D-Link DIR-882A1 VLAN setting and firewall setting

Maxxim999 · October 21, 2024, 5:40pm

Hello, after a long search for a solution to how to set VLAN on OpenWRT, I gave up and I want to ask for your help.
My network currently consists of:

Huawei router ISP(Optical converter)=> TP-Link VR2100 (as AP DHCP server)=>
LAN1=> WAN port PPPoE Internet connection
LAN2=> D-LINK DIR 882 A1 (OpenWRT still only testing and setting)           
                       => WAN port IC as AP
                       => Admin PC (LAN1)
                       => UBUNTU server (LAN2)
LAN3 => TP-link SWITCH 5-port (2x PC on the 1st floor)
LAN4 => D-LINK SWITCH 8-port (3xIPTV Adnroid Boxes + 1x Enigma
 2 stb as iptv)

I want or need to create at least 2 VLAN networks, especially for IPTV, if possible, connect the Guest WIFI LAN4 port to this VLAN, otherwise I will create a 3rd VLAN wifi network and especially for LAN on LAN1, LAN2, LAN3 ports.
I went through a lot of instructions, but I still get lost somewhere, I have no experience with this. For a long time I wanted to use the OpenWRT network, but I didn't have a router that would support it, and now I managed to get a router and I can't set it up.:-((
Now it's in this order only so that I don't shut down the Internet connection in the house. Since frequent restarts are necessary.
D-Link DIR-882A1 will be used as the main router after setup instead of TP-Link VR2100.
My configuration files are full because today I also reset Openwrt, so there are only basic settings.
Can you please help me with this?

psherman · October 21, 2024, 6:44pm

Is the huawei device able to run as a bridge mode device (assuming it's a DSL modem or similar), or can it be removed entirely? The idea would be to terminate the PPPoE connection on the D-Link unit instead.

is IC supposed to me "included"? Or something else?

Will each of these ports carry just a single nework, or do you intend for them to carry multiple networks to the switches? And are those switches managed (what is the model of each of those devices)?

Maxxim999 · October 21, 2024, 6:59pm

The switches are not managed and the Huawei one is "irrelevant" in this problem of mine, it is an optical converter.
I just need to create and set up 3 x VLANs = IPTV, GuestWifi, Admin network. Nothing else. Even if I create devices and the following interfaces and start it somehow, it doesn't work either:
There is no internet connection
or I can't log in to Webgui OpenWrt. So it doesn't work. I know that the biggest problem is in front of the keyboard , but I still carry it on, so I'm trying to find a solution.

Maxxim999 · October 21, 2024, 7:03pm

In this way, ports 1,2,3 will be in one VLAN1, port 4 VLAN2 and guestwifi VLAN3 or VLAN2 and VLAN3 will be one network, I think I don't need to separate them.

psherman · October 21, 2024, 7:11pm

is it only an optical converter, or does it perform NAT/routing and terminate the PPPoE connection. Unless it is a bridge device (simply media conversion, no routing, no NAT, etc.), it is highly relevant to the configuration methods required for creating your additional networks. What you want to achieve is possible either way, but the methods might be different.

No problem.

I don't understand what you're going for here.

Let's do it this way:

Port 1: VLAN 1
Port 2: VLAN 1
Port 3: VLAN 1 (and???)
Port 4: VLAN ?? (and???)

Maxxim999 · October 21, 2024, 7:25pm

I get lost in the settings. I set the device e.g. br-lan10, br-lan20 and br-lan-30. Next, I set the interface VLAN1, VLAN2 and VLAN3, but somewhere in the configuration I made a mistake because I passed x instructions and they do it differently everywhere due to the network requirements. It's certainly not a big problem, but I really don't have experience with it and I'm tired of trying and constantly resetting the settings. I guess we'll leave it as it is and try again tomorrow. Thank you for now, if possible we'll try to continue tomorrow. I'm tight today. Good night.

Maxxim999 · October 21, 2024, 7:29pm

Port1:VLAN1
Port2:VLAN1
Port3:VLAN1
Port4:VLAN2
GUESTWIFI:VLAN3 or VLAN2

Maxxim999 · October 21, 2024, 7:32pm

I think I will find help here, but probably not... :-(((

psherman · October 21, 2024, 8:20pm

Your VLAN assignments seem simple enough.

You just need to decide if the guest network is independent or the same as what is present on port 4.

You still didn't answer this:

Maxxim999 · October 22, 2024, 5:37am

It is not a bridging device. To connect to the Internet, there is a TP-Link VR2100 via PPPoE, my network starts from it. It is a DHCP server, Port forwarding, NAT goes through it, I have isolated IPTV on it, but not at the VLAN level, etc. It actually manages the entire network operation. 2.4-5 GHz wifi and guest wifi. I want to use all this on D-Link DIR-882 A1 + VLANY.
I decided to use VLAN only for one thing. Last year I bought an Android box from aliexpress, by the way, we use 2 android boxes also from aliexpress, they work without problems, but the last one has Android 14 on it and I tried to connect it to the LAN network several times and it dropped the entire network. He had to completely restart everything, and I'm not talking about the fact that someone got access to some information. I don't have anything important on any PC, but... And it ended up under the hammer, I think it won't start anymore.
And here the guest wifi VLAN3 as a separate VLAN, without the wifi network in VLAN1.

psherman · October 22, 2024, 5:48am

How did you isolate IPTV if not using VLANs?

So does this mean that you want all devices to be connected behind the D-Link device instead of some connecting to the Huawei?

Maxxim999 · October 22, 2024, 6:05am

It's OK, IPTV is on the VLAN level only in the TP-Link interface, otherwise there is a separate section for IPTV.
But we'll close it because it's not going anywhere. I guess we don't understand each other.

psherman · October 22, 2024, 6:15am

To be quite honest, your descriptions are not currently sufficient for anyone to really help you reach the goal. That's why I've been asking questions -- trying to get the information necessary to do so.

There are several ways that things can be structured, but it's really important to have a complete picture of the topology in order to do it both efficiently and securely. For example, I've been asking for details about the huawei device... first you said this:

which makes it sound like all it is doing is media conversion (optical > copper).
Then you said this:

which tells a completely different story about what that device is doing.

You went on to say that

and when I asked how this works on the huawei device, you said:

which again, is not consistent with your previous statement where you said it wasn't "at the vlan level" but then it was on the vlan level on a different device.

If you can better illustrate your desired topology, maybe we can help. A diagram could be really useful here.

Maxxim999 · October 22, 2024, 5:58pm

This is my /etc/config/network but I can't connect to the internet. Where did I go wrong?

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'XXXXXXXXXXXXXXXX"
        option packet_steering '1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'LAN'
        option ipv6 '0'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'wan'

config bridge-vlan
        option device 'LAN'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3'
        list ports 'wan:t'

config bridge-vlan
        option device 'LAN'
        option vlan '2'
        list ports 'lan1'
        list ports 'lan4:u*'
        list ports 'wan:t'

config bridge-vlan
        option device 'LAN'
        option vlan '3'
        list ports 'lan1'
        list ports 'wan:t'

config interface 'IPTV'
        option proto 'static'
        option device 'LAN.2'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'
        list dns '1.1.1.1'

config device
        option name 'LAN.1'
        option type '8021q'
        option ifname 'LAN'
        option vid '1'

config interface 'GUEST'
        option proto 'static'
        option device 'LAN.3'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'

config device
        option name 'LAN.2'
        option type '8021q'
        option ifname 'LAN'
        option vid '2'

config device
        option name 'LAN.3'
        option type '8021q'
        option ifname 'LAN'
        option vid '3'

config interface 'LAN1'
        option proto 'static'
        option device 'LAN.1'
        option ipaddr '192.168.11.1'
        option netmask '255.255.255.0'

psherman · October 22, 2024, 6:18pm

I see a bunch of errors here, but you still have not properly described your topology and the role and address/subnet of the upstream router/network.

Please show a topology diagram complete with addresses.

Maxxim999 · October 22, 2024, 6:58pm

It's not important anymore. I sought help elsewhere. Thank you. I don't know how to close the topic, please close it. I certainly do not intend to solve any diagrams. Thank you