Multiple vlan interfaces with dhcp

Installing and Using OpenWrt Network and Wireless Configuration
#1

Hi,

I've been using pfSense for the last couple of years as router and I think about switching back to OpenWrt. Most important to me is the fact that there's Hardware NAT support and the fact that OpenWrt is slim af.

What's bothering me is the fact that I'm using multiple vlans with dedicated DHCP server settings for each interface. That's what at least the GUI of OpenWrt does not offer but only global settings.

Is there a way to work this round?
Thank you

#2

I have exactly that configuration (three extra VLANs), each with it's own DHCP configuration, all configured through the GUI, and it works well.

Here is what I did:

  1. In 'Network/Switch', I created a new VLAN with ID 3. I set all of the switch ports to 'Off', then I tagged VLAN 3 on Eth0 and LAN 3. This means that anything plugged into LAN 3 on the router is connected internally to VLAN 3. (Be aware that port numbers may not match switch numbers - check the documentation for your router.)
  2. In 'Network/Interfaces' I created a new interface and named it 'VLAN3'. Enter the base IP address that you want to use on this VLAN. I used 192.168.13.1 (VLAN3 gets .13.1, VLAN4 gets .14.1, etc.).
  3. Click on the 'Physical Settings' tab, and select 'eth0.3' as the interface.
  4. Click on 'Firewall Settings' and create a firewall zone for the VLAN; I named the firewall zone 'VLAN3'. This step isn't strictly necessary, but people creating a VLAN usually want some kind of special isolation/security around it. Creating a firewall zone for your VLAN creates a custom INPUT, FORWARD, and OUTPUT rule chain for VLAN3; this makes it easy to see where to insert your rules. For example:

# VLAN3 is for IP cameras, or anything else that should be strictly contained to just its own VLAN
# Block VLAN3 from accessing the Internet or anything inside the house
iptables -I forwarding_VLAN3_rule -s 0.0.0.0/0 -j DROP

#3

Sorry for confusing you.
I want to configure for each of those vlans invididually:

  • search domain
  • dhcp range
  • static dhcp leases
  • etc.

ty

#4

Luci does allow you to configure the DHCP range per interface, and you can control all of the static leases (all VLANs and subnets), but all of them are in a single pool. That is, under 'Network/DHCP and DNS' you can configure static leases, and those leases apply to all of the VLANs and subnets. So the first static lease might be 192.168.10.1 and the next one might be 192.168.13.1 (for me, VLAN 3), and then .14.1, and so on.

As for search domain and 'etc.', I don't know.

If you use names from the static lease table in your firewall rules then you should read custom-firewall-rules-may-not-work-after-reboot.

#5

I will install unbound and isc dhcp server and try to configure dhcpd manually. I don't like that dnsmasq solution...
Thank you for your help