How to connect VLANs to internet?

sh11 · February 25, 2022, 8:16am

I create a new VLAN with id 3, when I connect my computer to this vlan I can't access the internet. So can I allow the vlan to access the internet, if yes is there is a link that can help me ?

Thanks.

flygarn12 · February 25, 2022, 8:42am

Firewal forward from your vlan3 (in your case) to wan.

Just copy the concept for the standard default lan to wan forward. But change lan to your new firewall zone for your interface connected to your new vlan.

sh11 · February 25, 2022, 9:29am

I added my interface in lan zone, but in which field should I add the rule, please if you can explain more.

flygarn12 · February 25, 2022, 10:09am

General settings and in the zone settings for the zone to your vlan

slh · February 25, 2022, 10:31am

Don't don't do that, give it its own firewall zone and its own firewall rules.

sh11 · February 28, 2022, 9:39am

These my settings and still vlan 1 can't reach internet. What's the problem brothers ?

sh11 · February 28, 2022, 10:34am

These my settings and still vlan 1 can't reach internet. What's the problem brothers ?

flygarn12 · February 28, 2022, 10:58am

You can’t have both wan and vlan2 in the same internet zone.

I repeat my self! You go to GENERAL SETTINGS tab!

sh11 · February 28, 2022, 2:42pm

I create a zone for VLAN 2, and in firewall allow lan to go to vlan2 and vise versa and still lan can't go to internet.

vlan2
lan

lleachii · February 28, 2022, 2:49pm

Allow forward from VALN2 to WAN.

Why did you edit the LAN zone?

You'll need to fix that.

psherman · February 28, 2022, 3:36pm

Vlan2 has 2 addresses associated with it - one of the overlaps the main lan (192.168.1.241/32 exists within 192.168.100.0/24). Remove that address from vlan2

sh11 · March 1, 2022, 9:56am

I create a zone for vlan 2 which include the port of wan by default, and I allow forward between zones as shown in picture below, but still lan can't access to internet.

Any suggestions please.
lan
vlan2

psherman · March 1, 2022, 3:38pm

Add forwarding from lan > wan (but not the other way around)
Enable masquerading on the wan zone.
Also set the wan zone to reject input and forward, and remove the forwarding from wan > vlan2

sh11 · March 2, 2022, 11:15am

Brother these are my settings, still vlan 2 can't access to internet.
What do you think is the problem ?

psherman · March 2, 2022, 3:40pm

Your VLANs are in the same subnet. They must be different subnets.

If you keep your lan in 192.168.100.0/24, make the other one something like 192.168.101.0/24.

Remove the gateway addresses. They are wrong.

Btw, where is the upstream connection being made? Is there a wan port? What is the address on that port?

Remove the forwarding from wan > lan and wan > vlan2.

sh11 · March 3, 2022, 9:20am

brother, these are my new settings, I can ping my router from vlan 2 but still cannot access to internet, so what should I change in these settings ?

psherman · March 3, 2022, 2:11pm

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcpw
cat /etc/config/firewall

sh11 · March 3, 2022, 2:17pm

root@OpenWrt:/# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd58:0841:d787::/48'

config atm-bridge 'atm'
        option vpi '1'
        option vci '32'
        option encaps 'llc'
        option payload 'bridged'
        option nameprefix 'dsl'

config dsl 'dsl'
        option annex 'a'
        option tone 'av'
        option ds_snr_offset '0'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.100.240'
        option netmask '255.255.255.0'
        list dns '1.1.1.1'
        option ip6assign '60'

config device
        option name 'dsl0'
        option macaddr 'e8:94:f6:0f:54:b3'

config interface 'wan'
        option device 'dsl0'
        option proto 'pppoe'
        option username 'username'
        option password 'password'
        option ipv6 '1'

config interface 'wan6'
        option device '@wan'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '2 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 5 6t'
        option vid '2'

config device
        option name 'eth0.2'
        option type '8021q'
        option ifname 'eth0'
        option vid '2'
        option mtu '1500'
        option macaddr 'E8:94:F6:0F:54:B2'

config interface 'vlan2'
        option proto 'static'
        option device 'eth0.2'
        option netmask '255.255.255.0'
        option broadcast '192.168.110.255'
        option ipaddr '192.168.110.33'

root@OpenWrt:/# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

root@OpenWrt:/# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'vlan2'
        option interface 'vlan2'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list ra_flags 'none'

root@OpenWrt:/# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled 'false'

config include
        option path '/etc/firewall.user'

config zone
        option name 'vlan2'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan2'
        option forward 'ACCEPT'

config forwarding
        option src 'vlan2'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'vlan2'

psherman · March 3, 2022, 3:04pm

add this:

config forwarding
        option src 'vlan2'
        option dest 'wan'

sh11 · March 3, 2022, 3:33pm

Still brother there is no internet connection.

root@OpenWrt:/# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled 'false'

config include
        option path '/etc/firewall.user'

config zone
        option name 'vlan2'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'vlan2'
        option forward 'ACCEPT'

config forwarding
        option src 'vlan2'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'vlan2'

config forwarding
        option src 'vlan2'
        option dest 'wan'