How to setup vlans for dynamic PSK on router with 1 SSID?

[SkyCrw]

Hi all,

I want to setup a couple of vlans for dynamic PSK on a linksys ea8300 router using 1 SSID and also pass these vlans to 1 Lan port which will feed another ea8300 router which will act as a dumb AP.

Hope anyone can help point me in the right direction, I am not new to openwrt but haven't set up a Dpsk before on openwrt and also haven't set up Vlan using the DSA switch before.

I read this topic: Individual per-passphrase Wifi VLANs using wpa_psk_file (no RADIUS required)
but I couldn't get enough out of it to make my setup work.

[NPeca75]

hi @SkyCrw

if this help you ... i will paste my working configs, so you could learn and adapt for your need

vlan1 unused
vlan2,100,200,255 is used and attached to WIFI
vlan255 is management

cat /etc/config/network 

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config device
        option type 'bridge'
        option vlan_filtering '1'
        option name 'switch'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'switch'
        option vlan '1'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'switch'
        option vlan '2'
        list ports 'lan4:t'

config bridge-vlan
        option device 'switch'
        option vlan '100'
        list ports 'lan4:t'

config bridge-vlan
        option device 'switch'
        option vlan '200'
        list ports 'lan4:t'

config bridge-vlan
        option device 'switch'
        option vlan '255'
        list ports 'lan4:t'

config interface 'vlan1'
        option device 'switch.1'
        option proto 'none'

config interface 'vlan2'
        option proto 'none'
        option device 'switch.2'

config interface 'vlan100'
        option proto 'none'
        option device 'switch.100'

config interface 'vlan200'
        option proto 'none'
        option device 'switch.200'

config interface 'vlan255'
        option proto 'static'
        option device 'switch.255'
        option ip6addr 'fd00:1:255::103/64'
        option ipaddr '169.254.1.103/24'
        list dns 'fd00:1:255::1'
        list dns '169.254.1.1'

cat /etc/config/wireless 

config wifi-iface 'wifinet0'
        option device 'radio0'
        option network 'vlan2'
        option mode 'ap'
        option ssid 'ele-AP'
        option encryption 'psk2'
        option key 'passForVlan2'
        option wmm '1'
        option short_preamble '1'
        option disassoc_low_ack '0'
        option max_inactivity '120'
        option isolate '1'
        option disabled '0'
        option ifname 'wlan0'
        option multicast_to_unicast_all '1'

config wifi-iface 'wifinet1'
        option device 'radio1'
        option network 'vlan2'
        option mode 'ap'
        option ssid 'ele5-AP'
        option encryption 'psk2'
        option key 'passForVlan2'
        option wmm '1'
        option short_preamble '1'
        option disassoc_low_ack '0'
        option max_inactivity '120'
        option isolate '1'
        option disabled '0'
        option ifname 'wlan1'
        option multicast_to_unicast_all '1'

config wifi-vlan
        option name 'vl100'
        option network 'vlan100'
        option vid '100'

config wifi-station
        option key 'passForVlan100'
        option vid '100'

config wifi-vlan
        option name 'vl200'
        option network 'vlan200'
        option vid '200'

config wifi-station
        option key 'passForVlan200'
        option vid '200'

config wifi-vlan
        option name 'vl255'
        option network 'vlan255'
        option vid '255'

config wifi-station
        option key 'passForVlan255'
        option vid '255'

[SkyCrw]

Hi @NPeca75 thanks for replying and sharing your config.
could you share some info on what this config does ?

If I understand it correctly, the way you have it set up means, the vlan changes based on the input password, I see one configured for vlan 100, vlan 200 and vlan 255.
And all vlans are assigned as tagged to lan port 4 except vlan 1 is untagged

Would this configuration be reflected in luci GUI too or will it only be visible via cli ?

[NPeca75]

@SkyCrw

I see one configured for vlan 100, vlan 200 and vlan 255

there is "default" wifi vlan which is vlan2

config wifi-iface 'wifinet0'
        option device 'radio0'
        option network 'vlan2'

so, you have 4 different vlans on one SSID

@SkyCrw

And all vlans are assigned as tagged to lan port 4 except vlan 1 is untagged

yes

@SkyCrw

configuration be reflected in luci GUI too

yes, at least for network devices/interfaces
to be honest, i would not dare to touch anything in Luci in wireless section after putting this config

@SkyCrw

vlan 1 is untagged

yes, untagged, and unused
so either you change this and put static address on vlan1
or ...
you need the way to access your OWRT on vlan255 (tagged)
or from the WIFI with vlan255 password

[SkyCrw]

okay I understand somewhat better now.
Do you use the same vlans for wired network devices too?

@NPeca75

i would not dare to touch anything in Luci in wireless section after putting this config

I see, so how/where did you configure if any dhcp pools for the vlans ?
Also would I need to configure firewall rules for these ?

@NPeca75

yes, untagged, and unused
so either you change this and put static address on vlan1
or ...
you need the way to access your OWRT on vlan255 (tagged)
or from the WIFI with vlan255 password

Semi confused on this part, this only applies for connections from my 2nd router / dumb AP correct ? because if I connect directly to a lan port on the main router I could still connect to OWRT
Also curious about this, if I understand the config correctly you access management using ipv6 ?

[NPeca75]

@SkyCrw

Do you use the same vlans for wired network devices too?

yes
ok, in my example, only lan4 is used as trunk port since i using this device s dumb ap, wifi only, but ... nothing stops you to add lan1,2,3 to some vlan

config bridge-vlan
        option device 'switch'
        option vlan '200'
        list ports 'lan4:t'
list ports 'lan1:u*' <== add this line
list ports 'lan2:u*' <== add this line

so you will have vlan200 on lan1 & 2 as untagged,native

@SkyCrw

so how/where did you configure if any dhcp pools for the vlans ?

since LuCI will not mess network/interfaces/devices/firewall, you could use LuCI for this. Only place where LuCI is problematic is wireless, because LuCI does not know about dynamic vlans and how to configure

@SkyCrw

if I understand the config correctly you access management using ipv6

using both, v4 (169.254.x.x) and v6 (fd00:1::xxx)

@SkyCrw

Semi confused on this part, this only applies for connections

suppose that you will need to access your OWRT router for management ?
i give you recipe how

[SkyCrw]

thanks alot for all the info @NPeca75 , I'm ready to go try and configure it now.
I have one last question, to configure the internal wifi on the main router would use the same config ? I'm trying to visualize in my head how to do it before I start.

[SkyCrw]

I've adjusted the given config to suit my needs and everything looks fine in luci and the passwords for the vlans work, I only have 1 issue when I try the wifi it doesn't give me an IP address, I left 1 wifi radio without vlan just to be able to access to router while setting up.

Now that I'm thinking about it, is this config tailored for the "dumb AP" router 2 and the vlans should get the ip's from dhcp pools on the main router, is this assumption correct ?
here are my configs:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd39:b6a4:8f77::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        option vlan_filtering '1'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'switch'
        option vlan '20'
        list ports 'lan4:t'

config bridge-vlan
        option device 'switch'
        option vlan '30'
        list ports 'lan4:t'

config bridge-vlan
        option device 'switch'
        option vlan '40'
        list ports 'lan4:t'

config bridge-vlan
        option device 'switch'
        option vlan '260'
        list ports 'lan4:t'

config interface 'vlan20'
        option proto 'none'
        option device 'switch.20'

config interface 'vlan30'
        option proto 'none'
        option device 'switch.30'

config interface 'vlan40'
        option proto 'none'
        option device 'switch.40'

config interface 'vlan260'
        option proto 'none'
        option device 'switch.260'
        option ipaddr '169.254.1.101/24'
        list dns '169.254.1.1'

config device
        option name 'lan1'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan2'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan3'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan4'
        option macaddr 'e8:9f:80:a2:c6:fa'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr 'e8:9f:80:a2:c6:f9'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/40000000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel 'auto'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option country 'AW'
        option txpower '20'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'vlan20'
        option mode 'ap'
        option ssid 'TEST 2'
        option encryption 'psk2'
        option key '12345678'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/a000000.wifi'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option country 'AW'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'TEST'
        option encryption 'psk2'
        option key '12345678'

config wifi-device 'radio2'
        option type 'mac80211'
        option path 'platform/soc/a800000.wifi'
        option channel '48'
        option band '5g'
        option htmode 'VHT80'
        option country 'AW'
        option cell_density '0'
		
config wifi-iface 'default_radio2'
        option device 'radio2'
        option network 'vlan20'
        option mode 'ap'
        option ssid 'TEST 3'
        option encryption 'psk2'
        option key '12345678'

config wifi-vlan
        option name 'vl30'
        option network 'vlan30'
        option vid '30'

config wifi-station
        option key 'passVlan30'
        option vid '30'

config wifi-vlan
        option name 'vl40'
        option network 'vlan40'
        option vid '40'

config wifi-station
        option key 'passVlan40'
        option vid '40'

config wifi-vlan
        option name 'vl260'
        option network 'vlan260'
        option vid '260'

config wifi-station
        option key 'passVlan260'
        option vid '260'

[NPeca75]

Hi

@SkyCrw

I try the wifi it doesn't give me an IP address

because you messed up configs

@SkyCrw

config device
        option name 'br-lan'
        option type 'bridge'

@SkyCrw

config bridge-vlan
        option device 'switch'
        option vlan '20'

see? you renamed bridge to 'br-lan', and later you using device 'switch'

[SkyCrw]

@NPeca75

see? you renamed bridge to 'br-lan', and later you using device 'switch'

ahhh I see, yes indeed, the br-lan was auto assigned name when I installed OWRT..
I will make the changes when I get home and try again

[SkyCrw]

oke so I've made some changes to the config, I feel like I'm very close to having it done but I am missing some small parts, where do I setup the dhcp pools, would this be in interfaces ?

@NPeca75

there is "default" wifi vlan which is vlan2

in your config vlan2 is tagged, wouldn't this mean you have to configure vlan2 on all your devices for it to work ?

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd95:f630:65c6::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '40'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '260'
        list ports 'lan4:t'
		
config interface 'vlan1'
        option proto 'none'
        option device 'br-lan.1'

config interface 'vlan20'
        option proto 'none'
        option device 'br-lan.20'

config interface 'vlan30'
        option proto 'none'
        option device 'br-lan.30'

config interface 'vlan40'
        option proto 'none'
        option device 'br-lan.40'

config interface 'vlan260'
        option proto 'none'
        option device 'br-lan.260'
        option ipaddr '169.254.1.101/24'
        list dns '169.254.1.1'

config device
        option name 'lan1'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan2'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan3'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan4'
        option macaddr 'e8:9f:80:a2:c6:fa'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
		
config device
        option name 'wan'
        option macaddr 'e8:9f:80:a2:c6:f9'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

[NPeca75]

@SkyCrw

oke so I've made some changes to the config

...and it is wrong again

@SkyCrw

config interface 'lan'
        option device 'br-lan'

did you see in my config something similar ?
to reference a "whole" device without dot ?
i think not
and .. please, could you explain, how interface section will match with this?

@SkyCrw

config wifi-vlan
        option name 'vl260'
        option network 'vlan260'

for example, how network 'vlan260' will match your "fantasy" name interface 'lan' ??

@SkyCrw

where do I setup the dhcp pools

and now, the main question
you want to setup main router ? or dumb AP ?

@SkyCrw

vlan2 is tagged, wouldn't this mean you have to configure vlan2 on all your devices

could you ask this question in another way? i really don't understand

maybe, after all, you should exactly say what you want

for ex:
i want DumbAP with vlan 10,20,30 for wifi and vlan1 for management
or
i want Main Router with vlan 10,20,30 for wifi and one trunk port for downstream to DumbAP

[SkyCrw]

@NPeca75

...and it is wrong again

I thought the br-lan was just a name and had to be the same in all instances
I guess I don't understand it, yes I did see that your config only has "switch" in all instances

@NPeca75

for example, how network 'vlan260' will match your "fantasy" name interface 'lan' ??

I guess I'm further away to getting done than I thought

in my mind I assumed I would have to change to vlan interface protocol to static and set up dhcp

@NPeca75

and now, the main question
you want to setup main router ? or dumb AP ?

Yes I'm trying to setup main router (afterwards my current active router will get upgraded to new OWRT and become dumb AP)

@NPeca75

could you ask this question in another way? i really don't understand

To my understanding a tagged vlan would require devices to have a vlan number configured on the interface they are using to connect, let say a windows pc, I would have to configure the vlan number to be tagged, but maybe I'm confusing wired connections ?

@NPeca75

maybe, after all, you should exactly say what you want

this is what I'm trying to accomplish;

i want Main Router with vlan 1 untagged ,20,30 tagged for wifi and one trunk port for downstream to DumbAP

I'm sorry to bother you so much will all these questions you've been great help so far, even though I've messed the config up numerous times I am learning a lot by your input

[NPeca75]

ok, last question
vlan1, do you want vlan1 to appear on WIFI ?

[SkyCrw]

@NPeca75

vlan1, do you want vlan1 to appear on WIFI ?

yes only to see the difference with the tagged vlans, I might disable it later

[NPeca75]

OK
copy & paste to your device & reboot

edit:
vlan1 is untagged on all LAN
LAN4 is trunk
since we still using "fantasy name" 'lan', dhcp server on vlan1 will work out of box
for other vlan's, you will need to setup dhcp server from LuCI

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config device
        option name 'lan1'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan2'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan3'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'lan4'
        option macaddr 'e8:9f:80:a2:c6:fa'

config device
        option name 'wan'
        option macaddr 'e8:9f:80:a2:c6:f9'

config device
        option type 'bridge'
        option vlan_filtering '1'
        option name 'br-lan'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '40'
        list ports 'lan4:t'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'vlan10'
        option device 'br-lan.10'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        
config interface 'vlan20'
        option device 'br-lan.20'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config interface 'vlan30'
        option device 'br-lan.30'
        option proto 'static'
        option ipaddr '192.168.30.1'
        option netmask '255.255.255.0'
        
config interface 'vlan40'
        option device 'br-lan.40'
        option proto 'static'
        option ipaddr '192.168.40.1'
        option netmask '255.255.255.0'
        
config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

/etc/config/wireless

config wifi-iface 'wifinet0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'AP24G'
        option encryption 'psk2'
        option key 'Vlan1Pass'
        option wmm '1'
        option short_preamble '1'
        option disassoc_low_ack '0'
        option max_inactivity '120'
        option isolate '1'
        option disabled '0'
        option ifname 'wlan0'
        option multicast_to_unicast_all '1'

config wifi-iface 'wifinet1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'AP58G'
        option encryption 'psk2'
        option key 'Vlan1Pass'
        option wmm '1'
        option short_preamble '1'
        option disassoc_low_ack '0'
        option max_inactivity '120'
        option isolate '1'
        option disabled '0'
        option ifname 'wlan1'
        option multicast_to_unicast_all '1'


config wifi-vlan
        option name 'vl10'
        option network 'vlan10'
        option vid '10'

config wifi-station
        option key 'Vlan10Pass'
        option vid '10'

config wifi-vlan
        option name 'vl20'
        option network 'vlan20'
        option vid '20'

config wifi-station
        option key 'Vlan20Pass'
        option vid '20'

config wifi-vlan
        option name 'vl30'
        option network 'vlan30'
        option vid '30'

config wifi-station
        option key 'Vlan30Pass'
        option vid '30'

config wifi-vlan
        option name 'vl40'
        option network 'vlan40'
        option vid '40'

config wifi-station
        option key 'Vlan40Pass'
        option vid '40'

[SkyCrw]

thanks a lot for all your help @NPeca75, I was a bit occupied and didn't have a moment to test this yet, will try it later today

[SkyCrw]

I'm back, just tried out the config you posted and it works exactly like I wanted!
I will read thru the config a few more times to fully understand it

[SkyCrw]

if I may ask one more thing, what do you mean with this ;

@NPeca75

since we still using "fantasy name" 'lan'

I didn't configure it like that, it came like that after flashing OWRT, would it have been better to not have it ?

[NPeca75]

Hi @SkyCrw

no, don't feel bad about it

i am against using this practice, because if you look at config, what we have?

device br-lan
interface 'lan'
and phy rj45 called lan1,2,3,4
so, LAN everywhere
and on top of it, there is dots like lan.2
it could be (it IS) confusing

since you using "advanced" mode, dealing with vlans, in my first example i tried to teach you trough config what is what

switch is internal switch
and interface is vlanX

but, since OWRT default (firewall & dhcp) points to fantasy "lan" it was easier for you to adopt default "lan" name at least for vlan1 and be able to access your device

so, everything is okay, at least, from "it is working, yeahhhh" point of view

other point is:
using vlan1 for management is suicide
using config with vlans without fully understand vlans, tagged, untagged, internal switch, etc ... is ...