Configuring VLANs to work through ISP router

I followed this tutorial exactly: https://youtu.be/qeuZqRqH-ug

This is what the hardware looks like:

The ISP router is in a main house, and then the OpenWrt router and switch are in a separate garage / apartment.

The two networks should be isolated since I worry about ransomware etc. I can change any settings which would not mess up their function (TVs, phone, wifi). I added a reserved ip (10.0.0.222) for my router.

Right now the original (vlan 200) connection still works. I can route via ipv4 since I am able to access devices on the ISP router's local network, and I can access the internet. This interface has the setting "iPv6 assignment length" set to 60, the others are at 0.

When I change the iPv6 assignment length on the other vlans, they can access the internet. But they cannot access what seem to be iPv4 connections.

I read an answer from another post explaining I can add static routes to the reserved ip address (10.0.0.222?), but this was not clear to me. Is there an easy setting to allow the vlans to route via iPv4? This is outside of my technical area and has been very frustrating, before I even get to the other hard parts :sweat_smile:

So you're saying that VLAN 200 works properly, but VLAN 420 and 888 don't?

You don't need to add routes to your ISP router if you're using masquerading on the wan zone (which is the default/typical use case).

Let's take a look at your config:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
root@OpenWrt:~# ubus call system board
{
        "kernel": "5.10.161",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Linksys E8450 (UBI)",
        "board_name": "linksys,e8450-ubi",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "22.03.3",
                "revision": "r20028-43d71ad93e",
                "target": "mediatek/mt7622",
                "description": "OpenWrt 22.03.3 r20028-43d71ad93e"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix REMOVED

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option device 'br-lan.200'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '200'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '420'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '888'
        list ports 'lan4:t'

config interface 'GUEST'
        option proto 'static'
        option netmask '255.255.255.0'
        option device 'br-lan.420'
        option ipaddr '192.168.4.1'

config interface 'UNSECURE'
        option proto 'static'
        option netmask '255.255.255.0'
        option device 'br-lan.888'
        option ipaddr '192.168.8.1'
        option ip6assign '60'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/18000000.wmac'
        option band '2g'
        option htmode 'HT20'
        option he_su_beamformee '1'
        option he_bss_color '8'
        option country 'CA'
        option cell_density '0'
        option channel 'auto'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option key 
        option ssid 
        option encryption 'psk2'
        option network 'GUEST'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option he_su_beamformee '1'
        option he_bss_color '8'
        option country 'CA'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 
        option encryption 'sae'
        option key 

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid
        option encryption 'psk2'
        option key
        option network 'lan'
root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'GUEST'
        option interface 'GUEST'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'UNSECURE'
        option interface 'UNSECURE'
        option start '100'
        option limit '150'
        option leasetime '12h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option output 'ACCEPT'
        option forward 'REJECT'
        option name 'Guests'
        option input 'REJECT'
        list network 'GUEST'

config zone
        option name 'Unsecure'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'UNSECURE'

config forwarding
        option src 'lan'
        option dest 'Unsecure'

config forwarding
        option src 'Guests'
        option dest 'wan'

config rule
        option name 'Guest DHCP and DNS'
        option src 'Guests'
        option dest_port '53 67 68'
        option target 'ACCEPT'

From the looks of it, the GUESTS network should be able to access the internet normally, while the UNSECURE network should not have access.

Is that what you are seeing? Is that the desired configuration?

That was my intention, the Guest network can access the internet but cannot see other devices on the network (or access the router). The Unsecure network is for things which I want to prevent internet access to, but still be able to access from other devices.

Based on your config, it seems that you should have achieved your goal. What is not working properly?

I tried this again and it seems the vlans attached to the router are working as expected now, I have no idea why. Did you do some magic?

The ones attached to the switch are not working however, and I can no longer use the "xxxx.lan" addresses to access devices since I added the vlans. My PC is currently connected to LAN1, with the switch on LAN4. I cannot access the NAS on the switch.

Is this configured improperly? I believe the switch configuration is correct.

Also, how would I re-enable the .lan addresses? I have a raspberry pi I used to access via server.lan, but since it's on a separate network now, I cannot. I can still use the ip address.

Thanks for the help

I must have... I've mastered the remote help! :laughing:

Which switch? The built-in switch in your E8450 or the TP-link switch?

Based on the configuration you've shown, I would expect that VLAN 200 would be present on lan1-lan3, and lan4 has all three VLANs tagged and connected to the TP link switch. If devices connected to the TP-link switch aren't on the correct network and/or aren't working at all, it would suggest the TP-link isn't configured properly.

Aside from not having the "hostname.lan" addresses, it seems like most things are working after I changed the PVID on the tp-link switch to match the lan bridge (200). Do you happen to know what setting would allow these addresses to be visible between vlans?

well, hostname.lan would be a local dns entry... if you use the IP address, can you connect instead (this will isolate the problem to general connectivity or dns related failures)?