Home Network setup help needed

Installing and Using OpenWrt
1

Hello,

I would like to ask for help to set up the home network correctly.

image
image1514×1029 81.5 KB

Devices:
ISP router in bridge mode

ASUS RT-AC65P router with OpenWrt 23.05.3

TL-SG1016PE managed switch

VLAN ID VLAN Name Member Ports Tagged Ports Untagged Ports
1 Default 1-16 1-16
20 GUEST 1-2 1-2
30 IOT 1-2 1-2

U6-LR ( OpenWrt router Lan2 )
Default - 1
GUEST - 20
IOT - 30

Thanks, Feri

2 

root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.150",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "ASUS RT-AC65P",
        "board_name": "asus,rt-ac65p",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.3",
                "revision": "r23809-234f1a2efa",
                "target": "ramips/mt7621",
                "description": "OpenWrt 23.05.3 r23809-234f1a2efa"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd62:c328:379f::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        option ipv6 '0'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.1.2'
        list dns '192.168.1.110'
        list dns '192.168.1.120'

config device
        option name 'wan'
        option macaddr '---'
        option ipv6 '0'

config device
        option type 'bridge'
        option name 'VLANS'
        option ipv6 '0'
        option igmp_snooping '1'
        option acceptlocal '1'
        list ports 'lan4'
        list ports 'VLANS.10'
        list ports 'VLANS.20'
        list ports 'VLANS.30'

config device
        option name 'eth0'
        option ipv6 '0'

config bridge-vlan
        option device 'VLANS'
        option vlan '10'
        list ports 'VLANS.10:t'

config bridge-vlan
        option device 'VLANS'
        option vlan '20'
        list ports 'VLANS.20:t'

config bridge-vlan
        option device 'VLANS'
        option vlan '30'
        list ports 'VLANS.30:t'

config interface 'GUEST'
        option proto 'static'
        option device 'VLANS.20'
        option ipaddr '192.168.20.4'
        option netmask '255.255.255.0'
        option gateway '192.168.20.1'
        list dns '192.168.1.110'
        list dns '192.168.1.120'

config interface 'IOT'
        option proto 'static'
        option device 'VLANS.30'
        option ipaddr '192.168.30.4'
        option netmask '255.255.255.0'
        option gateway '192.168.30.1'
        list dns '192.168.1.110'
        list dns '192.168.1.120'

config device
        option name 'VLANS.10'
        option type '8021q'
        option ifname 'VLANS'
        option vid '10'
        option acceptlocal '1'
        option ipv6 '0'

config device
        option name 'VLANS.20'
        option type '8021q'
        option ifname 'VLANS'
        option vid '20'
        option acceptlocal '1'
        option ipv6 '0'

config device
        option name 'VLANS.30'
        option type '8021q'
        option ifname 'VLANS'
        option vid '30'
        option acceptlocal '1'
        option ipv6 '0'

config device
        option name 'lan1'
        option multicast_to_unicast '1'
        option acceptlocal '1'

config interface 'WAN'
        option proto 'pppoe'
        option device 'wan'
        option ipv6 'auto'
        option username '---'
        option password '---'

config device
        option name 'lan2'
        option acceptlocal '1'

config device
        option name 'lan3'
        option acceptlocal '1'

config device
        option name 'lan4'
        option acceptlocal '1'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'
        option channel 'auto'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'IOT'
        option mode 'ap'
        option ssid 'kmr-iott'
        option encryption 'psk2'
        option isolate '1'
        option key '---'
        option wmm '0'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option disabled '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'GUEST'
        option mode 'ap'
        option ssid 'kmr-guest-5g'
        option encryption 'psk2'
        option key '---'
        option isolate '1'
        option disabled '1'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '20'
        option limit '99'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        list dhcp_option '6,192.168.1.110,192.168.1.120'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'IOT'
        option interface 'IOT'
        option start '20'
        option limit '150'
        option leasetime '12h'
        option force '1'

config dhcp 'GUEST'
        option interface 'GUEST'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option force '1'

config dhcp 'WAN'
        option interface 'WAN'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'WAN'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'GUESTZone'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'GUEST'

config rule
        option name 'GUEST-DHCP-DNS'
        option src 'GUESTZone'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config zone
        option name 'IOTZone'
        option input 'ACCEPT'
        option output 'REJECT'
        option forward 'REJECT'
        list network 'IOT'

config redirect
        option target 'DNAT'
        option name 'OpenVpn'
        option src 'wan'
        option src_dport '25555'
        option dest_port '25555'
        option dest_ip '192.168.1.106'
        list proto 'tcp'
        list proto 'udp'
        option dest 'lan'

config rule
        option name 'IOT DHCP'
        option src 'IOTZone'
        option dest_port '67 68'
        option target 'ACCEPT'

config forwarding
        option src 'GUESTZone'
        option dest 'wan'

config redirect
        option target 'DNAT'
        option name 'Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option enabled '0'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'Redirect DNS to PiHole'
        option src 'lan'
        option src_ip '!192.168.1.110'
        option src_dport '53'
        option dest_ip '192.168.1.110'
        option dest_port '53'
        option enabled '0'

config forwarding
        option src 'IOTZone'
        option dest 'lan'
3

Remove the gateway from lan interface.

Same from guest interface.

Same from iot interface.

Remove the DNS from guest and iot interfaces.

You DSA configuration looks rather complicated, in reality it should be more simple.
https://openwrt.org/docs/guide-user/network/dsa/dsa-mini-tutorial#multiple_networks_using_vlan_tagging

Disable the dhcp in WAN interface.

1 Like
4

Thank you, some progress.

If I enable guest wifi in the router, and connect to it, device got IP in the 192.168.20.x range, thats working.

If I connect to U6-LR AP to guest wifi, with vlan tag 20, the device stuck at "Obtaining IP address..." How can I debug this?

My goal is, to only use the AP for wifi.

Thank you.

5

Is the AP running the Unifi firmware or OpenWrt? If OpenWrt, post the configuration here.

6

Unifi firmware

7

Ok... please post the updated network config file as well as the screenshots from your unifi configuration.

8

Unifi:

image
image1225×446 35.4 KB

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd62:c328:379f::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        option ipv6 '0'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '04:92:26:47:c4:90'
        option ipv6 '0'

config device
        option type 'bridge'
        option name 'VLANS'
        option ipv6 '0'
        option igmp_snooping '1'
        option acceptlocal '1'
        list ports 'lan1'
        list ports 'VLANS.10'
        list ports 'VLANS.20'
        list ports 'VLANS.30'

config device
        option name 'eth0'
        option ipv6 '0'

config bridge-vlan
        option device 'VLANS'
        option vlan '10'
        list ports 'VLANS.10:t'

config bridge-vlan
        option device 'VLANS'
        option vlan '20'
        list ports 'VLANS.20:t'

config bridge-vlan
        option device 'VLANS'
        option vlan '30'
        list ports 'VLANS.30:t'

config interface 'GUEST'
        option proto 'static'
        option device 'VLANS.20'
        option ipaddr '192.168.20.4'
        option netmask '255.255.255.0'

config interface 'IOT'
        option proto 'static'
        option device 'VLANS.30'
        option ipaddr '192.168.30.4'
        option netmask '255.255.255.0'

config device
        option name 'VLANS.10'
        option type '8021q'
        option ifname 'VLANS'
        option vid '10'
        option ipv6 '0'

config device
        option name 'VLANS.20'
        option type '8021q'
        option ifname 'VLANS'
        option vid '20'
        option acceptlocal '1'
        option ipv6 '0'

config device
        option name 'VLANS.30'
        option type '8021q'
        option ifname 'VLANS'
        option vid '30'
        option acceptlocal '1'
        option ipv6 '0'

config device
        option name 'lan1'
        option multicast_to_unicast '1'
        option acceptlocal '1'

config interface 'WAN'
        option proto 'pppoe'
        option device 'wan'
        option ipv6 'auto'
        option username '---'
        option password '---'

config device
        option name 'lan2'
        option acceptlocal '1'

config device
        option name 'lan3'
        option acceptlocal '1'

config device
        option name 'lan4'
        option acceptlocal '1'

config interface 'MAIN'
        option proto 'static'
        option device 'VLANS.10'
        option ipaddr '192.168.10.4'
        option netmask '255.255.255.0'

config bridge-vlan
        option device 'VLANS'
        option vlan '1'
        list ports 'lan1:u*'
9

Your network config file is severely messed up.

I'd recommend resetting and starting from scratch. Feel free to make a backup first, but we won't be reusing most of it.

10

I tried my best, get ideas from your comment: https://forum.openwrt.org/t/help-setting-up-vlan-openwrt-23-05/183310?u=h0wreya

I think it's working like a charm, correct me if anything looks wrong.

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdc8:f763:58ec::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '---'

config interface 'wan'
        option device 'wan'
        option proto 'pppoe'
        option username '---'
        option password '---'
        option ipv6 'auto'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan1:t'

config interface 'MAIN'
        option proto 'static'
        option device 'br-lan.10'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'

config interface 'GUEST'
        option proto 'static'
        option device 'br-lan.20'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config interface 'IoT'
        option proto 'static'
        option device 'br-lan.30'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '21'
        option limit '98'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'MAIN'
        option interface 'MAIN'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'GUEST'
        option interface 'GUEST'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'IoT'
        option interface 'IoT'
        option start '100'
        option limit '150'
        option leasetime '12h'

root@OpenWrt:~# cat /etc/config/firewall

tconfig defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'MAIN'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'GuestZone'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'GUEST'

config zone
        option name 'IoTZone'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'IoT'

config forwarding
        option src 'GuestZone'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'IoTZone'

config rule
        option name 'Allow-Guest-DHCP-DNS'
        option src 'GuestZone'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option src 'wan'
        option src_dport '25555'
        option dest_ip '192.168.1.106'
        option dest_port '25555'
1 Like
11

Looks fine. Does it work as expected?

12

Yes. Thank you!

13

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.