Dumb AP accessible on both Vlan A and Vlan B?

Sat Dec 21 16:16:49 2024 daemon.warn dnsmasq-dhcp[1]: not giving name E8450Hall.lan to the DHCP lease of 192.168.87.175 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 192.168.86.245
Sat Dec 21 16:16:49 2024 daemon.warn dnsmasq-dhcp[1]: not giving name E8450Hall to the DHCP lease of 192.168.87.175 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 192.168.86.245

I found this in the syslog. I want the dumb AP to be accessible only on 192.168.86.245. I have clearly mentioned this in my infinite static DHCP leases. However, 192.168.87.175 is assigned to the same Dumb AP and it is accessible on the guest network.

I have 2 Linksys E8450 and running latest openwrt stable.

Complete Settings below.

Main Router Network:

https://paste.passtheheadphones.me/?7863792738fcf5e3#GQcoY6zSZgt9SBBn9nPtN8zWn36MGmnRWKqfQYGfpZx8

Main Router Firewall:

https://paste.passtheheadphones.me/?e2bdeb611083e7f9#5dq6TZCnv9sCiAb11uV2SCjvTXHFq7VRFEqhtGKpuKtc

Dumb AP Network:

https://paste.passtheheadphones.me/?f809fbca4d41c241#FCzN126SnSNUAeE2qaswHiwpGAB93AFxDCAeyFN1qWr9

Dumb AP Firewall:

https://paste.passtheheadphones.me/?c9d31a9656db24fb#6XK2Vqz81xvbVRXEcwCmRA5ZbCbjoDb5LkREZfbHMHq4

How to fix this?

If you allow input on the firewall zones, that is normal and expected behavior. For a solution, see:

I'm guessing your dumb AP has two interfaces, one for your vlan A and one for your vlan B.

Leave one interface "as is" (meaning: of "Protocol: Static address") and change the other one to "Protocol: None".

Go to firwall settings and make sure the vlan you don't want the AP to be able to accessed through to have a firewall zoned assigned.

Go to the DHCP tab and make your dumb AP not serve as DHCP server.

Can you please tell me what is wrong here?

This is on my dumb AP. I have both guest and lan to not serve DHCP. It was always disabled on this page.

Your screenshot does not show whether or not your guest network gets provided with IP addresses from your dumb AP as well or not. Even though I don't think it makes much sense, you can have both, an interface to have its IP address assigned via DHCP and give out other IP addresses on the same interface at the same time.

But your screenshot shows:

  • You have a WAN interface, which is something you don't need on a dumb AP. Even if that is unrelated to the issue you mentioned.
  • You have your guest network as DHCP client. Which is not something you need either, just put that guest network to "none".

I am sorry, does this show that it is disabled?

and there is no protocol called "none"

Too confusing for me.

You say it's a dumb AP but you don't appear to be using bridges for lan or guest, so how are you getting any kind of wireless connecting through to any ethernet ?

Basically you have two options:

  1. You have br-lan already, and you're using that to do vlan filtering on ports it looks like. You should probably make a bridge underneath ** like br-dsa or br-switch, do the filtering off that. Then you have br-lan assinged to lan and have br-dsa.99 as a member. For the guest the same method, you make br-guest it's assigned to guest and have br-dsa.4 as member. It sounds like you might also want to change the connection type for guest to 'unmanaged'. **This style doesn't always work with some devices though so while playing around with this perhaps be careful and keep a way to access the device going with a usb adapter or something.

  2. You stop using the bridge filtering where you've made the vlans off the br-lan bridge, you just have br-lan assigned to lan and br-guest assigned to guest and put whatever ports in them how they go. Eg if br-lan has lan1 and lan4.99 and br-guest has lan2 and lan4.4 etc etc and do it that way instead and again for guest I don't know exactly what you're trying to do but you might need to set the connection type to unmanaged.

Hi @psherman ! Long ago, you had helped me with an issue on OpenWrt and I am grateful for it. Currently, I have hit up another snag. I am no OpenWrt expert, and I code in python for a living. It would be great if you could help me get this sorted, thank you so much either ways!

Its too confusing for me as well. Can I just share my settings so you could tell me what's going on?

And please tell me where to access the settings file after ssh into the main router or dumb AP.

I set up vlans seeing this channel -- https://www.youtube.com/c/OneMarcFifty

It's late here and my bedtime, hopefully one of the guys that are very good with this step in soon. Posting your configs isn't a bad idea though and it probably one of the first things they'll ask you to do anyway.

Can you please tell me where are the configs located?

cat /etc/config/network
cat /etc/config/firewall

there's also the wireless but it's probably not necessary and I wouldn't be posting that yet

be careful not to reveal anything you don't want revealed though when you're cutting and pasting

1 Like

You need to explain your use case and verify that I described the issue correctly:

I assume you're testing from SRC LAN (192.168.86.0/24) to DST network Guest IP (DST 192.168.87.175) - and you're concerned it's working, correct?

If so, nothing is wrong. See above.

EDIT:

(I may have reversed the subnets, but the same principle applies.)

Ah yes, "unmanaged". That's the one. This makes this interface not have a local IP address at all.

Hi @lleachii ! In a very humble tone, kindly please try to understand I am a python dev and unable to understand the network engineer level technicals you are saying. I have updated my main post with entire settings. So kindly please explain in simple terms or tell me which settings to change.

My Problem:
I want my dumb AP to be ONLY accessed on the main VLAN which is 192.168.86.0. However, 192.168.87.175 is assigned to the Dumb AP, and it is accessible on the guest network. So right now, its accessed on both main VLAN and guest VLAN with different internal ipv4. So people on the guest network can view the router page. I simply don't want this for many reasons which I am not listing here.

Expected solution:

  1. Dumb AP accessed only on the main VLAN which is 192.168.86.0
  2. Additionally, I want guest network to give out DHCP in 192.168.87.0 range. I want this functionality. It's only that I don't want the dumb AP here.