Hello,
before writing this post, I have spent hours reading docs, watching YT tutorials, experimenting myself, and not countable times restoring my OpenWrt working configuration...
I have following topology:
Currently I have one big network 172.16.0.0/21
. What I want to achieve is to split it to smaller network, which would help me with better control over resources and security.
I would like to have following networks:
172.16.0.0/24
- VLAN1
- default/infra
172.16.1.0/24
- VLAN11
- services (e.g. pihole, transmission)
172.16.2.0/24
- VLAN21
- IOT (e.g. docker services like HASS, esphome, node-red, but also WiFi connected esp8266 devices)
172.16.4.0/24
- VLAN41
- trusted devices (e.g. my phone, my wife's phone - I would like to filter those by MAC address)
172.16.5.0/24
- VLAN51
- guests/everything else
Because I have a problem with overlapping IP pools, I decided to create POC network 172.16.21.0/24
assigned to VLAN21
.
I have started by configuring my switch. That was pretty easy.
Next I have created 802.1q VLANs in OpenWrt.
(new users are not allowed to post multiple images....)
Then I have configured Switch on router:
(new users are not allowed to post multiple images....)
Next I have created an interface "net_iot":
(new users are not allowed to post multiple images....)
Then I created Wifi connection to this interface.
For testing purposes, I have decided to configure firewall forwarding so, that there are no rejection just for testing purposes:
(new users are not allowed to post multiple images....)
Now, important note here is that I have running pihole on ip 172.16.1.1
(it's part of this bug subnet 172.16.0.0/21
).
So the issues:
-
So first I have logged in to "nuc" device, and I have started a docker container with
macvlan
driver attached toeth0.21
. Without any issue I'm able to ping8.8.8.8
, but... I'm not able todig
A record from172.16.1.1
. Withnmap
I see that 53 is open, but I don't get any response. -
When my wifi network is bound with device
eth0.21
, I don't get DHCP address. Even if using static IP address, I cannot ping172.16.1.1
-
When I have checked how by default OpenWrt is creating WiFi, I saw that it's bound to bridge device, which is bridging only
eth0.1
. So I thought "ok, let's try it". So I have created bridgebr-iot
which is bridging onlyeth0.21
. With such configuration Android devices are able to get proper IP address from172.16.21.0/24
. But... I don't get it. Why? From what I read on OpenWrt docs, bridging is creating "a virtual switch" between bridged devices and creating a broadcast address across those devices. Is it so thateth0.1
oreth0.21
are like single RJ45 socket? So I need a "switch" that will handle all WiFi devices trying to connect to this one socket? I really would like to understand it, I would be greatful for help in this topic. -
When for the test I decided to change the bound device to
lan
interface frombr-lan
toeth0.1
, I was cut off from WiFi. I was able to normally work and use Internet with cable, but not with WiFi.
Thank you in advance for any help and ideas how to proceed.
Bonus question:
Would it be possible for me that I would have only 2 WiFi networks? One "main" and second "iot" ? Can I use DHCP tagging mechanism to filter trusted vs unknown (guests?) devices so trusted devices would get different DHCP server than unknown devices?