Setting up /etc/config/dhcp reload dependency on /etc/config/network
Sat Dec 28 09:26:11 2024 user.notice ucitrack: Setting up /etc/config/network reload dependency on /etc/config/wireless
cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fda4:b6e4:3b2c::/41'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
option stp '1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'wan'
option proto 'pppoe'
option username '-----------'
option password '------------'
option ipv6 'auto'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
grep firewall
Sat Dec 28 09:26:12 2024 user.notice ucitrack: Setting up /etc/config/luci-splash reload dependency on /etc/config/firewall
Sat Dec 28 09:26:12 2024 user.notice ucitrack: Setting up /etc/config/qos reload dependency on /etc/config/firewall
Sat Dec 28 09:26:12 2024 user.notice ucitrack: Setting up /etc/config/miniupnpd reload dependency on /etc/config/firewall
Sat Dec 28 09:26:13 2024 user.notice firewall: Reloading firewall due to ifup of lan (br-lan)
Sat Dec 28 09:26:18 2024 user.notice firewall: Reloading firewall due to ifup of wan (pppoe-wan)
Sat Dec 28 09:26:24 2024 user.notice firewall: Reloading firewall due to ifup of wan_6 (pppoe-wan)
Hope it is safe to paste everything here.
I am using TP-link powerline adopter as extender, which cloned SSID form upstream router, so it might show in log as disabled.
What physical port connects from the main router over to the AP? This is the one that will need to be configured as a trunk to carry all the VLANs.
Do you want the other ports to be your normal lan, or would you like to have those ports setup for use with the other networks, too? (for example, you could do 1 trunk port, and then setup 1 port per network for the other 3 ports).
Meanwhile, you can start with the process of adding the new networks... Follow the guest wifi recipe, but skip over the part that makes the wifi SSIDs -- we don't need that yet. The process will have you setup a guest network that is isolated from the main network by means of the firewall. If you want to limit access to the router and to the other networks, follow that section. If not, just add the new networks to the lan firewall zone.
Once you're done with that, post your updated network config file and I'll show you how to make the modifications to make it into VLANs.
This is how my setup is.
Gateway>>Dlink router/AP (Don't want to keep 3rd device, if possible)
LAN ports are for TV, desktop and powerline adopter, if those can be kept, will be better. (But I love to learn, how to assign ports to another network)
It does occur to me that we may have issues with the power line adapter.... not all of these devices will support VLANs. But we'll give it a shot and see what happens.
This router is DSA based and I fail to see the need to run vlans here. You just need to create separate interfaces (networks) and attach the respective lan[1-4] ports and ssids to the right interfaces.
I had a few months ago nearly the same opinion with 3 seperate networks (SSID)s one for my Smarthome, one for my work/parents network and one for the childs.
I used the following config and it is working well with VLANs
root@WR1300v3:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option packet_steering '1'
option ula_prefix 'fd9f:f265:6dcf::/48'
config interface 'wan'
option device 'wan'
option proto 'static'
option ipaddr '192.168.2.2'
option netmask '255.255.255.0'
option gateway '192.168.2.1'
list dns '192.168.2.1'
list dns '8.8.8.8'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
config device
option name 'phy1-ap0'
config interface 'Management'
option proto 'static'
option device 'lan1'
option ipaddr '192.168.20.1'
option netmask '255.255.255.0'
config device
option type 'bridge'
option name 'test'
option bridge_empty '1'
option ipv6 '0'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config bridge-vlan
option device 'test'
option vlan '128'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'
config interface 'kinder'
option proto 'static'
option device 'test.140'
option ipaddr '192.168.140.1'
option netmask '255.255.255.0'
config bridge-vlan
option device 'test'
option vlan '140'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'
config device
option name 'lan1'
config bridge-vlan
option device 'test'
option vlan '150'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'
config interface 'Smarthome'
option proto 'static'
option device 'test.150'
option ipaddr '192.168.150.1'
option netmask '255.255.255.0'
list dns '192.168.2.1'
config bridge-vlan
option device 'test'
option vlan '130'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'
config bridge-vlan
option device 'test'
option vlan '10'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'
config interface 'Eltern'
option proto 'static'
option device 'test.128'
option ipaddr '192.168.128.1'
option netmask '255.255.255.0'
config route
option interface 'wan'
option target '0.0.0.0/0'
option gateway '192.168.2.1'
config interface 'Mgmt'
option proto 'static'
option device 'test.130'
option ipaddr '192.168.130.1'
option netmask '255.255.255.0'
I configured my FRitz!Box only for PPPOE Connection.
Defined 3 VLANs and added them to OpenWRT Router.
If you can not use VLANs with your PowerLine Adapter I think you can buy new one with VLAN or you must use static routes. (I think VLAN is more secure and you have seperate networks per SSID. Also you can add every port to a seperate VLAN. I.e. in my opinion I added my Playstation via a Switch only to Smarthome network. So it is totally isolated from parents network.
Thanks for adding help, definitely I will try this.
But still the half problem will be solved.
No rescue for binding Ad Guard with one SSID, ban-IP with second SSID and keeping unbound 3rd one.
