Help, my VLAN doesn't work on version 24.10

Xalassa · April 17, 2025, 4:18pm

After upgrading from 23.05 to 24.10 I see that my vlans do not work

The router is a Xiaomi Redmi Router AC2100, I upgraded it to two different routers and had no problems

/etc/config/network


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fd29:fdde:b233::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1.10'
	list ports 'lan1.12'
	list ports 'lan2.10'
	list ports 'lan2.12'
	list ports 'lan3'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.10.254'
	list dns '192.168.10.213'
	list dns '8.8.8.8'
	list dns '8.8.4.4'

config interface 'wan'
	option proto 'dhcp'
	option device 'wan'
	option hostname '*'

config interface 'wan6'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option device 'wan'

config interface 'backxiao2100'
	option proto 'static'
	option ipaddr '192.168.50.254'
	option netmask '255.255.255.0'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.20.254'
	option netmask '255.255.255.0'
	option device 'br-guest'

config interface 'iot'
	option proto 'static'
	option device 'br-iot'
	option ipaddr '192.168.30.254'
	option netmask '255.255.255.0'
	option delegate '0'

config device
	option name 'br-guest'
	option type 'bridge'
	list ports 'lan1.20'
	list ports 'lan2.20'

config device
	option name 'br-iot'
	option type 'bridge'
	list ports 'lan1.30'
	list ports 'lan2.30'

config device
	option name 'lan1.20'
	option type '8021q'
	option ifname 'lan1'
	option vid '20'

config device
	option name 'lan1.30'
	option type '8021q'
	option ifname 'lan1'
	option vid '30'

config device
	option type '8021q'
	option ifname 'lan1'
	option vid '10'
	option name 'lan1.10'

config device
	option type '8021q'
	option ifname 'lan1'
	option vid '12'
	option name 'lan1.12'

config device
	option type '8021q'
	option ifname 'lan2'
	option vid '10'
	option name 'lan2.10'

config device
	option type '8021q'
	option ifname 'lan2'
	option vid '12'
	option name 'lan2.12'

config device
	option type '8021q'
	option ifname 'lan2'
	option vid '20'
	option name 'lan2.20'

config device
	option type '8021q'
	option ifname 'lan2'
	option vid '30'
	option name 'lan2.30'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'xxxxxx'
	option listen_port '51820'
	list addresses '10.14.0.1/24'

config wireguard_wg0
	option description 'Marco'
	option public_key 'xxxxxxxxxxxx'
	option private_key 'xxxxxxxxxxxxxx'
	list allowed_ips '10.14.0.3/32'
	option route_allowed_ips '1'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun+'
	list network 'lan'
	list network 'wg0'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'backxiao2100'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'backxiao2100'

config zone
	option name 'guest'
	option output 'ACCEPT'
	option forward 'REJECT'
	option input 'REJECT'
	list network 'guest'

config zone
	option name 'iot'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config forwarding
	option src 'lan'
	option dest 'iot'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'guest dhcp dns'
	option src 'guest'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config forwarding
	option src 'iot'
	option dest 'lan'

config rule
	option target 'ACCEPT'
	option src 'IOT'
	option dest 'lan'
	option name '6053'
	option src_port '6053 1883'
	option dest_port '6053 1883'

config redirect
	option target 'DNAT'
	option src 'IOT'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '6053'
	option dest_port '6053'
	option name '6053'

config redirect
	option target 'DNAT'
	option src 'IOT'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '1883'
	option dest_port '1883'
	option name '1883'

config rule 'ovpn'
	option name 'Allow-OpenVPN'
	option src 'wan'
	option dest_port '1194'
	option proto 'udp'
	option target 'ACCEPT'
	option enabled '0'

config include
	option path '/etc/firewall.fail2ban'
	option enabled '1'
	option reload '1'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'wireguard'
	list proto 'udp'
	option src 'wan'
	option src_dport '51820'
	option dest_ip '192.168.10.254'
	option dest_port '51820'

config rule
	option name 'mdns'
	list proto 'udp'
	option src '*'
	option src_port '5353'
	list dest_ip '224.0.0.251'
	option dest_port '5353'
	option target 'ACCEPT'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'Proxy'
	option src 'wan'
	option src_dport '82'
	option dest_ip '192.168.10.211'
	option dest_port '82'
	option enabled '0'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'ngix'
	option src 'wan'
	option src_dport '443'
	option dest_ip '192.168.10.28'
	option dest_port '443'
	option enabled '0'

config redirect
	option dest 'lan'
	option target 'DNAT'
	option name 'ngix80'
	option src 'wan'
	option src_dport '80'
	option dest_ip '192.168.10.28'
	option dest_port '80'
	option enabled '0'

psherman · April 17, 2025, 4:30pm

There are massive problems with your configuration. It will probably be faster to reset and start over than it will be to fix what you have currently.

This should show you how things should be done, and we can always assist via the forum, too:

Xalassa · April 18, 2025, 10:13am

Thanks for the reply. I'll try

Xalassa · April 19, 2025, 6:40pm

I've been watching the tutorial and modified it to the file below, however it still works on 23.05 and not on 24.10. Any help?


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fd29:fdde:b233::/48'

config device 'switch'
	option name 'switch'
	option type 'bridge'
	option macaddr 'REDACTED'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'

config bridge-vlan 'lan_vlan'
	option device 'switch'
	option vlan '10'
	list ports 'lan1:t'
	list ports 'lan2:t'
	list ports 'lan3:u*'

config bridge-vlan 'guest_vlan'
	option device 'switch'
	option vlan '20'
	list ports 'lan1:t'
	list ports 'lan2:t'

config bridge-vlan 'iot_vlan'
	option device 'switch'
	option vlan '30'
	list ports 'lan1:t'
	list ports 'lan2:t'

config interface 'wan'
	option proto 'dhcp'
	option device 'wan'
	option hostname '*'

config interface 'wan6'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option device 'wan'

config interface 'backxiao2100'
	option proto 'static'
	option ipaddr '192.168.50.254'
	option netmask '255.255.255.0'

config interface 'lan'
	option device 'switch.10'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.10.254'
	list dns '192.168.10.213'
	list dns '8.8.8.8'
	list dns '8.8.4.4'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.20.254'
	option netmask '255.255.255.0'
	option device 'switch.20'

config interface 'iot'
	option proto 'static'
	option device 'switch.30'
	option ipaddr '192.168.30.254'
	option netmask '255.255.255.0'
	option delegate '0'

passibe15 · April 19, 2025, 7:40pm

What exactly does this mean?

Xalassa · April 19, 2025, 8:10pm

I don't have traffic on tagged devices

psherman · April 19, 2025, 8:20pm

Let’s also see the dhcp and firewall files.

Xalassa · April 19, 2025, 8:36pm

/etc/config/dhcp


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option serversfile '/var/run/simple-adblock/dnsmasq.servers'

config dhcp 'lan'
	option interface 'lan'
	option start '1'
	option limit '50'
	option leasetime '12h'
	option dhcpv4 'server'
	option force '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'backxiao2100'
	option interface 'backxiao2100'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'iot'
	option interface 'iot'
	option start '1'
	option limit '150'
	option leasetime '12h'
	option force '1'

Xalassa · April 19, 2025, 8:38pm

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone 'lan'
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list device 'tun+'
	list network 'lan'
	list network 'wg0'

config zone 'wan'
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'backxiao2100'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'backxiao2100'

config zone
	option name 'guest'
	option output 'ACCEPT'
	option forward 'REJECT'
	option input 'REJECT'
	list network 'guest'

config zone
	option name 'iot'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config forwarding
	option src 'lan'
	option dest 'iot'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'guest dhcp dns'
	option src 'guest'
	option dest_port '53 67 68'
	option target 'ACCEPT'

config forwarding
	option src 'iot'
	option dest 'lan'

config rule
	option target 'ACCEPT'
	option src 'IOT'
	option dest 'lan'
	option name '6053'
	option src_port '6053 1883'
	option dest_port '6053 1883'

psherman · April 19, 2025, 9:53pm

What is connected to ports 1and/or 2?

Xalassa · April 20, 2025, 10:21am

It is connected to other APs with OpenWRT with version 24.10. It is on these devices that I have no traffic when I update the main one to 24.10. In version 23.05 everything is fine.
I put here the configuration files of the secondary AP.
Firewall e dhcp are disable.

/etc/config/network


config interface 'loopback'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
	option device 'lo'

config globals 'globals'
	option ula_prefix 'fdb3:e294:8449::/48'
	option packet_steering '1'

config interface 'lan'
	option proto 'static'
	option delegate '0'
	option igmp_v3 '1'
	option igmp_v2 '0'
	option multicast_querier '1'
	option stp '1'
	option netmask '255.255.255.0'
	option ipaddr '192.168.10.251'
	option device 'br-lan'

config interface 'wan'
	option proto 'dhcp'
	option device 'br-lan'

config interface 'wan6'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option device 'eth1.12'
	option disabled '1'
	option norelease '1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '10'
	option ports '0t 6t 2 3 4 5 1t'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '12'

config interface 'Guest'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.20.251'
	option device 'br-Guest'

config interface 'IOT'
	option proto 'static'
	option delegate '0'
	option netmask '255.255.255.0'
	option ipaddr '192.168.30.251'
	option device 'br-IOT'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option vid '20'
	option ports '0t 1t'

config switch_vlan
	option device 'switch0'
	option vlan '5'
	option vid '30'
	option ports '0t 1t'

config interface 'backup'
	option proto 'static'
	option ipaddr '192.168.40.254'
	option netmask '255.255.255.0'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.10'
	option igmp_snooping '1'

config device
	option name 'br-Guest'
	option type 'bridge'
	list ports 'eth1.20'

config device
	option name 'br-IOT'
	option type 'bridge'
	list ports 'eth1.30'