First time DSA setup, VLAN DHCP not working

martindholmes · October 10, 2024, 7:59pm

Hi all,

I'm setting up a new GL-iNet Flint 2 router with OpenWrt 23 (latest stable), trying to reproduce a setup I have running on an Archer C7, and it's my first time using a DSA router. I've got as far as defining VLANs (LAN, IOT and Guest), and I've assigned one of the LAN ports as a trunk (to go to a second router), one as an IOT-only port, and the other three as LAN. When I connect a host to any of the LAN ports, I get assigned an IP in the LAN DHCP range (192.168.0.x), but when I connect to the IOT port, I don't get one in the intended range (192.168.3.x); in fact, I don't get an IP at all. The router shows something as being connected to the port, but it doesn't show a host as having a session. I must be missing something obvious -- can anyone see what it is? Config files are below. There's no wifi set up at all so far; I'm just trying to get the wired stuff working first.

network:
-----------------

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdcb:5812:bc38::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'lan5'

config device
	option name 'lan1'
	option macaddr '94:83:c4:a3:51:74'

config device
	option name 'lan2'
	option macaddr '94:83:c4:a3:51:74'

config device
	option name 'lan3'
	option macaddr '94:83:c4:a3:51:74'

config device
	option name 'lan4'
	option macaddr '94:83:c4:a3:51:74'

config device
	option name 'lan5'
	option macaddr '94:83:c4:a3:51:74'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.0.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'eth1'
	option macaddr '94:83:c4:a3:51:72'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1:t'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '3'
	list ports 'lan1:t'
	list ports 'lan5:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '4'
	list ports 'lan1:t'

config interface 'IOT'
	option proto 'static'
	option device 'br-lan.3'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

config interface 'Guest'
	option proto 'static'
	option device 'br-lan.4'
	option ipaddr '192.168.4.1'
	option netmask '255.255.255.0
-----------------

dhcp:
---------------
config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'IOT'
	option interface 'IOT'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'Guest'
	option interface 'Guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
-------------

firewall:

------------

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'IOTZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'IOT'

config zone
	option name 'GuestZone'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Guest'

config forwarding
	option src 'lan'
	option dest 'IOTZone'
-------------

brada4 · October 10, 2024, 8:13pm

iotzone is set to reject input ie dhcp requests from clients.

martindholmes · October 10, 2024, 9:07pm

Doh! Thanks indeed -- I'm sure that's it, and I'll try it as soon as I get home.

brada4 · October 10, 2024, 10:06pm

Ill look more in detail if that is not the one.

martindholmes · October 10, 2024, 11:21pm

I do remember removing the firewall zone completely from that VLAN, and it still didn't work, but it's possible there's something else happening. I'll report back in a bit.

martindholmes · October 11, 2024, 3:22am

That was absolutely it. Thanks indeed. I was staring at that screen for ages and just didn't see what was right in front of me.

BabaBlackship-Da · October 12, 2024, 2:15am

Can you pl let me know what you did?? I have same issue - guest vlan is not getting up address from wired router. I am trying to create vlan over mesh using gre tunnel between two dumb access points. Followed Marc’s video… can’t get to make the guest vlan get up from the wired router… tha ks

psherman · October 12, 2024, 2:19am

@BabaBlackship-Da - please create a new thread for your issue. I suspect the solution for you will be a bit different, and a dedicated thread will help keep the discussion focused and reduce the likelihood of any confusion.

BabaBlackship-Da · October 12, 2024, 2:46am

Thanks - will do

martindholmes · October 12, 2024, 4:39am

When you do, I'm happy to detail what I've set up. I'm going slowly through the setup process for new routers with 23.05, which is new to me, and so far I have the main router and the dumb AP working with my three VLANs, wired only. Next I have the wifi to do. When I've got that working, I'll document it all for myself with lots of screenshots, which I'll be happy to share. I'm still working through luci, but my goal with this setup is to get more familiar with the config files as well.

system · October 22, 2024, 4:40am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.