Hi all,
First of all, please excuse my ignorance on the matter. I know what I would like to achieve but I do lack the expertise to set it up the way I would like things to work. I did read several similar instructions to what I would like to achieve and I may have missed the perfect one. If you can point me to it, that will be very much appreciated. Here is what I would like to achieve:
I would like to have a separate ESSID for the IoT devices that operates under VLAN 80 to isolate them from the rest of my LAN.
Here is what I was able to achieve so far:
- I have a UniFi Edge Router as the firewall, router and VLAN assigner. VLANs 60 and 70 are already assigned to workstations and media PCs, and are working as intended. All of the above have wired connections to the switch below.
- A Cisco switch directly attached to the router on its port 1, which is marked as trunk, untagged for VLAN 1 and tagged for VLANs 60, 70 and 80. Port 3 is assigned to a workstation, and is marked untagged for VLAN 60, whereas ports 5 and 6 are assigned to media PCs and are marked untagged for VLAN 70. Port 4 is what connects this switch to the Belkin RT3200, which runs the most recent stable version of OpenWRT (22.03) and is set up as a dumb AP without DHCP, firewall and dnsmasq as recommended in the relevant documentation/guide in the wiki.
- On Open WRT I have the following interfaces, which came by default:
- LAN (br-lan), WAN (br-wan), WAN6 (wan) with device names in parenthesis
- I created a new bridge device (br4IoT) that includes lan1-4 as bridge ports just like the br-lan. On the Bridge VLAN Filtering tab, I added VLANs 1 and 80 both marked as local and VLAN1 marked as untagged and as Primary VLAN on lan1, which is where the cable from switch port 4 is attached. VLAN80 is marked as tagged on lan1. Enable VLAN filtering check box is checked.
- I also created a new interface called LANIoT that uses static address (192.168.80.2/24) and br4IoT device.
- On Wireless page, I have 2 ESSIDs added per radio: LAN (LAN-N and LAN-AX) and IoT (IoT-N and IoT-AX).
- LAN is all with default settings and works flawlessly.
- IoT uses LANIoT as network as opposed to LAN
- I can see all four ESSIDs listed as wireless networks on my laptop, cell phone, etc. I can connect to LAN-N and LAN-AX as expected and without any problems. I can connect to IoT-N and IoT-AX as well, but I cannot get an IP via DHCP, although the DHCP server is set on the UniFi router and is enabled/available. I can get a static IP (e.g. 192.168.80.5) for my laptop if I choose to do so while connecting to the IoT-N/AX wireless network but with limited connectivity and cannot ping anything locally or on internet. On the other hand, while connected to LAN wireless network, I can ping 192.168.80.1 successfully so there is no firewall that blocks communication at least from LAN to VLAN 80.
I feel that I am very close but cannot achieve success. Any pointers will be very much appreciated!
Edit: I realized I can put my config files which may help. Here is /etc/config/network:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd11:1667:c459::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.1.3'
option gateway '192.168.1.1'
list dns '192.168.1.135'
list dns '192.168.1.133'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
option type 'bridge'
option auto '0'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option auto '0'
option reqaddress 'try'
option reqprefix 'auto'
config device
option type 'bridge'
option name 'br4IoT'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'LANIoT'
option device 'br4IoT'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.80.2'
option gateway '192.168.80.1'
config bridge-vlan
option device 'br4IoT'
option vlan '80'
list ports 'lan1:t'
config bridge-vlan
option device 'br4IoT'
option vlan '1'
list ports 'lan1:u*'
Here is /etc/config/wireless:
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/18000000.wmac'
option channel '1'
option band '2g'
option htmode 'HT20'
option country 'US'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option mode 'ap'
option encryption 'psk2'
option key '--redacted--'
option network 'lan'
option ssid 'LAN-N'
config wifi-device 'radio1'
option type 'mac80211'
option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel '36'
option band '5g'
option htmode 'HE80'
option country 'US'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option mode 'ap'
option encryption 'psk2'
option key '--redacted--'
option network 'lan'
option ssid 'LAN-AX'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option encryption 'psk2'
option key '--redacted--'
option ssid 'IoT-N'
option network 'LANIoT'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option encryption 'psk2'
option key '--redacted--'
option ssid 'IoT-AX'
option network 'LANIoT'