How to create a simple VLAN with DSA?

openwrtforever · May 16, 2023, 4:40am

I am using Linksys WRT1900AC v1 with latest snapshot and trying to play with VLANs with no success.

I want to create a VLAN on port 3 for my NVR camera system. Steps I followed

Network > Interfaces > Devices > Add device configuration
Device Type > 802.1q > Base Device > lan3, VLAN ID 3, Device name = lan3.3

Interfaces > Add new interfaces > Name = NVR, Protocol Static, Device lan3.3
IP 192.168.2.1, firewall NVR
Save

If I unplug the ethernet cable and plug it back on port 3 I am still getting 192.168.1.1 IP range instead of 192.168.2.1
What I am doing wrong?

psherman · May 16, 2023, 5:38am

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

openwrtforever · May 16, 2023, 6:03am

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdfa:d78b:833d::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config device
        option name 'lan1'
        option macaddr 'xxx'

config device
        option name 'lan2'
        option macaddr 'xxx'

config device
        option name 'lan3'
        option macaddr 'xxx'

config device
        option name 'lan4'
        option macaddr 'xxx'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr 'xxx'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type '8021q'
        option ifname 'lan3'
        option vid '3'
        option name 'lan3.3'

config interface 'NVR'
        option proto 'static'
        option device 'lan3.3'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'NVR'
        option interface 'NVR'
        option start '100'
        option limit '150'
        option leasetime '12h'

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'NVR'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'NVR'

psherman · May 16, 2023, 6:26am

Remove this:

Edit br-lan to remove lan4. And create a new bridge with lan4

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'


config device
        option name 'br-nvr'
        option type 'bridge'
        list ports 'lan4'

Then edit your nvr network to use this new bridge:

config interface 'NVR'
        option proto 'static'
        option device 'br-nvr'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

That will fix the main issue. The other issue is that input = reject which means that the router will not respond to dhcp or dns requests from the nvr network, and you don’t have any rules defined to allow these two services. Make input = accept for now - this is the quick way to make sure everything is generally working. You can tighten it down later.

openwrtforever · May 16, 2023, 2:33pm

Looks like it is working. I don't want NVR to access anything, no LAN no WAN, just want computers from LAN to access NVR.

NVR Firewall zone looks like this
NVR => REJECT [accept] [accept] [reject]

Hopefully this firewall zone will block complete LAN and WAN access.

psherman · May 16, 2023, 2:36pm

let's see your current complete firewall file (if it is unchanged from above except for the input = accept I recommended above, let me know and I'll reference that).

openwrtforever · May 16, 2023, 2:37pm

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        option family 'ipv6'
        option target 'ACCEPT'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        option family 'ipv6'
        option target 'ACCEPT'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'NVR'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'NVR'

psherman · May 16, 2023, 2:47pm

The NVR doesn't have any connectivity to or from it currently. You'll want to allow forwarding from lan > NVR if you want to be able to access the NVR from your lan network.

config forwarding
        option src 'lan'
        option dest 'NVR'

And as we know, currently, the NVR zone has input = accept (per my suggestion earlier). If you want to make it so that it has no access to the router itself (except for DNS and DHCP -- see below), you'll change the input rule here to REJECT...

And then add this to allow DHCP and DNS to function:

config rule
        option name 'NVR DHCP/DNS'
        option src 'NVR'
        option dest_port '53 67 68'
        option target 'ACCEPT'

openwrtforever · May 16, 2023, 11:33pm

I made an easy to use setup guide for someone like me who prefers using LUCI.

fakemanhk · May 17, 2023, 1:41am

Just one side notes: For NVR you probably need to allow it to access NTP server (can run it on your router instead of allowing it to connect internet) so that the time won't drift.

openwrtforever · May 17, 2023, 1:47am

My NVR uses NTP server provided by OpenWrt so it is working for several years without the Internet access.

system · May 27, 2023, 1:48am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.