Guest Network for IOT Devices

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi there

I heard that it is recommended to have IoT devices on a different subnet, so that's what I want to achieve with your help.

My Network just so you can imagine my setup a little bit better:

Network_Topology
Network_Topology1256×1572 82.3 KB

What I did so far:
Router:

  1. Created Guest Interface, guest firewall zone and enabled DHCP server:
    /etc/config/network
config interface 'IoT'                                  
        option proto 'static'                                           
        option ipaddr '10.210.11.1'                                      
        option netmask '255.255.255.0'                                     
        option device 'br-IoT'                                        
                                                                        
config device                                                            
        option name 'br-IoT'                                             
        option type 'bridge'                      
        list ports 'eth0.2'                                             
        option igmp_snooping '1'                                           
        option promisc '1'                                                 
        option multicast_querier '0'

/etc/config/firewall

config zone                       
        option name 'IoT'            
        option output 'ACCEPT'        
        list network 'IoT'            
        option input 'REJECT'                
        option forward 'REJECT'         
                                      
config forwarding                   
        option src 'IoT'                  
        option dest 'wan'              
                                             
config forwarding                   
        option src 'lan'         
        option dest 'IoT'            
                                        
config rule 'IoT_dns'               
        option name 'Allow-DNS-IoT' 
        option src 'IoT'              
        option dest_port '53'      
        option proto 'tcp udp'                  
        option target 'ACCEPT'         
                                      
config rule 'IoT_dhcp'     
        option name 'Allow-DHCP-IoT'      
        option src 'IoT'                      
        option src_port '68'                   
        option dest_port '67'                
        option proto 'udp'                      
        option family 'ipv4'                
        option target 'ACCEPT'

/etc/config/dhcp

config dhcp 'IoT'                     
        option interface 'IoT'        
        option start '100'            
        option limit '150'            
        option leasetime '12h'        
        list dhcp_option '6,10.210.11.1'
        list dhcp_option '3,10.210.11.1'
        list ra_flags 'none'

On AP Downstairs:

  1. Tag the right ports with VLAN ID 2, create IoT-Interface and configure Wifi:

/etc/config/network

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 1 2 3 4 5 6'
        option vid '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option description 'IoT'
        option ports '0t 2t 5t'

config interface 'IoT'  
        option proto 'dhcp'
        option device 'br-IoT'  

config device
        option name 'br-IoT'  
        option type 'bridge'
        list ports 'eth0.2'

/etc/config/wireless

config wifi-device 'radio1'
        option type 'mac80211'
        option hwmode '11g'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option htmode 'HT20'
        option rts '784'
        option channel '11'
        option beacon_int '500'
        option cell_density '0'
        option txpower '24'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option key 'xxxxxxxxxx'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'
        option ieee80211r '1'
        option dtim_period '1'
        option ssid 'xxxxxxxxxxxxxxx'
        option nasid '123D'
        option encryption 'psk2+ccmp'
        option network 'IoT'

~

And on the other AP upstairs:

  1. Same as with AP downstairs, exept other ports

/etc/config/network

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 1 2 3 4 5 6'
        option vid '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 5t'
        option vid '2'

config interface 'IoT'
        option proto 'dhcp'
        option device 'br-IoT'

config device
        option name 'br-IoT'
        option type 'bridge'
        list ports 'eth0.2'

/etc/config/wireless

config wifi-device 'radio1'
        option type 'mac80211'
        option hwmode '11g'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option htmode 'HT20'
        option channel '6'
        option rts '784'
        option beacon_int '500'
        option cell_density '0'
        option txpower '24'
        option disabled '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option key 'xxxxxxxxx'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'
        option ieee80211r '1'
        option dtim_period '1'
        option ssid 'xxxxxxxx'
        option nasid '123D'
        option encryption 'psk2+ccmp'
        option network 'IoT'

Only thing that doesn't work so far is the DNS server. I'm using Adguardhome as DNS server and I do not know how to send my requests from my subnet to it.

I would also appreciate if you could sanity check my settings, if there are any mistakes etc. Thank you in advance!

2

I would highly reccomend OneMarcFifity's channell if you wish to do this through Luci. His videos explain the basic principles quite well. Although if you wish to use CLI this won't be very useful. This video, I think, covers your topic mostly, but the rest of the playlist is also very good.

1 Like
3

Thank you for the video! I got everything working now, but would prefer if somebody could sanity-check my updated settings below. Just one more question, if I want to access my smart switches etc. from my main LAN (HomeAssistan) do I only need a mDNS over both networks or something more? (I used this thread and tutorial for setting up mDNS)

Router:
/etc/config/network

config interface 'IoT'                                                  
        option proto 'static'                                           
        option ipaddr '10.210.11.1'                                     
        option netmask '255.255.255.0'                                     
        option device 'eth0.2'

(I actually didn't need a bridge in my case, it only gave me the following errors with the bridge setup:

kern.warn kernel: [61088.619111] br-lan: received packet on eth0 with own address as source address (addr:24:1c:xx:xx:xx:xx, vlan:0)

/etc/config/firewall

config forwarding                              
        option src 'lan'                        
        option dest 'IoT'                       
                                                
config rule 'IoT_dns'                       
        option name 'Allow-DNS-IoT'             
        option dest_port '53'                
        option proto 'tcp udp'                  
        option target 'ACCEPT'              
        option src 'IoT'                       
                                                
config rule 'IoT_dhcp'                          
        option name 'Allow-DHCP-IoT'            
        option src_port '68'                   
        option dest_port '67'                   
        option proto 'udp'                      
        option family 'ipv4'                    
        option target 'ACCEPT'              
        option src 'IoT'                       
                                                
config rule                                     
        option name 'mDNS to IoT'               
        list proto 'udp'                       
        option src 'IoT'                        
        option src_port '5353'                  
        list dest_ip '224.0.0.251'           
        option dest_port '5353'                 
        option target 'ACCEPT'                  
                                             
config rule                                     
        option name 'mDNS for IoT'          
        list proto 'udp'                        
        option src 'lan'                        
        option src_port '5353'               
        list dest_ip '224.0.0.251'              
        option dest_port '5353'             
        option target 'ACCEPT'                  
                                                
config forwarding                            
        option src 'IoT'                        
        option dest 'wan'

/etc/config/dhcp

config dhcp 'IoT'                     
        option interface 'IoT'        
        option start '100'            
        option limit '150'            
        option leasetime '12h'        
        list dhcp_option '6,10.210.11.1'
        list dhcp_option '3,10.210.11.1'
        list ra_flags 'none'

relevant lines /etc/adguardhome.yaml

dns:
  bind_hosts:
  - 10.210.10.1
  - 127.0.0.1
  - 10.210.11.1
  port: 53

On AP Downstairs:

/etc/config/network

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 1 2 3 4 5 6'
        option vid '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option description 'IoT'
        option ports '0t 2t 5t'

config interface 'IoT'
        option device 'br-IoT'
        option proto 'static'
        option ipaddr '10.210.11.132'
        option netmask '255.255.255.0'
        option gateway '10.210.11.1'

config device
        option name 'br-IoT'
        option type 'bridge'
        list ports 'eth0.2'

And on the other AP upstairs:

/etc/config/network

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 1 2 3 4 5 6'
        option vid '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 5t'
        option vid '2'

config interface 'IoT'
        option device 'br-IoT'
        option proto 'static'
        option ipaddr '10.210.11.107'
        option netmask '255.255.255.0'
        option gateway '10.210.11.1'

config device
        option name 'br-IoT'
        option type 'bridge'
        list ports 'eth0.2'

Thanks in advance!

4

That's the same video i follow to configuring my IoT interface, but i can always connect on wan trought IoT, i also installed pbr, should i configure another rule for OpenVPN? Or is a normal behaviour?