Eap_proxy, VLANs, and wired guest networks


I want to setup a WRT3200ACM router for:

  1. WAN pass-thru from the fiber ONT to the AT&T provided Arris BGW210 using eap_proxy.

  2. Two additional wired 192.168.x.0/24 networks for the apartments wholly separate from the main LAN.

  3. running SNORT on, at least, one of the apartment networks.

This is what I have so far on the VLANs

LAN1 (eth0.1) will be the main LAN in my home
LAN2 (eth0.3) will be the pass-thru to the Arris for eap_proxy
LAN3 (eth0.4) will be for the first apartment
LAN4 (eth0.5) will be for the second apartment

This is what I started for the interfaces, but I'm confused how IPv6 should be working for grabbing a /64 for each of the three LANs

I just plugged-in a Linksys gigabit adapter USB3GIGV1 along with installing kmod-usb-net-rtl8152 and I get a new eth2 port :slight_smile: This makes me wonder if I get a USB3 powered hub and keep adding adapters I might be able to share my fiber Internet with the entire apartment complex giving them each their own 192.168.x.0/24?

root@OpenWrt:/# ethtool eth2
Settings for eth2:
        Supported ports: [ TP MII ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Half 1000baseT/Full
        Supported pause frame use: No
        Supports auto-negotiation: Yes
        Supported FEC modes: Not reported
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Advertised pause frame use: Symmetric Receive-only
        Advertised auto-negotiation: Yes
        Advertised FEC modes: Not reported
        Link partner advertised link modes:  10baseT/Half 10baseT/Full
                                             100baseT/Half 100baseT/Full
        Link partner advertised pause frame use: Symmetric Receive-only
        Link partner advertised auto-negotiation: Yes
        Link partner advertised FEC modes: Not reported
        Speed: 100Mb/s
        Duplex: Full
        Port: MII
        PHYAD: 32
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: pumbg
        Wake-on: g
        Current message level: 0x00007fff (32767)
                               drv probe link timer ifdown ifup rx_err tx_err tx_queued intr tx_done rx_status pktdata hw wol
        Link detected: no

I decided to use with goeap_proxy for getting true bridge-mode with AT&T fiber. I enjoyed having to figure out how to use the OpenWRT SDK for building ipk modules. I like how the source for goeap_proxy is an OpenWRT feed, as well as setting itself as a service. The cross-compiling SDK for the WRT3200ACM was, of course, this one.

A few /etc/config/networks tweaks and I'll give it a try later today. The requirement for the wan interface being on VLAN 0 confuses me as the WAN port itself is already VLAN'd to eth1.2

The ISP has delegated you a /64 only, which is very lame of them. Usually for residential customers a /56 or /48 is allocated, so multiple lans can get their own /64 prefix.
Also make sure you have wan6 assigned to wan firewall zone.

1 Like

Actually, no delegation. It's blank. This is part of the screenshot from the Home Network Status page of the BGW210. Although I found you can do multiple DHCPv6-PD requests to get multiple /64 blocks from the LAN side, so I might have to go this way for the multiple private subnets. it was handing me 2600::**::10cf::/64 while testing the WRT on the LAN

Yes, you could even daisy chain hubs, it's not like you need the bandwidth concurrently...
... or you could use a VLAN capable switch - there's plenty costing less than $100 (cheaper per port and you might be able to use some of the ports for a couple of cameras or wifi APs.


If your ISP can give you more than one /64, odhcpd + nd-relay should be able to cause your router to request a /64 for each one of the downstream devices, making it appear as if your router is just a dumb switch to the upstream

1 Like

Well, it looks like I screwed the pooch. I complained heavily to AT&T tech support about the lack of a provisioned delegated prefix and the best they could offer was to try newer equipment. The new BGW320 uses an SPF module over flex fiber to the new ONT wall plate. Now I can't put my WRT in the middle to proxy certificate exchange. Now I'm daydreaming of going back to Comcast for a simple bridged modem interface