Managed Switch or OpenWrt?

Hardware Questions and Recommendations
21

You're correct - the examples linked above show the concepts involved, but do not accomplish your specific case.

Here is an example for a single home network port (lan interface) on port eth1 and three small home office ports (interface SHO) on ports eth2, eth3 and eth4. The home lan has vlan ID 1 and subnet 192.168.1.x. The small home office has vlan ID 10 and subnet 192.168.2.x. Your ISP modem is plugged into port eth0 in this example (wan interface).

In this example ports eth1-eth4 are all bridged on br-lan; however, port eth1 only receives untagged vlan 1 traffic and ports eth2-eth4 only receive untagged vlan 10 traffic. In other words, your home lan and small home office networks are completely isolated from each other. You could also choose to send both lan and SHO to a port or ports by tagging the port(s), provided you attach devices to those ports that understand vlan tags, as mentioned above.

Except for assigning vlan ID 1 to your lan (because it is the default vlan ID assigned to the lan for OpenWrt devices still using swconfig, which I think answers your question about why you would assign a vlan ID to your lan), I recommend numbering additional vlans starting at 10 so that you do not create conflicts with, for example, vlan ID 2 used as the default for the wan on OpenWrt devices still using swconfig.

In this example, I have also assigned two dns servers (Cloudflare and Quad 9, both ipv4 and ipv6 addresses) as a replacement for your ISP's dns server. They don't need to analyze all your dns requests :wink:

I am showing you how to do this with the configuration files, as it would involve too many screen shots of LuCI pages to walk you through everything, so I assume you are able to edit text files on your OpenWrt router. Just in case, here are some helpful commands to log into your router from a command terminal and install the nano editor (if you do not already know how to use vi, you'll find nano easier):

ssh root@192.168.1.1
opkg update
opkg install nano
cd /etc/config
nano network
nano dhcp
nano firewall
exit

Here is the /etc/config/network file (start with the section config device and following):


config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fd59:181c:b2d4::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1'
	list ports 'eth2'
	list ports 'eth3'
	list ports 'eth4'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth0'
	option proto 'dhcp'
	option peerdns '0'
	list dns '1.1.1.2'
	list dns '9.9.9.9'

config interface 'wan6'
	option device 'eth0'
	option proto 'dhcpv6'
	option peerdns '0'
	list dns '2606:4700:4700::1112'
	list dns '2620:fe::fe'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'eth1'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'eth2'
	list ports 'eth3'
	list ports 'eth4'	

config interface 'SHO'
	option proto 'static'
	option device 'br-lan.10'
	option ipaddr '192.168.2.1'
	option netmask '255.255.255.0'

Here are the additions to the /etc/config/dhcp file to give your SHO a DHCP server (add to bottom of file):

#
# Give SHO a DHCP server
#
config dhcp 'SHO'
	option interface 'SHO'
	option start '100'
	option limit '150'
	option leasetime '24h'
	list ra_flags 'none'
#

Here are the additions to the /etc/config/firewall file to give your small home office network access to the internet (add where indicated):

# include a file with users custom iptables rules
config include
	option path /etc/firewall.user

config zone
	option name 'sho'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'SHO'
	option input 'REJECT'

config forwarding
	option src 'sho'
	option dest 'wan'

config rule
	option name 'Allow-sho-DNS'
	option src 'sho'
	option dest_port '53'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'

config rule
	option name 'Allow-sho-DHCP'
	list proto 'udp'
	option src 'sho'
	option target 'ACCEPT'
	option dest_port '67-68'

You did not mention setting up wireless, but this is done by adding SSID's for your home lan network (lan) and/or your small home office network (SHO) and then configure them as desired.

2 Likes