Help with VLANs

Kitdrewne · August 10, 2024, 4:47pm

Hi there! I'm fairly new to OpenWrt, and am currently trying to replace an old Cisco Meraki MR32 access point with a Ubiqiti U6 Plus AP running OpenWrt. It seems to work just fine, however I'm getting stuck when it comes to setting up VLANs for the couple SSIDs we need to have running on it.

I've followed a few different walkthroughs on the subject, but haven't had any luck getting them to work. Basically where I'm at now is where it seems like everything should work, but when connecting to an SSID that should be associated with a VLAN, I'm not pulling DHCP and am not able to reach anything configuring an address manually.

We have an OPNsense firewall, a FS switch, and the MR32 APs running just fine with the same VLANs, so everything should be configured good on that end. Firewall, DHCP, and DNS are all being provided through the OPNsense box, so I have disabled those on the new AP, basically just needing it to run as a dumb AP and nothing more. I feel like I'm probably missing something super obvious with the OpenWrt configuration.

Here is where I'm at with the current configs below.

ubus call system board

{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "ARMv8 Processor rev 4",
	"model": "Ubiquiti UniFi 6 Plus",
	"board_name": "ubnt,unifi-6-plus",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd0e:237b:a9e2::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.4.6'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.4.1'

config device
	option type 'bridge'
	option name 'vlan_bridge'
	list ports 'eth0'
	list ports 'vlan_bridge.20'
	list ports 'vlan_bridge.30'
	list ports 'vlan_bridge.40'

config bridge-vlan
	option device 'vlan_bridge'
	option vlan '20'
	list ports 'eth0:t'
	list ports 'vlan_bridge.20:t'

config bridge-vlan
	option device 'vlan_bridge'
	option vlan '30'
	list ports 'eth0:t'
	list ports 'vlan_bridge.30:t'

config bridge-vlan
	option device 'vlan_bridge'
	option vlan '40'
	list ports 'eth0:t'
	list ports 'vlan_bridge.40:t'

config interface 'staff'
	option proto 'none'
	option device 'vlan_bridge.20'
	option type 'bridge'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/18000000.wifi'
	option channel '1'
	option band '2g'
	option htmode 'HE20'
	option disabled '1'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'none'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/18000000.wifi+1'
	option channel '36'
	option band '5g'
	option htmode 'HE80'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'staff'
	option mode 'ap'
	option ssid 'Staff Wi-Fi'
	option encryption 'sae'
	option key 'c3ap948fnnzf450f'

/etc/config/dhcp

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'
	option dynamicdhcp '0'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

brada4 · August 10, 2024, 5:00pm

One port cannot be a member of 2 bridges.

Kitdrewne · August 10, 2024, 5:19pm

That's good to know, thank you! I've updated my configuration as below. Unfortunately, it looks like I'm still not getting anything on that SSID when connecting...

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd0e:237b:a9e2::/48'

config interface 'lan'
	option device 'eth0'
	option proto 'static'
	option ipaddr '192.168.4.6'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.4.1'

config device
	option type 'bridge'
	option name 'vlan_bridge'
	list ports 'eth0'
	list ports 'vlan_bridge.20'
	list ports 'vlan_bridge.30'
	list ports 'vlan_bridge.40'

config bridge-vlan
	option device 'vlan_bridge'
	option vlan '20'
	list ports 'eth0:t'
	list ports 'vlan_bridge.20:t'

config bridge-vlan
	option device 'vlan_bridge'
	option vlan '30'
	list ports 'eth0:t'
	list ports 'vlan_bridge.30:t'

config bridge-vlan
	option device 'vlan_bridge'
	option vlan '40'
	list ports 'eth0:t'
	list ports 'vlan_bridge.40:t'

config interface 'staff'
	option proto 'none'
	option device 'vlan_bridge.20'
	option type 'bridge'

psherman · August 10, 2024, 5:25pm

This config is pretty messed up.

I'd recommend resetting to defaults. Then, share with us the default (or near-default) network config with the following information:

What are the VLAN IDs (and ideally the functional names of each like lan, iot, guest) that you need on the AP?
Are all VLANs tagged, or is one untagged (if so, which one)?
What VLAN is used for managing the device itself?
What address do you want the AP to use on your network (or do you want it to get an address using DHCP client)?

Kitdrewne · August 10, 2024, 5:48pm

The VLAN IDs are as below:
20 - staff - 10.123.20.0/24
30 - guest - 172.20.30.0/24
40 - iot - 172.25.40.0/24

LAN is 192.168.4.0/24

All are tagged. I'd like the AP to be managed on the LAN with the static IP address 192.168.4.6.

Here is the default network config after resetting:

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdaf:3395:4538::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

Thank you!

psherman · August 10, 2024, 5:50pm

Is the lan untagged, or does it have a VLAN ID?

Kitdrewne · August 10, 2024, 5:50pm

Sorry, LAN is untagged.

psherman · August 10, 2024, 5:58pm

Ok. There are two possible ways to approach this. We'll try with bridge-VLANs, but if that doesn't work, there's another method.

Start by creating bridge-vlans:

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'eth0:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '30'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '40'
	list ports 'eth0:t'

Edit the lan to use br-lan.1 and the desired address:

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.4.6'
	option netmask '255.255.255.0'

Now create unmanaged interfaces for each of the other networks:

config interface 'staff'
	option device 'br-lan.20'
	option proto 'none'

config interface 'guest'
	option device 'br-lan.30'
	option proto 'none'

config interface 'iot'
	option device 'br-lan.40'
	option proto 'none'

Now, you can create the SSIDs and link them against the respective networks (lan, staff, guest, iot).

Restart and try again.

brada4 · August 10, 2024, 6:21pm

Ur fast bro

Kitdrewne · August 10, 2024, 6:51pm

It looks like this worked! Thank you so much!!

I'm testing with an OPNsense device at home I have the device config loaded on, so I think it's all good now. I'll get it hooked up in that office on Monday, but I think everything should be good.

Here's what by config looks like after those changes, just in case this helps anyone else:

/etc/config/network

	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdaf:3395:4538::/48'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'eth0:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '30'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '40'
	list ports 'eth0:t'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.4.6'
	option netmask '255.255.255.0'

config interface 'staff'
	option device 'br-lan.20'
	option proto 'none'

config interface 'guest'
	option device 'br-lan.30'
	option proto 'none'

config interface 'utility'
	option device 'br-lan.40'
	option proto 'none'

Thanks so much again for the help! I really appreciate it!

system · August 20, 2024, 6:52pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.