Configuring VLANs on the RT3200/E8450

Harakan · January 17, 2023, 8:14pm

I've just picked up a Belkin RT3200 (LinkSys E8450) to replace my current router (Archer C7 v5), but I'm very confused about how to set up VLANs on the new device - both are running OpenWRT 23.03.03, but I can't figure out how to replicate my existing configuration.

The Archer C7 v5 had a "Network" > "Switch" page, that allowed the various ports to be included as tagged/untagged members of VLANs. I had a fairly complex setup with half a dozen VLANs, several untagged on individual router ports, and others tagged to external managed switches, bridged with various wireless SSIDs.

On the RT3200, there is no "Network" > "Switch" page. However, the "Interfaces" > "Devices" page seems to suggest that it IS switch-based - it shows the br-lan bridge device, but then an "eth0" and four LAN ports "lan0".."lan3" all with the same MAC address (where I would expect separate hardware ports to have unique MACs), and a "wan" with a different MAC. If I click "Add device configuration", the "Existing device" dropdown shows "Ethernet switch: eth0" and "Switch port: lan0" etc.

I've read the Wiki page on VLANs (https://openwrt.org/docs/guide-user/network/vlan/switch_configuration), including the "Is there a VLAN-capable hardware switch integrated in your device?" section, but the output I see from the RT3200 doesn't seem consistent with either of the examples - it doesn't have either "devices/pci..." or "devices/virtual...":

root@OpenWrt:~# ls -l /sys/class/net
lrwxrwxrwx    1 root     root             0 Jan  3 00:26 br-lan -> ../../devices/virtual/net/br-lan
lrwxrwxrwx    1 root     root             0 Jan  1  1970 eth0 -> ../../devices/platform/1b100000.ethernet/net/eth0
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan1 -> ../../devices/platform/1b100000.ethernet/mdio_bus/mdio-bus/mdio-bus:00/net/lan1
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan2 -> ../../devices/platform/1b100000.ethernet/mdio_bus/mdio-bus/mdio-bus:00/net/lan2
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan3 -> ../../devices/platform/1b100000.ethernet/mdio_bus/mdio-bus/mdio-bus:00/net/lan3
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan4 -> ../../devices/platform/1b100000.ethernet/mdio_bus/mdio-bus/mdio-bus:00/net/lan4
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lo -> ../../devices/virtual/net/lo
lrwxrwxrwx    1 root     root             0 Jan  1  1970 wan -> ../../devices/platform/1b100000.ethernet/mdio_bus/mdio-bus/mdio-bus:00/net/wan
lrwxrwxrwx    1 root     root             0 Jan  3 00:26 wlan0 -> ../../devices/platform/18000000.wmac/net/wlan0
lrwxrwxrwx    1 root     root             0 Jan  3 00:26 wlan1 -> ../../devices/platform/1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/net/wlan1

Does the RT3200 have a switch, or does it have separate hardware ports? If it isn't switch-based, what is the "Ethernet switch: eth0" under "existing devices" and why are "lan0" etc. listed as switch ports? If it is switch-based, why don't I see a "Network" > "Switch" page? Is this something missing from the default configuration or that I have to enable somewhere?

Thanks in advance for any help!

Harakan · January 17, 2023, 8:26pm

The /etc/config/network from my current configuration on the Archer C7:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd07:5f89:16ff::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'
        option ipv6 '0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.128.254'
        option delegate '0'

config device
        option name 'eth0.2'
        option macaddr 'ac:84:c6:8e:1a:06'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'
        option auto '0'
        option reqaddress 'try'
        option reqprefix 'auto'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option description 'LAN-Internal'
        option ports '0t 2 3'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option description 'WAN-External'
        option ports '0t 1'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '129'
        option description 'VLAN129-Limited'
        option ports '0t 2t 5'

config device
        option type 'bridge'
        option name 'br-vlan129'
        list ports 'eth0.129'
        option ipv6 '0'

config device
        option name 'eth0.129'
        option ipv6 '0'

config interface 'VLAN129'
        option proto 'static'
        option device 'br-vlan129'
        option ipaddr '192.168.129.254'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'eth0'
        option ipv6 '0'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option vid '130'
        option ports '0t'
        option description 'VLAN130-Ext2G'

config device
        option type 'bridge'
        option name 'br-vlan130'
        list ports 'eth0.130'
        option ipv6 '0'

config device
        option name 'eth0.130'
        option ipv6 '0'

config interface 'VLAN130'
        option proto 'static'
        option ipaddr '192.168.130.254'
        option netmask '255.255.255.0'
        option device 'br-vlan130'

config switch_vlan
        option device 'switch0'
        option vlan '5'
        option vid '131'
        option ports '0t'
        option description 'VLAN131-Ext5G'

config device
        option type 'bridge'
        option name 'br-vlan131'
        list ports 'eth0.131'
        option ipv6 '0'

config device
        option name 'eth0.131'
        option ipv6 '0'

config interface 'VLAN131'
        option proto 'static'
        option device 'br-vlan131'
        option ipaddr '192.168.131.254'
        option netmask '255.255.255.0'

config switch_vlan
        option device 'switch0'
        option vlan '7'
        option ports '0t 2t'
        option vid '140'
        option description 'VLAN140-Private'

config device
        option type 'bridge'
        option name 'br-vlan140'
        option ipv6 '0'
        list ports 'eth0.140'

config interface 'VLAN140'
        option proto 'static'
        option device 'br-vlan140'
        option ipaddr '192.168.140.254'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'eth0.140'
        option ipv6 '0'

config switch_vlan
        option device 'switch0'
        option vlan '8'
        option ports '0t 2t'
        option vid '132'
        option description 'VLAN132-ExtLAN'

config device
        option name 'eth0.132'
        option ipv6 '0'

config device
        option type 'bridge'
        option name 'br-vlan132'
        list ports 'eth0.132'
        option ipv6 '0'

config interface 'VLAN132'
        option proto 'static'
        option device 'br-vlan132'
        option ipaddr '192.168.132.254'
        option netmask '255.255.255.0'
        option delegate '0'

psherman · January 17, 2023, 8:33pm

Your RT3200 is a DSA device.

Is your goal to replicate the VLAN config you have on the C7?

Harakan · January 17, 2023, 8:45pm

Thanks - DSA is entirely new to me!

Yes, if possible my starting point is to replicate the current VLAN config so I can do a drop-in replacement for the current Archer C7.

I guess the only real issue I have with the existing configuration was the need to have separate interfaces for the 2.4G/5G/wired "Ext" networks. The intention with these networks is that every client is isolated and only has Internet access - the "client isolaton" on wireless works well for this but still allowed access to the other radio / wired network if they were on the same bridge, and the workarounds I could find weren't very elegant. Obviously the wired clients can still see each other, but I could add extra VLANs to further isolate any specific wired devices if necessary.

Harakan · January 18, 2023, 12:18am

I think I've correctly replicated my previous setup on the RT3200:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdae:ea2b:66f7::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option device 'br-lan.1'
        option delegate '0'
        option ipaddr '192.168.128.254'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '129'
        list ports 'lan1:t'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '132'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '140'
        list ports 'lan1:t'

config device
        option name 'br-lan.1'
        option ipv6 '0'

config device
        option name 'br-lan.129'
        option ipv6 '0'

config interface 'VLAN129'
        option proto 'static'
        option device 'br-lan.129'
        option ipaddr '192.168.129.254'
        option netmask '255.255.255.0'
        option delegate '0'

config interface 'VLAN130'
        option proto 'static'
        option device 'radio0.network3'
        option ipaddr '192.168.130.254'
        option netmask '255.255.255.0'
        option delegate '0'

config interface 'VLAN131'
        option proto 'static'
        option device 'radio1.network3'
        option ipaddr '192.168.131.254'
        option netmask '255.255.255.0'
        option delegate '0'

config interface 'VLAN132'
        option proto 'static'
        option device 'br-lan.132'
        option ipaddr '192.168.132.254'
        option netmask '255.255.255.0'
        option delegate '0'

config interface 'VLAN140'
        option proto 'static'
        option device 'br-lan.140'
        option ipaddr '192.168.140.254'
        option netmask '255.255.255.0'
        option delegate '0'

Is it expected that the LuCI "Interfaces" page now only shows the bridge port (e.g. "br-lan129)") even if a wireless SSID is assigned to the interface? On the C7, it would show the bridge, and then all the ports - wired and wireless - in brackets.

Also, is there any easy way to see the status of the physical ports (link rate etc.) in LuCI with DSA? I used to be able to get this easily by just going to "Network > Switch", but the only place I can find it now is very deep - "Network > Interfaces > Devices > br-lan:Configure > Bridge VLAN filtering".

Thanks again for the help getting this up and running so quickly - after I got my head around the DSA approach, it doesn't seem as confusing as it did at first - assuming I haven't messed it up completely!

skobelik · February 21, 2023, 9:27am

Hello,
I also have a vlan problem on my RT3200, meaning I couldn't replicate the configuration from my old Netgear AP.

Basically, I would like to have e.g. lan4 detached from the main bridge and bridged with lan1.7 instead. I couldn't even create the latter vlan with the usual syntax, so I'm somewhat at loss.

The idea is to have another machine on another subnet use the Belkin router as bridge, without it being on the same network. Am I doing it wrong?

LEDE-Guy · August 11, 2023, 10:13pm

Was there ever a resolution to this? I’m in the same boat. Coming from a C2600 that had vlans configured so I could extend one of my networks via wired.

Harakan · August 12, 2023, 4:48am

My RT3200 is working as I wanted, with multiple VLANs on both wired and wireless. I'm still using the stable release (22.03.5).

I think the configuration I posted on 18-Jan-2023 worked, but it was a long time ago - I've set up more complex firewall rules and made other tweaks since then, so not sure if I'm still using those exact settings.

The key was reading up on DSA - it is quite different. LuCI doesn't show physical port states on the stable release, but I've learned to live without that.