Thanks.
We've still got a few problems, but we'll correct those as we go.
Meanwhile, I'm going to make some assumptions here. Please feel free to adapt the configs if these aren't consistent with your topology and/or if you need help doing that, tell me what your topology looks like in terms of the ports and their functions.
I'm going to assume that:
- eth1 and lan1 are used for the lan.
- lan2 is available to be used as a 'test' port for sanity checking the new VLAN
- lan3 connects to the managed switch.
We will add the guest network (10.1.99.0/24), so you'll have 2 networks - lan and guest (not counting the tailscale and docker).
Starting with the network config...
Delete the vlan_filtering line below:
Add bridge VLANs:
config bridge_vlan
option device 'br-lan'
option vlan '1'
list ports 'eth1:u*'
list ports 'lan1:u*'
list ports 'lan3:u*'
config bridge_vlan
option device 'br-lan'
option vlan '99'
list ports 'lan2:u*'
list ports 'lan3:t'
Edit the lan interface to use br-lan.1:
config interface 'lan'
option device 'br-lan.1'
option proto 'static'
option ipaddr '192.168.0.1'
option netmask '255.255.255.0'
option ip6assign '60'
Add the guest network with device br-lan.99:
config interface 'guest'
option device 'br-lan.99'
option proto 'static'
option ipaddr '10.1.99.1'
option netmask '255.255.255.0'
Delete this (it overlaps the lan and is thus invalid):
Now we'll move onto the dhcp file:
Delete the list interface lines in this section:
Remove the force line below:
Add a new DHCP server for the guest network:
config dhcp 'guest'
option interface 'guest'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
Now, onto the firewall file:
Create a new zone. This will reject input to the router, so we also need rules for DHCP and DNS. Additionally, we'll allow internet access, but nothing else. It'll all look like this:
config zone
option name 'guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'guest'
config rule
option src 'guest'
option name 'Allow-guest-DHCP'
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'
config rule
option src 'guest'
option name 'Allow-guest-DNS'
option dest_port '53'
option target 'ACCEPT'
config forwarding
option src 'guest'
option dest 'wan'
Reboot the router after making these changes.
Now, you can plug a computer into port lan1 and get an address on the main lan (192.168.0.0/24). Move that computer to port lan2 and you'll join the guest network (10.1.99.0/24) and it will have internet access, but no access to the lan (and currently vice versa).
Finally, your managed switch, connected to lan3, needs to be configured as a trunk on its corresponding port. That should expect VLAN 1 untagged and VLAN 99 tagged.
My recommendation is to setup the switch like this (again assuming this works for you, at least temporarily for testing):
- port 1: uplink/trunk (VLAN 1 untagged+PVID, VLAN 99 tagged)
- port 2: access port for lan (VLAN 1 untagged + PVID)
- port 3: access port for guest (VLAN 99 untagged + PVID)
Now, plug your computer into port 2 and make sure it joins the lan (192.168.0.0/24). Then move it to port 3 and test that it joins the guest network (10.1.99.0/24).
You'll know that everything is working as expected if the above tests work. From there, you can follow a similar recipe and/or reassign ports to build out the other VLANs.
If anything fails, please report that here along with the update config. (you're also welcome to post the config for general review, of course).
Also, keep in mind that the specific configuration of your managed switch is out of scope for this forum as it is not OpenWrt. We'll try to provide general help, but if you need more detailed config assistance, please reach out to the vendor's support channels or their user forums.
