Guest VLAN issues

Installing and Using OpenWrt Network and Wireless Configuration
1

Recently made some changes and I can't connect to the guest network anymore. I kindly request your help!

I have a router (RPi 4B, openwrt), a switch (TP Link SG105E) and a dumb AP (WAX202, openwrt).

The switch is configured as follows:

image
image1308×414 17.3 KB

The router has:

/etc/config/network


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option dhcp_default_duid '0004bf7a05ecd4d94000aa752fb610a7138b'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.0.1.1'
	option netmask '255.255.255.0'
	option multipath 'off'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth1'
	option hostname '*'

config route
	option interface 'wan'
	option target '***'

config interface 'vpn'
***
config wireguard_vpn
***

config interface 'guest'
	option proto 'static'
	option device 'eth0.50'
	option ipaddr '10.0.50.1'
	option netmask '255.255.255.0'
	option multipath 'off'

(VLANs are reduced to just guests until I figure this out)

/etc/config/firewall

...

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'vpn'

config rule
	option name 'Allow-Guest-DNS'
	option src 'guest'
	option dest_port '53'
	option proto 'tcp udp'
	option target 'ACCEPT'

config rule
	option src 'guest'
	option name 'Allow-Guest-DHCP'
	list proto 'udp'
	option dest_port '67 68'
	option target 'ACCEPT'

/etc/config/dhcp


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '0'
	option ednspacket_max '1232'
	list server '10.0.1.1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/odhcpd.leases'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
	option piodir '/tmp/odhcpd-piodir'
	option hostsdir '/tmp/hosts'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'

I ran tcpdump -epni eth0 port 67 or port 68 when trying to connect to the guest network (either via the AP or the RPi's own antenna) and nothing shows up.

Any idea?

2

The config as shared looks fine. There could be issues in the parts of the config that has not been shard thus far. It is worth noting that you are allowing guest > vpn, so the VPN must be operating properly (and if you have policy based routing, that needs to be correct, too).

But, in the meantime, try connecting via ethernet to VLAN 50/guest.

To do this, temporarily set one of your switch ports to have VLAN 50 untagged + PVID. Then plug a computer directly into that port and observe if it gets an IP in the 10.0.50.0/24 network via DHCP and if it has the desired connectivity.

3

Thanks for your reply!

It did work connecting directly into the switch, which prompted to check the AP.

Turns out I had changed the device in the interface via Lucy, but forgot to change the bridge-vlan.

As for why RPi's own antenna isn't working I have no idea and intention to pursue a solution right now.

Thanks a lot!

4

Keep in mind that the Pi's wifi radio is very low end.

  • It can only operate in a single band (2.4G XOR 5G) -- it is not capable of simultaneous dual band operation.
  • It only supports the use of a single SSID.
  • It has a low performance 1x1 radio/antenna system
  • The handling of multiple clients isn't great -- it's really a chipset and design that is centered around being used in STA mode, not as an AP (it's able to operate this way, but not optimized for it)
  • It's limited on power and range
  • And the bandwidth of the radio is also quite low, so throughput isn't anything special.

It's best to simply disable this device's radio and use properly designed APs.

5

Thanks. I don't use it for everyday internet, but do find it useful for small maintenance jobs where the AP is down, or for testing, such as this case, assuming it works....

6

sounds good.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile: