Extending IOT VLAN to dumb APs

Hey all,

I know this has been discussed several times in other places, but it seems that config has slightly changed, so none of the tutorials online seem to fit exactly anymore. Anyways, this is complicated and I have a hard time wrapping my head around this.

Would be very grateful if someone could help me set this up:

Here is my setup and what I am aiming to do:

  • GUEST should be able to access the internet but nothing else
  • IOT should be accessible from LAN
  • Host (HASS) in IOT should be able to access all other Hosts in IOT, the other hosts should be able to communicate via mqtt and a specific port (1883) at Host HASS
  • IOT should not be able to access anything else (WAN, LAN, GUEST)

Questions:

  • Do I need to create VLANs or could the same be done with IOT as a "guest network"? apparently - answered by @psherman below

  • How would my config need to look like (see current config below)?

  • I have a fairly complex home network that looks like this:

                       +------------+                              +----------+                                              
                       | Router 1   |                              | Router 2 | 192.168.1.1                                  
                       |            +------------------------------|          |                                              
-----------------------+            |                              |          |                                              
                       +----+-------+                              ++---------+                                              
                            |                                       |                                                        
                            |                                       |                                                        
                            |                                       |                                          +----------+  
                       +---------------------------+                |         +--------------------------------| Dumb AP  |  
                       ||Server   |           DMZ  |                |         |                                |          |  
                       ||         |                |                |         |                                +----------+  
                       |+---------+                |              +-----------++                                             
                       |                           |              | Switch     |                               +----------+  
                       |                           |              | managed    +-------------------------------| Dumb AP  |  
                       |                           |              |            |                               |          |  
                       |                           |              +-----------++                               +----------+  
                       +---------------------------+                          |                                 +-----------+
                                                                              +---------------------------------| Dumb AP   |
                                                                                                                |           |
                                                                                                                +-----------+

Here comes my current /etc/config/network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd93:6410:07a0::/48'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ip6ifaceid 'eui64'
	option ip6addr 'fe80::1'

config interface 'wan'
	option device 'eth2'
	option proto 'dhcp'
	option hostname 'turris'
	option ipv6 '1'

config interface 'guest_turris'
	option enabled '1'
	option proto 'static'
	option device 'br-guest-turris'
	option ipaddr '10.111.222.1'
	option netmask '255.255.255.0'
	option ip6assign '64'

config device 'br_guest_turris'
	option name 'br-guest-turris'
	option type 'bridge'
	option bridge_empty '1'

config device 'br_lan'
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan0'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'wan6'
	option device '@wan'
	option proto 'dhcpv6'

config device 'dev_wan'
	option name 'eth2'

config interface 'wg0'
	option proto 'wireguard'
	option listen_port '51820'
	list addresses '10.10.10.1/24'
	option private_key 'redacted'
	list dns '1.1.1.1'
	list dns '8.8.8.8'

config wireguard_wg0
	option description 'phone'
	option persistent_keepalive '25'
	option route_allowed_ips '1'
	list allowed_ips '10.10.10.2/32'
	option public_key 'redacted'
	option private_key 'redacted'

config device
	option bridge_empty '1'
	option type 'bridge'
	option name 'br-iot'

config interface 'iot'
	option device 'br-iot'
	option proto 'static'
	option ipaddr '10.0.0.1'
	option netmask '255.255.255.0'
  • If I understand correctly, I need to 'tag' the traffic on the respective LAN port (i.e. lan4) and then configure the dumb APs and the router to tag packets according to interface?

Thanks a lot for your help - happy to provide more detail on network etc.

the questions I ask you is:

  1. is the switch present management (is it possible to create vlans on it)?

  2. is the posting configuration on router 1 or on router 2 ?

  3. do you think you have only one main router and all the others will be configured as dump-AP and are connected via ethernet to router 1 ?

Hey there,

thanks for asking (sorry, I thought the graphic would be clearer):

  1. Switch is managed!
  2. on Router 2, Router 1 is only modem-functionality.
  3. correct: one main router (Router 2), all dumb APs connected via ethernet (and the unmanaged switch) to Router 2

if the switch is not managed can you think of replacing it?

How many ethernet ports does the switch have? (if there are few it is better to convert an old router on which to install openwrt and transform it into a managed switch)


the biggest problem is that non-managed switches have an anomalous behavior with mixed ethernet frames (tagged and not)

example:

Forget what I said, the switch is managed! It is a Netgear GS308e

ok

then the first step is the creation of the vlans on the switch and on router2 (I recommend you to have only tagged traffic between the switch and router 2 and between the switch and the dump-aps)

ps: be careful you may find that you no longer have access to router 2 (in this example I created vlans for the three required zones)

show:

example:
vlan 10 = lan
vlan 20 = iot
vlan 30 = guest

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan4:t'

config interface 'lan'
        option proto 'static'
        option device 'br-lan.10'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'

config interface 'iot'
        option proto 'static'
        option device 'br-lan.20'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config interface 'guest'
        option proto 'static'
        option device 'br-lan.30'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'
1 Like

So, basically everything runs through the lan device, but then separated into VLANs?

What should happen to my guest and iot bridge devices?

I am not sure I want to lock myself out just right now so I think I will browse some more tutorials for that..

traffic passes through the relevant VLAN towards router 2

show:
https://openwrt.org/docs/guide-user/network/dsa/dsa-mini-tutorial#multiple_networks_using_vlan_tagging


for this I linked you how you can enable the vlans without locking yourself out of the router

alternatively if the router2 has a usb port you could connect a usb ethernet adapter and configure an administration interface ...

example:
"TP-Link UE306" - kernel module: ax88179_178a
/etc/config/network

config interface 'usblan'
        option proto 'static'
        option device 'eth1'
        option ipaddr '192.168.50.1'
        option netmask '255.255.255.0'

/etc/config/firewall

config zone
        option name 'usblan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'usblan'

config forwarding
        option src 'lan'
        option dest 'usblan'

config forwarding
        option src 'usblan'
        option dest 'lan'

Hmm, if I understand you correctly, you may want to try - Guest network on Dumb AP. The guest network on the Dumb Ap will not have access to lan, but will have access to internet. If my understanding is correct than you may try this: https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guestwifi_dumbap#step_3aset_up_the_firewall_zone
You need to leave firewall and dnsmasq "on".
Kr
K

I assume the author of the post actually wants to create vlans

show:

1 Like

Yes I saw that, but I also noticed he is affraid of locking himself out.
Just a different approach- If I understood his/her case scenario correctly.

for this reason I warned him and proceeded to give him the solution on how not to lock himself out initially once he has created the vlans on router 2 and on the switch

Ok sorry- shell I delete my posts, if it is affecting you in a way?

it doesn't bother me at all it's a free forum,

from my point of view all the ideas are good :grinning:

the vlans will give more control over the network that the author of the post wants to create :grinning:

1 Like

I am on another opinion to be frank- vlans are very static. You dedicate a particular port and if you forget about that after a while, and you make changes to your router setup/infrastructure, you may spend hours investigating why it is not working- well at least that's what happend to me :slight_smile:
Anyway- I need to admit that I was considering not to answer with my sugestion as it is out of topic, but felt obligated to do so, if OP is not aware of other options.
Kr
K

1 Like

the choice is up to the author of the post...

1 Like

Hey there, thank you for the input. Looking at the documentation got me thinking and I assume that a guest network on ALL dumb APs could potentially suit my needs.

How exactly does that differ from a VLAN?

One potential problem: I want a separate VLAN/guest network to isolate my IOT devices. They are all managed via Home Assistant, which needs to talk to all of the devices. So, there are two options:

  1. Keep Home Assistant on my Lan network and allow communication to the devices in the guest network
  2. Put Home Assistant in the guest network and somehow allow it to communicate with the other devices (not sure if that is even possible?)..

would this work?

This would be a bad setup - problematic for guest devices roaming between APs, harder to administer, and just generally inefficient and inelegant.

Your main router should be tasked with all the routing and firewall functions, sending those networks over Ethernet (using VLANs) to the APs which then only need to bridge the VLANs to WiFi ssids. If you do setup guest networks on each ap separately, there are no VLANs involved and you basically have a bunch of isolated islands.

Hey, thanks. That is really helpful.

So what would be the next steps? I assume setting up VLANs on my main router? Somehow I still find this hard to process/implement...

Any chance someone could help out based on the config above - happy to share additional info.

Well @mor3dr3ad do you really need it to ALL dumb APs or just one which can reach all IoT devices?
@psherman I agree. However I have similar setup. Home Assistant sever and 2 dumb APs. In my setup the leading factor is HA. I let all IoT devices which do not need internet to connect my lan/wifi lan and I block their access to internet via traffic rules in firewall and still they can access my HA server . All other IoT devices (which needs internet to synch with HA) connects to the dumb AP guest network, where I isolated them and also reduced the bandwidth with SQM.
I have tried it with VLAN and it was harder for me to set it up (actually you helped me - thanks for it), and also harder to sustain a network change, if I forget about the ports in question.
I am giving my 5 cents, but I fully trust @psherman expertise. It is just easier for me.