After configuring DSA Vlan, wired is working, wireless is not. Where am I going wrong? I have reviewed many posts on the forum and reddit but cannot find the missing piece.
Netgear WAX206 with OpenWrt 23.05.2. Trying to configure simple vlan setup to understand how vlans work on OpenWrt and expand later.
Here are the steps I followed using Luci:
Bridge device:
Went to Network > Interfaces > Devices.
Configure the bridge device br-lan.
Go to bridge vlan filtering tab.
Enable VLAN filter and add vlan 10.
Set all the ports (4) to untagged and enabled local.
Interface
Go to network > interfaces
Edit lan.
Set device to br-lan.10
Wireless
Go to Network > Wireless
Edit SSID
Network already set to LAN.
If I hover, I can see "Software VLAN br-lan.10".
If I save, the router automatically rolls back after x time (I love this feature btw, great to see this in OpenWrt) because my wireless device cannot reach the router. I know wired is working as I left ping running in tmux sessions on one of my wired servers.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
I also have this issue, for some reason some devices have trouble communicating on some wired LAN device under a VLAN, not all device have this issue since majority of them are working (eg it can connect to my NAS that is member of that VLAN) but all my IP cams and esp dev board are no dice.
I did managed to fix it by first, go to Devices tab, and add a new device, select bridge on the device type and choose the vlan id you want to attach that bridge to (in your case its br-lan.10) save the changes and apply, Now add or edit the interface you want that VLAN to get assigned to and make sure to choose the "Bridge" where the vlan 10 is attached to, do not choose the 802.1q vlan itself, after that hit save and apply.
I also need to go to my wireless SSID and remove the current SSID and readd it back. After that it works great, all devices can now communicate to that VLAN including the wired devices.
Unless you intend to add additional VLANs, I'm not sure what you're trying to achieve by adding VLAN10. But that said, you should explicitly designate each port's status -- in this case, add :u* to indicate that it is untagged + PVID:
config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'
I see several SSIDs -- do any of them work? What specifically happens when you try to connect? Does your computer get an IP address?
On this one, your guest network would have access to all of the wired devices on your lan, and they may also have access to wifi devices on the lan (via the other SSIDs), too. They just won't be able to reach another network on the same SSID. Therefore, your guest network should be an entirely different subnet if your goal is to isolate guest devices from your lan.
Plan is add few more segments and trunk the vlans to another switch. Are ports untagged implicitly? Typically you should not use PVID for security reasons.
I'm able to connect to the SSID but from what I can tell DHCP is failing which leads me to believe there is some plumbing missing for wireless > interface.
Guest network is non-goal at the moment, since east-west traffic is already blocked by guest mode.
It seems so, yes, but it is always best to be explicit here.
No, this is not a correct statement. PVID has nothing to do with security. It is a way of specifying the VLAN to which untagged traffic should be assigned. The ports, in this case, are already operating with untagged VLAN 10... PVID simply ensures that the ingress traffic is properly associated with the that VLAN. In some implementations (such as TP-Link, Netgear, and Ubiquiti EdgeOS), PVID is actually the way that you select the VLAN that will be untagged (in general) on a port.
There is no missing plumbing, AFAIK. I'm not seeing anything specific that would cause DHCP to fail.
I would recommend removing all the extra SSIDs -- just have one on each band associated with the lan.
What do you mean "east-west traffic" being blocked by guest mode? What guest mode are you talking about here?
You currently have 4 ssids, 2 on each band and using the same underlying network. Remove the guest ssids and see if that helps.
Nope, that is not how isolate works. It can only isolate clients from each other that are connected to the same ssid it does not isolate wired clients, for example, from the guest devices - they will still be able to reach each other. And I suspect that the guest devices will also be able to reach the non-guest WiFi clients, too.
Also, there's nothing wrong with VLAN 1. Again, the VLAN ID is not relevant to security. VLAN 1 is totally fine -- there is no inherent security risk using it. And there is nothing from a best practices perspective that suggests that VLAN 1 is problematic. While I'm sure you may be able to find some people who prefer not to use it and have various justifications for that opinion, this is by no means a universal or common concern.
Hi @gift5640 there seems to be a bug in either OpenWRT or Luci. I suspect it is not restarting the wireless interfaces/radios when re-configuring for VLAN filtering.
I was able to get this working by configuring an additional foobar SSID on each radio at the same time configuring the vlan filtering. Apply and save and it should be working then delete the additional SSID.
If I configured an additional SSID on the 2.4GHz radio only, then only the 2.4GHz SSID's would work.
Thanks for that info!
After further playing around, I observed that if I simply rebooted the device after setting the config, it worked.
Frustrating that a reboot is required though.
