Connecting ethernet port to different interface on R7800

Hi all,

on a Netgear Nightawk R7800, from the default installation, all my ethernet ports (other than WAN) are on the interface of 1 network.

I need to take one of these ports, and make it connect to another interface.

Here are the relevant parts of the configuration:

/etc/config/wireless

config wifi-iface 'radio1_net1'
	option device 'radio1'
	option network 'net1'
	option mode 'ap'
	option key REDACTED
	option ssid 'net1_ssid'

config wifi-iface 'radio1_net2'
	option device 'radio1'
	option network 'net2'
	option mode 'ap'
	option key REDACTED
	option ssid 'net2_ssid'

/etc/config/network

config interface 'net1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '193.167.1.1'
	option device 'br-net1'

config interface 'net2'
	option type 'bridge'
	option proto 'static'
	option ipaddr '193.167.2.1'
	option netmask '255.255.255.0'

config interface 'wan'
	option proto 'dhcp'
	option peerdns '0'
	option device 'eth0.2'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'

config device
	option name 'br-net1'
	option type 'bridge'
	list ports 'eth1.1'

Right now, all my ethernet ports connect to the network net1. I want one of these ethernet ports to connect to net2 only, and give no access whatsoever to net1.

Any help much appreciated.

config interface 'net1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '193.167.1.1'
	option device 'br-net1'

config interface 'net2'
	option proto 'static'
	option ipaddr '193.167.2.1'
	option netmask '255.255.255.0'
	option device 'br-net2'

config interface 'wan'
	option proto 'dhcp'
	option peerdns '0'
	option device 'eth0.2'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'
	
config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '1 6t'

config device
	option name 'br-net1'
	option type 'bridge'
	list ports 'eth1.1'
	
config device
	option name 'br-net2'
	option type 'bridge'
	list ports 'eth1.3'

https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guest-wlan#firewall

EDIT:

You know these are not RFC1918 addresses, right?

2 Likes

Amazing, it all works, thanks!

Just a few basic questions:

  • what is the difference between having my net2 configured with option device 'br-net1' instead of option type 'bridge'?

  • in terms of separating net1 and net2, I have indeed configured my firewall for network separation. However, I am wondering if there is increase security risk in having the 2 networks share a switch (before, the 2 networks were only on wifi)? Maybe that increases the attack surface?

You know these are not RFC1918 addresses, right?

Yeah, I was just tinkering around, to try and see what happens with non standard addresses.

option type 'bridge' was part of the old syntax and it doesn't work with the new versions (the bridge will not be created).

If you mean the device switch, this is not a problem. Wired ports belonging to different VLANs are completely isolated from each other.
However, if you want to connect the two networks to a common external switch, there are many risks and potential problems.

1 Like

Ok, that sounds great, thanks for the explanation. The switch is simply the embeded switch in the router itself. No external switch.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.