Mini PC x86 many VLAN on 2 ethernet ports

Hi team

I have mini PC with 5 Ethernet ports (let call it "OWRT router"). I have 2 switches connected to this OWRT router.

I'm planing to create home lab with development, staging and production environments. On top of that I have some IoTs, home devices etc.

I would like to create dedicated VLANs managed by OWRT router, to keep services and risks in isolated segments as shown on below picture:

For sure, I would like to allow limited manageable communications between VLANs:

targeted_network_communication

I have installed latest version of OpenWRT (23.05.3), read some OWRT wiki pages and few posts on forum. As result, I have configured OWRT as shown on below schema:

My problem : I can not configure OWRT to share 2 and more VLANs (id 103 AND 104) across 2 ports.

Reproduce the problem:

  1. configure OWRT router as show above (see more details on OpenWRT_experiments )
  2. create VLAN on laptop : ip link add link enp1s0 name enp1s0.103 type vlan id 103
  3. up new VLAN: ip link set dev enp1s0.103 up
  4. ask router to provide laptop with IP address: dhclient -d -nw enp1s0.103
  5. Monitor IP traffic on br-rght bridge on OWRT router: tcpdump -ne -i br-rght
# success, we have VLAN ID 103 incoming packages to br-rght bridge:

21:11:12.638252 50:7b:9d:64:c9:bb > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 103, p 0, ethertype IPv4 (0x0800), 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 50:7b:9d:64:c9:bb, length 300
21:11:31.510623 50:7b:9d:64:c9:bb > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 103, p 0, ethertype IPv4 (0x0800), 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 50:7b:9d:64:c9:bb, length 300
21:11:40.029741 50:7b:9d:64:c9:bb > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 346: vlan 103, p 0, ethertype IPv4 (0x0800), 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 50:7b:9d:64:c9:bb, length 300
  1. Monitor IP traffic on bridge VLAN: tcpdump -ne -i br-rght.103
# oops, VLAN packages are converted into untagged ones:

21:14:43.653446 50:7b:9d:64:c9:bb > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 50:7b:9d:64:c9:bb, length 300
21:14:51.244139 50:7b:9d:64:c9:bb > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 50:7b:9d:64:c9:bb, length 300
21:15:09.914862 50:7b:9d:64:c9:bb > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 50:7b:9d:64:c9:bb, length 300
  1. Monitor IP traffic on bridge mid: tcpdump -ne -i br-mid
# packets do not reach br-mid  : (

Question: how to configure OWRT router to allow some VLANs go to eth port 6 only (it works with above config), some VLANs go to eth port 7 only (it works with above config), some VLANs go to both eth 6 an7 ports (doesn't work with above config)?

More details you can fin on my GitHub repo OpenWRT_experiments as well as in below output:

ubus call system board
{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "Intel(R) Atom(TM) CPU C3758R @ 2.40GHz",
	"model": "Default string QDNV01",
	"board_name": "default-string-qdnv01",
	"rootfs_type": "ext4",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "x86/64",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdc0:c328:4e46::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	option ipv6 '0'
	list ports 'eth4'
	list ports 'eth5'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth8'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth8'
	option proto 'dhcpv6'

config device
	option type 'bridge'
	option name 'br-left'
	list ports 'eth7'
	option ipv6 '0'

config bridge-vlan
	option device 'br-left'
	option vlan '102'
	list ports 'eth7:t'

config bridge-vlan
	option device 'br-left'
	option vlan '103'
	list ports 'eth7:t'

config bridge-vlan
	option device 'br-left'
	option vlan '104'
	list ports 'eth7:t'

config device
	option type 'bridge'
	option name 'br-rght'
	list ports 'eth6'
	option ipv6 '0'

config bridge-vlan
	option device 'br-rght'
	option vlan '101'
	list ports 'eth6:t'

config bridge-vlan
	option device 'br-rght'
	option vlan '103'
	list ports 'eth6:t'

config bridge-vlan
	option device 'br-rght'
	option vlan '104'
	list ports 'eth6:t'

config interface 'stg'
	option proto 'static'
	option device 'br-left.102'
	option ipaddr '192.168.102.1'
	option netmask '255.255.255.0'

config interface 'dev'
	option proto 'static'
	option device 'br-rght.101'
	option ipaddr '192.168.101.1'
	option netmask '255.255.255.0'

config device
	option type 'bridge'
	option name 'br-mid'
	list ports 'br-left.103'
	list ports 'br-left.104'
	list ports 'br-rght.103'
	list ports 'br-rght.104'

config bridge-vlan
	option device 'br-mid'
	option vlan '103'
	list ports 'br-left.103:t'
	list ports 'br-rght.103:t'

config bridge-vlan
	option device 'br-mid'
	option vlan '104'
	list ports 'br-left.104:t'
	list ports 'br-rght.104:t'

config interface 'prod'
	option proto 'static'
	option device 'br-mid.103'
	option ipaddr '192.168.103.1'
	option netmask '255.255.255.0'

config interface 'iot'
	option proto 'static'
	option device 'br-mid.104'
	option ipaddr '192.168.104.1'
	option netmask '255.255.255.0'



cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'stg'
	option interface 'stg'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'dev'
	option interface 'dev'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'prod'
	option interface 'prod'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'

There are two ways to approach this:

  1. put all ports in a single bridge and then use bridge-vlan syntax (like you have done) to specify the VLAN port membership and tagging status.

or

  1. use dotted notation and setup bridges with the dotted notation on the ports. An example below (not following your specific schema, but you'll see how it works):
config device
	option name 'br-vlan10'
	option type 'bridge'
	list ports 'eth4.10'
	list ports 'eth5.10'
  1. usually makes more sense on x86_64 with multiple individual network cards.
1 Like