DHCP IPv4 pass-through failing on bridge with trunk VLAN interface

Installing and Using OpenWrt
1

Hello everyone,

I am having an issue with DHCP propagation on a secondary router running OpenWrt.

My setup involves a main router ("master") that handles all routing and DHCP servers, and sends tagged VLANs down to my OpenWrt device via a trunk port (lan1).

On the OpenWrt router, I am trying to untag VLAN 10 on a specific physical port (lan2) so that devices connected to it can automatically get an IP from the main router's DHCP pool. To do this, I grouped the VLAN sub-interface (lan1.10) and the physical port (lan2) into a software bridge named br-lan10.

Both router use: OpenWrt 25.12.4

Here is my current configuration of the secondary router:

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '2'
	option dhcp_default_duid '0004d8238d47c27c41f1826f5daa735bb1ad'

config device
	option type '8021q'
	option ifname 'lan1'
	option vid '11'
	option name 'lan1.11'

config interface 'iot'
	option proto 'none'
	option device 'br-iot'
	option ipv6 '0'

config device
	option type 'bridge'
	option name 'br-iot'
	list ports 'lan1.11'
	option macaddr '2c:3a:fd:c7:08:88' 

config device
	option type '8021q'
	option ifname 'lan1'
	option vid '10'
	option name 'lan1.10'

config device
	option type 'bridge'
	option name 'br-lan10'
	list ports 'lan1.10'
	list ports 'lan2'
	option vlan_filtering '1'
	option macaddr '2c:3a:fd:c7:08:89' 
	option igmp_snooping '0'          

# 2. Dici solo a lan2 di comportarsi da porta nativa (Access) per la VLAN 10
config bridge-port
	option device 'br-lan10'
	option ports 'lan2'
	option pvid '10'

config interface 'lan10'
	option proto 'static'
	option device 'br-lan10'
	option ipaddr '192.168.10.253'
	option netmask '255.255.255.0'
	option gateway '192.168.10.254'
	list dns '192.168.10.254'
	list dns '1.1.1.1'
	list dns '8.8.8.8'
	list dns_search 'linux.pg'
	option ipv6 '1'
	option delegate '0'
	option ip6assign '64'

config device
	option type 'bridge'
	option name 'br_recovery'

config interface 'recovery'
	option proto 'static'
	option device 'br_recovery'
	option ipaddr '192.168.3.254'
	option netmask '255.255.255.0'
	option ipv6 '0'

config device
	option name 'lan2'

config device
	option type '8021q'
	option ifname 'lan1'
	option vid '9'
	option name 'lan1.9'

config device
	option type 'bridge'
	option name 'br-guest'
	list ports 'lan1.9'

config interface 'guest'
	option proto 'none'
	option device 'br-guest'
	option ipv6 '0'

config interface 'Lan10v6'
	option proto 'dhcpv6'
	option device 'br-lan10'
	option reqaddress 'try'
	option reqprefix 'auto'
	option norelease '1'
	option multipath 'off'

cat /etc/config/dhcp 

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/linux.pg/'
	option domain 'linux.pg'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option port '53'
	option noresolv '1'
	option bind_interfaces '0'
	list server '192.168.10.254'
	list server '1.1.1.1'
	list server '8.8.8.8'
	list server '/*in-addr.arpa/192.168.10.254'
	list server '/*in-addr.arpa/192.168.11.254'
	list server '/*in-addr.arpa/192.168.9.254'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/odhcpd.leases'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option interface 'iot'
	option ignore '1'
	option piodir '/tmp/odhcpd-piodir'
	option hostsdir '/tmp/hosts'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option ignore '1'

config dhcp 'lan10'
	option interface 'lan10'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option ignore '1'

config dhcp 'recovery'
	option interface 'recovery'
	option start '100'
	option limit '150'
	option leasetime '12h'

Any hints on what might be dropping these broadcast packets or how to properly debug this?

Thank you!

2

This looks quite odd, but in order to properly determine the necessary config, let’s see the output of ubus call system board

3

To you

ubus call system board
{
        "kernel": "6.12.87",
        "hostname": "Fritz3000",
        "system": "ARMv7 Processor rev 5 (v7l)",        "model": "AVM FRITZ!Repeater 3000",
        "board_name": "avm,fritzrepeater-3000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.4",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32933-4ccb782af7",                "target": "ipq40xx/generic",
                "description": "OpenWrt 25.12.4 r32933-4ccb782af7",
                "builddate": "1778712129"
        }
}

Thank

4

Since this device has 2 ethernet ports and uses DSA, you need to use bridge-VLANs. Right now, your config is invalid.

I'd recommend resetting the device to defaults and then rebuilding the VLANs using the DSA method.

If you'd like help doing this, please post the default network configuration from your device and we can help you setup the VLANs accordingly. In that case, please also be sure to indicate what you'll be using your second ethernet port for.

5

Thanks, I managed to fix it by recreating the configuration from scratch:

 cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '2'
	option dhcp_default_duid '0004d8238d47c27c41f1826f5daa735bb1ad'

config device
        option type 'bridge'
        option name 'br-lan'
        list ports 'lan1'
        list ports 'lan2'

config bridge-vlan
        option device 'br-lan'
        option vlan '9'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan1:t'
        list ports 'lan2:u*'
	option vid '10'

config bridge-vlan
        option device 'br-lan'
        option vlan '11'
        list ports 'lan1:t'

config interface 'iot'
	option proto 'none'
	option device 'br-lan.11'
	option ipv6 '0'

config interface 'lan10'
	option proto 'static'
	option device 'br-lan.10'
	option ipaddr '192.168.10.253'
	option netmask '255.255.255.0'
	option gateway '192.168.10.254'
	list dns '192.168.10.254'
	list dns '1.1.1.1'
	list dns '8.8.8.8'
	list dns_search 'linux.pg'
	option ipv6 '1'
	option delegate '0'
	option ip6assign '64'

config device
	option type 'bridge'
	option name 'br_recovery'

config interface 'recovery'
	option proto 'static'
	option device 'br_recovery'
	option ipaddr '192.168.3.254'
	option netmask '255.255.255.0'
	option ipv6 '0'

config device
	option name 'lan2'

config interface 'guest'
	option proto 'none'
	option device 'br-lan.9'
	option ipv6 '0'

config interface 'Lan10v6'
	option proto 'dhcpv6'
	option device 'br-lan.10'
	option reqaddress 'try'
	option reqprefix 'auto'
	option norelease '1'
	option multipath 'off'
6

Yes, this looks much better! Glad that it is working now.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile: