How to configure VLANs correctly

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi everyone,

we just built a house and we have the following components:

  • Netgear R7800 router with OpenWRT

  • Ruckus ICX7150-C12P switch

  • 2x Ruckus R320 APs (one on each level)

I am completely new to Ruckus and VLANs and OpenWRT. My target is to have two VLANs, one for IOT/HomeKit components (we will go with Apple HomeKit for home automation) and the other one for laptops, iPads etc. the iPads should be able to see the IOT components, but not the other way around. I also want to be able to limit the internet access for single IOT components for privacy purposes.

In a second step I would like to channel selected components through Wireguard VPN on the router.

I hope you guys can give me some ideas on how to configure this setup!

Thanks a lot in advance!

2

Well for everything that runs openwrt this are the guides

Also maybe this thread give you some ideas

2 Likes
3

I've been digging through the same documentation. The problems are fairly obvious:

  • for a total beginner re: VLANs, the wiki page is practically useless, as it does not go into detail what exactly the settings do
  • Since OpenWrt switched to DSA, the guides are also incorrect, making it much harder to understand what's going on and what settings your situation needs

Same goes for forum posts. I think the project as a whole would gain a lot from people rewriting most of these guides, based on a recent version, with visualisations, and frequently used solutions used as examples.

3 Likes
4

The WIP is getting whipped; it is a volunteer effort.

5 Likes
5

trouble is there isn't really a 'recent' version with dsa/vlan support... I think a realistic date/goal for such clear documents is around 21.02.2.

yeah... as someone with a background with vlans... even swconfig throws my head sideways... because a router has 'internal' vlans VS 'on-the-wire' vlans... which is REALLY difficult to convey... even to someone who has no problem understanding vlans at all...

I think wholistically DSA makes this abstraction somewhat clearer to an end user...

3 Likes
6

So it seems I made some progress today:

  1. I created a separate WLAN "IOT".
  2. I gave this the VLAN ID 2. The standard connection is VLAN ID 1.
  3. In the Ruckus config one can configure "Isolate wireless client traffic from other clients on the same AP." I did that as well.
  4. On the switch, I tagged the three ports for the Wi-Fi APs and the router as tagged. Now they are "part of both VLANs". Untagged on VLAN 1 and tagged on VLAN 2.

So far, so good. Now, the OpenWRT portion gives me problems. The links above have not been too helpful up until now, unfortunately. Next step is to disable internet access for all clients for VLAN 2.

How do I do that in the OpenWRT LUCI?

Thanks in advance

P.S. I am not using the internal switch of the OpenWRT router.

7

Yes, I'm aware, and I'm not really complaining, rather, just making a statement that the documentation covers the old methods, while users are on the new system, which makes the documentation itself near useless for said users.

It's akin to someone asking about specifics of Windows 10, and someone linking Windows XP/7 guides to achieve the same. Are those documentations valid? Sure. Are they applicable to the current situation? Absolutely not.

1 Like
8

Presumably that is why I pointed at the new DSA wiki pages being worked on, also see the many examples pushed to the tutorial thread.

2 Likes
9

I really like the discussion about the general quality of the documentation.

Can you guys also direct me in the right direction on my issues :slight_smile:

Thanks a lot!