DSA VLANs on R6S and TP Link EAP670

Installing and Using OpenWrt
1

I’d appreciate some advice on debugging an odd DSA VLAN issue please.

The router is FrendlyElec R6S with OpenWRT 24.10.3 to configure two VLANS via DSA. I’ve tried a couple of options and I’m getting odd results.

eth0 (1G) and eth2(2.5G) are in a bridge together. I have a single EAP670 connected to eth2. Goal is two VLANs only to the eth2 port.. I’ve tried two options via DSA:

#1: In this config I can reach the router via VLAN99 on eth2. VLAN1: eth2 and eth0 becomes unresponsive. No traffic is presented from the router.

eth0: VLAN1 U*
eth2: VLAN1 U*, VLAN99 T

#2: No traffic from the router on any VLAN or port. Only able to access via Wireguard on the WAN interface.

eth0: U*
eth2: VLAN1 T, VLAN99 T

I suspect I have more than one issue here. The kernel log indicates that VLAN filtering has been enabled on eth0. 8021q: adding VLAN 0 to HW filter on device eth0 There is a known bug with the GMAC on the R6S’ SoC that might be preventing the VLAN filter from working on eth0, only. Technically, since no VLAN filtering is being done per the DSA configuration, eth0 shouldn’t be placed in filtering mode.

eth2 however shouldn’t have any problems at all setting up a VLAN filter as they are connected via PCIe and therefore do not use the SoC’s GMAC. Since I was able to connect via VLAN 99, it would seem that it is “working” to some extent.

Where should I begin debugging this issue. I’ve done plenty of DSA VLANs on other OpenWRT devices and EAP225 so I’m pretty confident that the configuration should work.

Is is possible to take eth0, eth2 out of the bridge, build vlans directly on eth2 and then bridge eth0 and eth2.1 together? Is there a way to exclude eth0 from DSA’s “bad touch”?

TIA, Mike

2

The best way to approach this is to directly evaluate the config files:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
3

I totally agree. Do you have any suggestions on how to get them? I’d normally SSH but with the interfaces down that’s an issue. The WireGuard tunnel is not able to SSH to the router when the ports are unresponsive. Is the shell accessible via serial? I’d have to disassemble the case and solder a header in to access it but if that’s what it take, I’ll do it.

MIke

4

You can use serial, or failsafe (be sure to mount_root after entering failsafe mode).

1 Like