Home, Guest and IoT Vlan - Wired + Wireless

jammy137 · January 25, 2021, 2:47pm

Hi all,

I'm new to OpenWRT but not new to networking (currently doing CCNA). I'm hoping that someone is able to assist with my home setup. I'll explain what I've got so far, and then explain below what I'm trying to achieve.

Current setup
4x Wireless networks, individually addressed:
IoTNET - for smart devices (fire stick, Sonos and so on)
GuestWiFi - for Guests
my LAN - for my devices
Partner's LAN - for hers
then there's the standard Vlan (1?) for wired access to my LAN.

What I would like to achieve
IoTNET - able to access wirelessly and wired so that my Smart TV and Sonos can be plugged in wired
GuestWiFi - can remain solely wireless, so this needs no changing
myLAN - able to access wirelessly, and wired
Partner's LAN - same as mine.

The routing/firewall stipulations would need to be as below:
IoTNet - access to WWW, but not able to speak to any other LAN/VLAN
GuestWiFi - only WWW access
my LAN - access to WWW, but able to control smart devices on IoTNET
Partner's LAN - same as mine.

I think I know how I'd do this on cisco, but, with my limited knowledge of Linux as a whole and also openWRT, I'm hoping one of you out there is able to help. I've been using the GUI (because of my limited knowledge of Linux commands (too used to Cisco atm).
Also, lastly I don't want to combine IoTNET and Guest because of my Sonos, as they have no app security on them and anyone with the app is able to control them, so would prefer it only to be devices on mine and my partner's VLAN/LAN.

Hope this all makes sense, and someone is able to help.

trendy · January 25, 2021, 4:27pm

You can control the allowed flows of the firewall with forwardings. iot and guest have forwarding only to wan. lans have to iot and wan.

mpa · January 25, 2021, 8:03pm

To add a wired connection to a subnet which is currently WiFi-only:

configure VLAN X in the switch configuration if applicable (Network -> Switch): tagged on the CPU port, untagged on the access port where the client connects
enable bridging under "Physical settings" for an OpenWrt interface (Network -> Interface)
add the physical interface (usually eth0.X) to the bridge

The details may vary, that's why it would be good to see your current configuration. Please post these files from /etc/config/ after redacting any secrets:

network
wireless
firewall

What is the device's make and model?

jammy137 · January 28, 2021, 10:34am

Just managed to do that with the Vlan, thanks!

How do I get it to do a "show running-config"? I'm running a Linksys WRT1900ACS
As I say, I'm very new to OpenWRT and still a bit 'wet behind the ears' regarding Linux.

trendy · January 28, 2021, 10:40am

There isn't one-file-shows-all-config, but you can see the individual files in /etc/config/

mpa · January 28, 2021, 10:59am

In addition to looking at the individual UCI config files, you can also run uci show or uci export after logging in via SSH.

There is a lot of documentation about the config system in the OpenWrt wiki:

Some add-on packages may come without UCI support and use their own config files located elsewhere.

LuCI can export the configuration as an archive (System -> Backup/Flash Firmware).
It tries to include all relevant files, not just the UCI config.

jammy137 · January 28, 2021, 11:21am

Hi,

Thanks for that. Think I've redacted everything I need to.

firewall.@defaults[0]=defaults
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].synflood_protect='1'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan'
firewall.@zone[1]=zone
firewall.@zone[1].input='ACCEPT'
firewall.@zone[1].name='LauraNET'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='ACCEPT'
firewall.@zone[1].network='Laura_NET'
firewall.@zone[2]=zone
firewall.@zone[2].name='GuestNET'
firewall.@zone[2].input='ACCEPT'
firewall.@zone[2].forward='ACCEPT'
firewall.@zone[2].network='GuestNET'
firewall.@zone[2].output='ACCEPT'
firewall.@zone[3]=zone
firewall.@zone[3].network='IoTNET'
firewall.@zone[3].input='ACCEPT'
firewall.@zone[3].name='IoTNET'
firewall.@zone[3].output='ACCEPT'
firewall.@zone[3].forward='ACCEPT'
firewall.@zone[4]=zone
firewall.@zone[4].name='wan'
firewall.@zone[4].input='REJECT'
firewall.@zone[4].output='ACCEPT'
firewall.@zone[4].forward='REJECT'
firewall.@zone[4].masq='1'
firewall.@zone[4].mtu_fix='1'
firewall.@zone[4].network='wan wan6'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-ICMPv6-Forward'
firewall.@rule[0].src='wan'
firewall.@rule[0].dest=''
firewall.@rule[0].proto='icmp'
firewall.@rule[0].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[0].limit='1000/sec'
firewall.@rule[0].family='ipv6'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-IPSec-ESP'
firewall.@rule[1].src='wan'
firewall.@rule[1].dest='lan'
firewall.@rule[1].proto='esp'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-ISAKMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].dest='lan'
firewall.@rule[2].dest_port='500'
firewall.@rule[2].proto='udp'
firewall.@rule[2].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].dest='wan'
firewall.@forwarding[1].src='GuestNET'
firewall.@forwarding[2]=forwarding
firewall.@forwarding[2].dest='wan'
firewall.@forwarding[2].src='IoTNET'
firewall.@forwarding[3]=forwarding
firewall.@forwarding[3].dest='wan'
firewall.@forwarding[3].src='LauraNET'
firewall-opkg.@defaults[0]=defaults
firewall-opkg.@defaults[0].syn_flood='1'
firewall-opkg.@defaults[0].input='ACCEPT'
firewall-opkg.@defaults[0].output='ACCEPT'
firewall-opkg.@defaults[0].forward='REJECT'
firewall-opkg.@zone[0]=zone
firewall-opkg.@zone[0].name='lan'
firewall-opkg.@zone[0].network='lan'
firewall-opkg.@zone[0].input='ACCEPT'
firewall-opkg.@zone[0].output='ACCEPT'
firewall-opkg.@zone[0].forward='ACCEPT'
firewall-opkg.@zone[1]=zone
firewall-opkg.@zone[1].name='wan'
firewall-opkg.@zone[1].network='wan' 'wan6'
firewall-opkg.@zone[1].input='REJECT'
firewall-opkg.@zone[1].output='ACCEPT'
firewall-opkg.@zone[1].forward='REJECT'
firewall-opkg.@zone[1].masq='1'
firewall-opkg.@zone[1].mtu_fix='1'
firewall-opkg.@forwarding[0]=forwarding
firewall-opkg.@forwarding[0].src='lan'
firewall-opkg.@forwarding[0].dest='wan'
firewall-opkg.@rule[0]=rule
firewall-opkg.@rule[0].name='Allow-DHCP-Renew'
firewall-opkg.@rule[0].src='wan'
firewall-opkg.@rule[0].proto='udp'
firewall-opkg.@rule[0].dest_port='68'
firewall-opkg.@rule[0].target='ACCEPT'
firewall-opkg.@rule[0].family='ipv4'
firewall-opkg.@rule[1]=rule
firewall-opkg.@rule[1].name='Allow-Ping'
firewall-opkg.@rule[1].src='wan'
firewall-opkg.@rule[1].proto='icmp'
firewall-opkg.@rule[1].icmp_type='echo-request'
firewall-opkg.@rule[1].family='ipv4'
firewall-opkg.@rule[1].target='ACCEPT'
firewall-opkg.@rule[2]=rule
firewall-opkg.@rule[2].name='Allow-IGMP'
firewall-opkg.@rule[2].src='wan'
firewall-opkg.@rule[2].proto='igmp'
firewall-opkg.@rule[2].family='ipv4'
firewall-opkg.@rule[2].target='ACCEPT'
firewall-opkg.@rule[3]=rule
firewall-opkg.@rule[3].name='Allow-DHCPv6'
firewall-opkg.@rule[3].src='wan'
firewall-opkg.@rule[3].proto='udp'
firewall-opkg.@rule[3].src_ip='fc00::/6'
firewall-opkg.@rule[3].dest_ip='fc00::/6'
firewall-opkg.@rule[3].dest_port='546'
firewall-opkg.@rule[3].family='ipv6'
firewall-opkg.@rule[3].target='ACCEPT'
firewall-opkg.@rule[4]=rule
firewall-opkg.@rule[4].name='Allow-MLD'
firewall-opkg.@rule[4].src='wan'
firewall-opkg.@rule[4].proto='icmp'
firewall-opkg.@rule[4].src_ip='fe80::/10'
firewall-opkg.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall-opkg.@rule[4].family='ipv6'
firewall-opkg.@rule[4].target='ACCEPT'
firewall-opkg.@rule[5]=rule
firewall-opkg.@rule[5].name='Allow-ICMPv6-Input'
firewall-opkg.@rule[5].src='wan'
firewall-opkg.@rule[5].proto='icmp'
firewall-opkg.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall-opkg.@rule[5].limit='1000/sec'
firewall-opkg.@rule[5].family='ipv6'
firewall-opkg.@rule[5].target='ACCEPT'
firewall-opkg.@rule[6]=rule
firewall-opkg.@rule[6].name='Allow-ICMPv6-Forward'
firewall-opkg.@rule[6].src='wan'
firewall-opkg.@rule[6].dest=''
firewall-opkg.@rule[6].proto='icmp'
firewall-opkg.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall-opkg.@rule[6].limit='1000/sec'
firewall-opkg.@rule[6].family='ipv6'
firewall-opkg.@rule[6].target='ACCEPT'
firewall-opkg.@rule[7]=rule
firewall-opkg.@rule[7].name='Allow-IPSec-ESP'
firewall-opkg.@rule[7].src='wan'
firewall-opkg.@rule[7].dest='lan'
firewall-opkg.@rule[7].proto='esp'
firewall-opkg.@rule[7].target='ACCEPT'
firewall-opkg.@rule[8]=rule
firewall-opkg.@rule[8].name='Allow-ISAKMP'
firewall-opkg.@rule[8].src='wan'
firewall-opkg.@rule[8].dest='lan'
firewall-opkg.@rule[8].dest_port='500'
firewall-opkg.@rule[8].proto='udp'
firewall-opkg.@rule[8].target='ACCEPT'
firewall-opkg.@include[0]=include
firewall-opkg.@include[0].path='/etc/firewall.user'

network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd50:70f5:b2ee::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth0.1'
network.lan.proto='static'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ipaddr='192.168.2.1'
network.lan.stp='1'
network.wan=interface
network.wan.ifname='eth1.2'
network.wan.proto='pppoe'
network.wan.password='#####'
network.wan.ipv6='auto'
network.wan.username='#####'
network.wan6=interface
network.wan6.ifname='eth1.2'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].vid='1'
network.@switch_vlan[0].ports='5t 3 1 0'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='6t 4'
network.@switch_vlan[1].vid='2'
network.GuestNET=interface
network.GuestNET.proto='static'
network.GuestNET.ipaddr='192.168.3.1'
network.GuestNET.type='bridge'
network.GuestNET.netmask='255.255.255.240'
network.GuestNET.ifname='wlan1-1'
network.IoTNET=interface
network.IoTNET.proto='static'
network.IoTNET.ipaddr='10.10.1.1'
network.IoTNET.netmask='255.255.255.192'
network.IoTNET.type='bridge'
network.IoTNET.ifname='radio1.network3 eth1.10'
network.Laura_NET=interface
network.Laura_NET.proto='static'
network.Laura_NET.netmask='255.255.255.0'
network.Laura_NET.ipaddr='192.168.4.1'
network.Laura_NET.ip6assign='64'
network.@switch_vlan[2]=switch_vlan
network.@switch_vlan[2].device='switch0'
network.@switch_vlan[2].vlan='3'
network.@switch_vlan[2].vid='10'
network.@switch_vlan[2].ports='6t 2'

wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.channel='36'
wireless.radio0.hwmode='11a'
wireless.radio0.path='soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
wireless.radio0.htmode='VHT80'
wireless.radio0.country='GB'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.network='lan'
wireless.default_radio0.mode='ap'
wireless.default_radio0.macaddr='c6:41:1e:32:f0:3a'
wireless.default_radio0.key='#####'
wireless.default_radio0.encryption='psk2'
wireless.default_radio0.ssid='LAN-Deploy4'
wireless.default_radio0.ifname='LANDEPLOY5G'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.channel='11'
wireless.radio1.hwmode='11g'
wireless.radio1.path='soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
wireless.radio1.htmode='HT20'
wireless.radio1.country='GB'
wireless.wifinet3=wifi-iface
wireless.wifinet3.ssid='GuestNET'
wireless.wifinet3.encryption='psk2'
wireless.wifinet3.device='radio0'
wireless.wifinet3.mode='ap'
wireless.wifinet3.network='GuestNET'
wireless.wifinet3.key='######'
wireless.wifinet3.isolate='1'
wireless.wifinet3.ifname='GuestNET5G'
wireless.wifinet5=wifi-iface
wireless.wifinet5.ssid='DeviceNET'
wireless.wifinet5.encryption='psk2'
wireless.wifinet5.device='radio0'
wireless.wifinet5.mode='ap'
wireless.wifinet5.network='IoTNET'
wireless.wifinet5.key='######'
wireless.wifinet5.ifname='DeviceNET5G'
wireless.wifinet6=wifi-iface
wireless.wifinet6.ssid='LlamaNET'
wireless.wifinet6.encryption='psk2'
wireless.wifinet6.device='radio0'
wireless.wifinet6.mode='ap'
wireless.wifinet6.key='######'
wireless.wifinet6.network='Laura_NET'
wireless.wifinet6.ifname='LlamaNET5G'
wireless.wifinet4=wifi-iface
wireless.wifinet4.ifname='LAN-Deploy2.4G'
wireless.wifinet4.ssid='LAN-Deploy4'
wireless.wifinet4.encryption='psk2'
wireless.wifinet4.device='radio1'
wireless.wifinet4.mode='ap'
wireless.wifinet4.network='lan'
wireless.wifinet4.key='######'
wireless.wifinet7=wifi-iface
wireless.wifinet7.ssid='GuestNET'
wireless.wifinet7.encryption='psk2'
wireless.wifinet7.device='radio1'
wireless.wifinet7.mode='ap'
wireless.wifinet7.network='GuestNET'
wireless.wifinet7.key='######'
wireless.wifinet8=wifi-iface
wireless.wifinet8.ifname='DeviceNET2.4G'
wireless.wifinet8.ssid='DeviceNET'
wireless.wifinet8.device='radio1'
wireless.wifinet8.mode='ap'
wireless.wifinet8.key='######'
wireless.wifinet8.encryption='psk2'
wireless.wifinet8.network='IoTNET'
wireless.wifinet9=wifi-iface
wireless.wifinet9.ifname='LlamaNET2.4'
wireless.wifinet9.ssid='LlamaNET'
wireless.wifinet9.encryption='psk2'
wireless.wifinet9.device='radio1'
wireless.wifinet9.mode='ap'
wireless.wifinet9.network='Laura_NET'
wireless.wifinet9.key='######'

mpa · January 28, 2021, 1:32pm

When posting configurations, please use the Preformatted text tool </>.

Add forwardings:

lan -> IoTNET
LauraNET -> IoTNET

Since wireless interface names are dynamic, it is better not to use them in the network configuration.

I wonder whether radio1.network3 does anything useful there.

Please remove all references to wireless interfaces from the ifname lists. When any of them becomes empty, delete that ifname option as well.

The association between the network section and the wireless interface is already established with the network option in the wireless interface configuration. Examples:

That is enough for joining a wireless interface to a bridge.

This is a backup file, apparently created by the opkg package manager. It is not part of the active configuration.

While this may be working, I think it is common practice to join additional LAN-like VLANs to the same CPU port which already has the LAN attached to it. If you change this, also update the interface to use eth0 instead of eth1:

network.IoTNET.ifname='eth0.10'

For each zone, consider whether you want to block access to the OpenWrt router itself by setting
input to REJECT. Don't forget to add exceptions for essential protocols such as DNS, DHCP and ICMP in this case.

Woodrow1 · January 28, 2021, 3:36pm

If you don’t mind, I’ll take advantage of it, I think it will soon be useful to me

mpa · January 28, 2021, 11:19pm

This is a small addition to my previous post.

Your configuration connects two wireless interfaces to the Laura_NET network interface:

I believe this requires the bridge option (currently missing):

network.Laura_NET.type='bridge'

jammy137 · January 29, 2021, 8:25am

Hi,

The two Laura_NET wireless interfaces are a 2.4Ghz and a 5Ghz interface, it all appears to work perfectly when both types of devices connect to the WiFi and they can see each other on the network.

jammy137 · January 29, 2021, 8:32am

Just going through your longer reply, which is really useful thanks! Can't see where to add exceptions. I've opened the relevant forwarding in the "Zones" area on Firewall. (btw, I'm doing 99% of this on the GUI, unsure if that makes a difference). Would I be inputting the exception rules in "Traffic Rules"?

trendy · January 29, 2021, 2:52pm

That is correct.