Inter-VLAN routing / access

thimplicity · February 5, 2022, 9:02pm

Hi everyone,
after my initial VLAN setup last year I made the big mistake to "just add one more". The new VLAN works from a DHCP and WAN perspective and I can ping the respective machine in that new WLAN from the router / the management VLAN. Unfortunately, I cannot do that from the other VLANs, although I copied the configuration for interfaces, devices, DHCP and firewall from a VLAN that works well.

I cannot ping between or access between VLANs. Any ideas? I assume it has something to do with the firewall settings. I already added the forwarding rules back and forth between the VLANs

psherman · February 5, 2022, 9:04pm

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Tech_Junky · February 5, 2022, 9:05pm

Just need a route to the VL to let the others know it's there.

Why create different VL's if you're letting them all see and speak to each other?

thimplicity · February 6, 2022, 1:23pm

Here we go:

network


config interface 'loopback'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
	option device 'lo'

config globals 'globals'
	option ula_prefix '...'

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option device 'br-lan'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth0.2'
	option metric '20'

config interface 'wan6'
	option proto 'dhcpv6'
	option device 'eth0.2'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '1'
	option ports '2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 5'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '3'
	option ports '1 4t 6t'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1.1'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option vid '5'
	option ports '4t 6t'

config switch_vlan
	option device 'switch0'
	option vlan '5'
	option vid '15'
	option ports '4t 6t'

config switch_vlan
	option device 'switch0'
	option vlan '6'
	option vid '10'
	option ports '4t 6t'

config switch_vlan
	option device 'switch0'
	option vlan '7'
	option vid '20'
	option ports '4t 6t'

config interface 'VLAN_SERVER'
	option proto 'static'
	option device 'eth1.3'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

config interface 'VLAN_Home'
	option proto 'static'
	option device 'eth1.5'
	option ipaddr '192.168.5.1'
	option netmask '255.255.255.0'

config interface 'VLAN_IOT'
	option proto 'static'
	option device 'eth1.10'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config interface 'VLAN_KIDS'
	option proto 'static'
	option device 'eth1.15'
	option ipaddr '192.168.15.1'
	option netmask '255.255.255.0'

config interface 'VLAN_GUESTS'
	option proto 'static'
	option device 'eth1.20'
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'

config interface 'wg0'
	option proto 'wireguard'
	option private_key '...'
	list addresses '...'
	list addresses '...'
	option metric '10'

config wireguard_wg0
	option description '...'
	option public_key '...'
	list allowed_ips '::0/0'
	list allowed_ips '0.0.0.0/0'
	option route_allowed_ips '1'
	option endpoint_host '...'
	option endpoint_port '51820'

config interface 'wg1'
	option proto '...'
	option private_key '...'
	list addresses '...'
	list addresses '...'
	option peerdns '0'
	list dns '...'
	option metric '30'

config wireguard_wg1
	option description '...'
	option public_key '...'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::0/0'
	option endpoint_host '...'
	option endpoint_port '51820'

dhcp (I have quite some hosts configured, I took most of them out and just left two as an example, but I do not think it is relevant)


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option cachesize '1000'
	option noresolv '1'
	option port '5353'
	list server '192.168.1.1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list dhcp_option '6,192.168.1.1'
	list dhcp_option '3,192.168.1.1'
	option leasetime '24h'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'
	list ra_flags 'none'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'VLAN_SERVER'
	option interface 'VLAN_SERVER'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,192.168.3.1'
	list dhcp_option '3,192.168.3.1'
	list ra_flags 'none'

config dhcp 'VLAN_Home'
	option interface 'VLAN_Home'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,192.168.5.1'
	list dhcp_option '3,192.168.5.1'
	list ra_flags 'none'

config dhcp 'VLAN_IOT'
	option interface 'VLAN_IOT'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,192.168.10.1'
	list dhcp_option '3,192.168.10.1'
	list ra_flags 'none'

config dhcp 'VLAN_KIDS'
	option interface 'VLAN_KIDS'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,192.168.15.1'
	list dhcp_option '3,192.168.15.1'
	list ra_flags 'none'

config dhcp 'VLAN_GUESTS'
	option interface 'VLAN_GUESTS'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list dhcp_option '6,192.168.20.1'
	list dhcp_option '3,192.168.20.1'
	list ra_flags 'none'

config host
	option ip '...'
	option mac '...'
	option name 'Apple-TV'
	option dns '1'

config host
	option ip '...'
	option mac '...'
	option name 'Laptop'
	option dns '1'

firewall


config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option name 'VLAN_HOME'
	list network 'VLAN_Home'

config forwarding
	option dest 'wan'
	option src 'VLAN_HOME'

config zone
	option name 'VLAN_IOT'
	option output 'ACCEPT'
	option input 'DROP'
	option forward 'DROP'
	list network 'VLAN_IOT'

config zone
	option name 'VLAN_KIDS'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option input 'REJECT'
	list network 'VLAN_KIDS'

config forwarding
	option src 'VLAN_KIDS'
	option dest 'wan'

config zone
	option name 'VLAN_GUESTS'
	option output 'ACCEPT'
	option input 'REJECT'
	option forward 'REJECT'
	list network 'VLAN_GUESTS'

config forwarding
	option src 'VLAN_GUESTS'
	option dest 'wan'

config rule
	option name 'Allow-DNS-IOT'
	option src 'VLAN_IOT'
	option target 'ACCEPT'
	option dest_port '53'

config rule
	option name 'Allow-DHCP-IOT'
	option src 'VLAN_IOT'
	option target 'ACCEPT'
	option dest_port '67 68'

config rule
	option src 'VLAN_GUESTS'
	option dest_port '53'
	option target 'ACCEPT'
	option name 'Allow-DNS-Guests'

config rule
	option name 'Allow-DHCP-Guests'
	option src 'VLAN_GUESTS'
	option target 'ACCEPT'
	option dest_port '67 68'

config forwarding
	option src 'VLAN_HOME'
	option dest 'VLAN_IOT'

config forwarding
	option src 'VLAN_HOME'
	option dest 'VLAN_KIDS'

config rule
	option name 'Allow-DNS-Kids'
	option src 'VLAN_KIDS'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCP-Kids'
	option src 'VLAN_KIDS'
	option target 'ACCEPT'
	option dest_port '67 68'

config forwarding
	option src 'lan'
	option dest 'VLAN_HOME'

config forwarding
	option src 'lan'
	option dest 'VLAN_IOT'

config rule
	option name 'Allow mDNS'
	option src '*'
	option src_port '5353'
	list dest_ip '...'
	option dest_port '5353'
	option target 'ACCEPT'
	list proto 'udp'

config rule
	option dest 'VLAN_IOT'
	option target 'ACCEPT'
	option name 'Allow-Home-to-IOT'
	option src 'VLAN_HOME'
	option src_port '80 443'
	option dest_port '80 443'

config rule
	option src 'lan'
	option src_port '80 443'
	option dest 'VLAN_IOT'
	option dest_port '80 443'
	option target 'ACCEPT'
	option name 'Allow-LAN-to-IOT'

config rule
	option src 'VLAN_IOT'
	option dest 'VLAN_HOME'
	list dest_ip '192.168.5.90'
	option target 'ACCEPT'
	option name 'Allow-IOT-to-...'
	option dest_port '53221'

config rule
	option name 'Allow-...'
	option src 'VLAN_IOT'
	option dest 'wan'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'
	list src_ip '192.168.10.168'
	list src_ip '192.168.10.221'

config forwarding
	option src 'VLAN_IOT'
	option dest 'wan'

config rule
	option src 'VLAN_KIDS'
	option dest 'VLAN_HOME'
	list dest_ip '192.168.5.95'
	option target 'ACCEPT'
	option name 'Allow-Kids-to-...'

config rule
	option src 'VLAN_HOME'
	option dest 'lan'
	list dest_ip '192.168.1.1'
	list dest_ip '192.168.1.5'
	list dest_ip '192.168.1.199'
	option target 'ACCEPT'
	option name 'Allow-Home-to-...'

config zone
	option name 'vpn'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wg0'
	option input 'REJECT'
	option masq '1'

config forwarding
	option src 'lan'
	option dest 'vpn'

config forwarding
	option src 'VLAN_HOME'
	option dest 'vpn'

config forwarding
	option src 'VLAN_KIDS'
	option dest 'vpn'

config forwarding
	option src 'VLAN_IOT'
	option dest 'vpn'

config forwarding
	option src 'VLAN_GUESTS'
	option dest 'vpn'

config zone
	option name 'vpn2'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wg1'
	option input 'REJECT'
	option masq '1'

config forwarding
	option src 'VLAN_HOME'
	option dest 'vpn2'

config rule
	option name 'Allow-...-to-wan'
	option src 'VLAN_HOME'
	option dest 'wan'
	option target 'ACCEPT'
	list src_ip '192.168.5.90'
	option src_port '53221'

config forwarding
	option src 'VLAN_KIDS'
	option dest 'VLAN_IOT'

config forwarding
	option src 'VLAN_HOME'
	option dest 'lan'

config zone
	option name 'VLAN_SERVER'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'VLAN_SERVER'
	option forward 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'VLAN_SERVER'

config forwarding
	option src 'VLAN_HOME'
	option dest 'VLAN_SERVER'

config forwarding
	option src 'VLAN_SERVER'
	option dest 'VLAN_IOT'

config forwarding
	option src 'VLAN_SERVER'
	option dest 'vpn'

config forwarding
	option src 'VLAN_SERVER'
	option dest 'wan'

config forwarding
	option src 'VLAN_SERVER'
	option dest 'VLAN_HOME'

config forwarding
	option src 'VLAN_SERVER'
	option dest 'lan'

config rule
	option name 'test'
	option src 'VLAN_HOME'
	option dest 'VLAN_SERVER'
	option target 'ACCEPT'

I do not use wifi on the router.

Overall, I opened the rules up too much to get it working and then I plan to narrow them down again. If there is a good link somewhere on how to do this properly, it would be cool, if you could share.

edit: I use AdGardHome on th erouter as well as DNS server.

thimplicity · February 6, 2022, 1:26pm

The setup I had worked fine with separating them and not let everyone see everyone, but for testing and troubleshooting the new one I opened it up more to find out why it is not working.

psherman · February 6, 2022, 11:12pm

You've got quite a few VLANs.

Which ones are having trouble connecting to the others? And when you try to connect from one VLAN to another, what hosts are involved (operating systems)?

thimplicity · February 7, 2022, 2:53am

I am trying to connect between home (vlan 5) and server (vlan 3 - the new one). I have mostly testing with a MacBook being in 5 and a windows laptop being in 3.

psherman · February 7, 2022, 3:02am

Nothing stands out to me as problematic in the OpenWrt configuration.

Check your Windows firewall -- it may be blocking connections from other subnets. By default, Windows will reject traffic coming from a different subnet.

thimplicity · February 7, 2022, 2:25pm

So the solution was two-fold:

Reboot the router ......... should have done that earlier
Open the Windows firewall for different subnets

system · February 17, 2022, 2:25pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.