The Setup
There are VLAN's involved. The AP's and switches are all accessible on VLAN_4 - "iot". While computers, phones and such are all on VLAN_2 - "house".
On the AP
I'm using the Networking => Switch LuCi page to enumerate the VLAN's, a Wireless Mesh on Radio0, and a GRETAP tunnel to allow the VLANS on my network to continue over the air to another AP where I hope to connect more computers. The AP that I'm testing with is the start of the bridge and it has wired access to my home network, and subsequently the internet.
Currently there is one firewall zone defined, and the AP interface is assigned to that zone, which is in turn connected to a bridge, which links together eth0.4, @GreT.4, and the WiFi Mesh (which the GRETAP tunnel runs through).
The GRETAP tunnel, and the "house" interface are not assigned to a firewall zone. The "house" interface is connected to a bridge which links together eth0.2, @GerT.2, and the WiFi network on Radio1.
I tried to sanitize everything, and use generic names. If there is a weird typo here and there it's probably due to my editing.
ubus call system board
{
"kernel": "5.15.150",
"hostname": "FastJack3",
"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
"model": "Ubiquiti UniFi AC Pro",
"board_name": "ubnt,unifiac-pro",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.3",
"revision": "r23809-234f1a2efa",
"target": "ath79/generic",
"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
}
}
/etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd46:5992:0a24::/48'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option vid '999'
option description 'blackhole'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '4'
option ports '0t 2t 3'
option description 'iot'
config switch_vlan
option device 'switch0'
option vlan '3'
option vid '2'
option ports '0t 2t'
option description 'house'
config switch_vlan
option device 'switch0'
option vlan '4'
option vid '5'
option ports '0t 2t'
option description 'servers'
config switch_vlan
option device 'switch0'
option vlan '5'
option vid '3'
option ports '0t 2t'
option description 'guest'
config switch_vlan
option device 'switch0'
option vlan '6'
option ports '0t 2t'
option vid '1'
option description 'whispers'
config interface 'iot'
option proto 'static'
option device 'br-4'
option ipaddr '10.42.40.3'
option netmask '255.255.255.0'
option gateway '10.42.40.1'
list dns '10.42.40.1'
option type 'bridge'
config device
option type 'bridge'
option name 'br-2'
option bridge_empty '1'
list ports 'eth0.2'
list ports '@GreT.2'
config device
option type 'bridge'
option name 'br-4'
list ports 'eth0.4'
list ports '@GreT.4'
config interface 'GreT'
option proto 'gretap'
option force_link '1'
option peeraddr '10.42.40.4'
option tunlink 'iot'
option df '0'
option defaultroute '0'
config interface 'house'
option proto 'static'
option device 'br-2'
option ipaddr '10.42.42.3'
option netmask '255.255.255.0'
option gateway '10.42.42.1'
option defaultroute '0'
list dns '10.42.42.1'
config device
option type 'bridge'
option name 'br-5'
list ports 'eth0.5'
list ports '@GreT.5'
option bridge_empty '1'
config device
option type 'bridge'
option name 'br-3'
list ports 'eth0.3'
list ports '@GreT.3'
option bridge_empty '1'
config device
option type 'bridge'
option name 'br-1'
list ports 'eth0.1'
list ports '@GreT.1'
option bridge_empty '1'
/etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option channel '40'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option channel '4'
option band '2g'
option htmode 'HT20'
option cell_density '0'
config wifi-iface 'wifinet0'
option device 'radio0'
option mode 'mesh'
option encryption 'sae'
option mesh_id 'FJ-MESH'
option mesh_fwding '1'
option mesh_rssi_threshold '0'
option key 'SUPER_TOP_SECRET'
option network 'iot'
config wifi-iface 'wifinet1'
option device 'radio1'
option mode 'ap'
option ssid 'dentest'
option encryption 'psk2'
option key 'TOP_SECRET'
option ieee80211r '1'
option mobility_domain '28fa'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option network 'house'
Apparently I have barely touched the dhcp section. So this likely needs a lot of work
/etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
Out of desperation I set the firewall on the AP to accept everything, I'll put it back after I fix the problem:
/etc/config/firewall
config defaults
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option synflood_protect '1'
config zone
option name 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'iot'
Would you like to see the configs from my home router?