Now that I have a managed switch I am trying to switch things over to what I stated as my goal but I pretty much get stuck at the beginning, which is getting the NanoPi setup to receive the tagged VLAN traffic. I am also a bit confused on how the zone forwarding should work and whether clamping or masquerading will be needed.
Since the R4S is a 2 port device, I'm assuming that one is the WAN and the other will be used as a trunk with your local networks.
With that in mind, if you're just creating a single guest network, follow this guide to get started. You can ignore the part about making the SSIDs on this device, though, if you're only using Ethernet from the R4S. We'll make some adjustments from there to attach it to Ethernet.
If you run into any issues along the way, feel free to ask and we'll try to get you unstuck.
When you're done, let's see the config (we'll make those modifications once the basics are complete):
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
I setup the device and interface per the guide. Basically the same as the Dumb AP setup. Obviously did not do the wifi part and skipped the firewalls section for now as well (although I can add that in if you think it makes sense right now.
Then implement the firewall rules as presented in the guide. Post the network config and the firewall files again when that is done - I’ll double check them.
That should be all that is necessary on the router. Three we will move to the switch and the APs.
And this 802.1q stanza is not actually necessary -- it can also be deleted (although it shouldn't cause any issues if it is kept in place):
Now, let's look at your switch config -- we need to see the /etc/config/network config file from that device and additionally we need to know the following about the ports:
Which port connects to the router (R4S)?
Which ports are used to connect to the APs?
Is there a spare port we can use for verifying that the guest network is working properly? If so, what port number?
Which port connects to the router (R4S)? Port 1 Which ports are used to connect to the APs? Ports 2 & 3 Is there a spare port we can use for verifying that the guest network is working properly? If so, what port number? Ports 7-24 are all basically available. Lets go with port 16 as its simple to reach for me.
So, let's make some bridge-vlans. The first is already there, but I recommend editing it -- sorry, this will be a bit tedius:
Make it look like this:
config bridge-vlan 'lan_vlan'
option device 'switch'
option vlan '1'
list ports 'lan1:u*'
list ports 'lan2:u*'
...
list ports 'lan28:u*'
(where the ... is the rest of the ports).
Omit just one port from the above, though -- lan16, since we're going to use that for the guest verification.
Next, we'll create the bridge-VLAN for the guest network:
config bridge-vlan
option device 'switch'
option vlan '10'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan16:u*'
And now we'll create an unmanaged interface for the guest network:
config interface 'guest'
option device 'switch.10'
option proto 'none'
Restart your switch after these changes are complete.
If all goes well, you'll have the lan on all ports except for port 16 which will have the guest network. If this is true, we can start working on the APs (post the /etc/config/network config from those devices next).
Sorry but a bit confused on how to do this. I typically use the LuCI interface. Would I basically just create a bridge device for each port, enable vlan tagging, and mark it as untagged, then remove it from the original switch bridged device until im through all 24 ports, minus 16 and 25-28 (not supported).
ahh I see. Alright this might take a me moment, pretty new to this.
I think I have the first part of your request done.
e]0;root@switch: ~aroot@switch:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd05:5588:b0a3::/48'
option packet_steering '1'
config device 'switch'
option name 'switch'
option type 'bridge'
option macaddr '2c:23:3a:25:78:da'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'lan5'
list ports 'lan6'
list ports 'lan7'
list ports 'lan8'
list ports 'lan9'
list ports 'lan10'
list ports 'lan11'
list ports 'lan12'
list ports 'lan13'
list ports 'lan14'
list ports 'lan15'
list ports 'lan16'
list ports 'lan17'
list ports 'lan18'
list ports 'lan19'
list ports 'lan20'
list ports 'lan21'
list ports 'lan22'
list ports 'lan23'
list ports 'lan24'
list ports 'lan25'
list ports 'lan26'
list ports 'lan27'
list ports 'lan28'
config bridge-vlan 'lan_vlan'
option device 'switch'
option vlan '1'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'
list ports 'lan5:u*'
list ports 'lan6:u*'
list ports 'lan7:u*'
list ports 'lan8:u*'
list ports 'lan9:u*'
list ports 'lan10:u*'
list ports 'lan11:u*'
list ports 'lan12:u*'
list ports 'lan13:u*'
list ports 'lan14:u*'
list ports 'lan15:u*'
list ports 'lan17:u*'
list ports 'lan18:u*'
list ports 'lan19:u*'
list ports 'lan20:u*'
list ports 'lan21:u*'
list ports 'lan22:u*'
list ports 'lan23:u*'
list ports 'lan24:u*'
list ports 'lan25:u*'
list ports 'lan26:u*'
list ports 'lan27:u*'
list ports 'lan28:u*'
config device
option name 'switch.1'
config interface 'lan'
option device 'switch.1'
option proto 'static'
option ipaddr '192.168.1.252'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
e]0;root@switch: ~aroot@switch:~#
root@switch:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd05:5588:b0a3::/48'
option packet_steering '1'
config device 'switch'
option name 'switch'
option type 'bridge'
option macaddr '2c:23:3a:25:78:da'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'lan5'
list ports 'lan6'
list ports 'lan7'
list ports 'lan8'
list ports 'lan9'
list ports 'lan10'
list ports 'lan11'
list ports 'lan12'
list ports 'lan13'
list ports 'lan14'
list ports 'lan15'
list ports 'lan16'
list ports 'lan17'
list ports 'lan18'
list ports 'lan19'
list ports 'lan20'
list ports 'lan21'
list ports 'lan22'
list ports 'lan23'
list ports 'lan24'
list ports 'lan25'
list ports 'lan26'
list ports 'lan27'
list ports 'lan28'
config bridge-vlan 'lan_vlan'
option device 'switch'
option vlan '1'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'
list ports 'lan5:u*'
list ports 'lan6:u*'
list ports 'lan7:u*'
list ports 'lan8:u*'
list ports 'lan9:u*'
list ports 'lan10:u*'
list ports 'lan11:u*'
list ports 'lan12:u*'
list ports 'lan13:u*'
list ports 'lan14:u*'
list ports 'lan15:u*'
list ports 'lan17:u*'
list ports 'lan18:u*'
list ports 'lan19:u*'
list ports 'lan20:u*'
list ports 'lan21:u*'
list ports 'lan22:u*'
list ports 'lan23:u*'
list ports 'lan24:u*'
list ports 'lan25:u*'
list ports 'lan26:u*'
list ports 'lan27:u*'
list ports 'lan28:u*'
config device
option name 'switch.1'
option macaddr '2c:23:3a:25:78:da'
config interface 'lan'
option device 'switch.1'
option proto 'static'
option ipaddr '192.168.1.252'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
config bridge-vlan 'guest_vlan'
option device 'switch'
option vlan '10'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan16:u*'
config interface 'guest'
option device 'switch.10'
option proto 'none'
kitchen (192.168.1.2)
root@kitchen:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd87:b812:65d6::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.2'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
list dns '9.9.9.9'
config device
option type 'bridge'
option name 'br-guest'
option bridge_empty '1'
config interface 'guest'
option proto 'static'
option device 'br-guest'
option ipaddr '192.168.2.2'
option netmask '255.255.255.0'
the 192.168.2.0/24 network is the makeshift guest network I have going on currently, that we discussed in my prior thread. My hope is for that to be fully replaced.
You have an explicit 802.1q stanza which creates a VLAN "device." But this is not necessary because the use of the bridge VLANs and/or dotted notation (depending on which device we're talking about) will automatically create the same device. Therefore, the 802.1q stanza can be deleted.
Great!
Yes. Two things you'll want to do:
Change the current firewall rule that allows guest DNS such that it has a destination zone of lan and a destination address of 192.168.1.254.
config rule
option name 'Allow-DNS-Guest'
option src 'guest'
option dest_port '53'
option target 'ACCEPT'
option dest 'lan'
list dest_ip '192.168.1.254'
Add DHCP option 6 (DNS advertisements) 192.168.1.254 to the guest DHCP server. That looks like this:
