Great... thanks for the new info.
One caveat -- I don't know the mapping of the logical ports to the physical ports, so it is possible that things won't be assigned to the right physical ports. If that happens, it's not a big deal to fix it. I'll assume that logical port 0 = lan 1... logical port 3 = lan4.
First thing we'll do is delete the wan/wan6 interfaces:
Now we'll create new networks called vlan2 - vlan4:
config interface 'vlan2'
option device 'eth0.2'
option proto 'static'
option ipaddr '192.168.2.2'
option netmask '255.255.255.0'
option gateway '192.168.2.1'
list dns '192.168.2.1'
config interface 'vlan3'
option device 'eth0.3'
option proto 'static'
option ipaddr '192.168.3.2'
option netmask '255.255.255.0'
config interface 'vlan4'
option device 'eth0.4'
option proto 'static'
option ipaddr '192.168.4.2'
option netmask '255.255.255.0'
And we'll edit the lan to 192.168.1.2:
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.2'
option netmask '255.255.255.0'
Now we'll setup the VLANs on the switch with what is hopefully the correct port mapping. This involves editing VLANs 1 and 2, and adding 3 and 4:
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 5t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '1 5t'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '2 5t'
config switch_vlan
option device 'switch0'
option vlan '4'
option ports '3 5t'
Next, in the DHCP file, we'll add DHCP servers for VLANs 3 and 4:
config dhcp 'vlan3'
option interface 'vlan3'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
config dhcp 'vlan4'
option interface 'vlan4'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
We'll create a new firewall zone for VLAN 2 in the firewall file:
config zone
option name 'vlan2'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'vlan2'
option masq '1'
And, for getting things started (with the fewest variables), we'll set VLANs 3 and 4 in the lan firewall zone (this won't achieve the isolation, but will help us prove that everything is working; we'll isolate later):
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'vlan3'
list network 'vlan4'
And finally, we'll add a forward:
config forwarding
option src 'lan'
option dest 'vlan2'
Reboot and test the following:
- each port is assigned properly by plugging a computer into each port in sucession.
- Ports 1, 3, and 4 should be associated with VLAN 1, 3, and 4 respectively, and there should be a DHCP server enabled on each of those.
- Port 2 should not have a DHCP server, so your computer will not get an address.
If the ports are wrong, we can fix them... just note what you see on each port.
If all is good, connect port 2 to the upstream router and then test that routing is working as expected from the other 3 networks.
Once that's all set, we can talk about isolation.
Right now each vlan is configured in a different way. Also I haven touched the default lan. Pretty sure the network>switch config is good, one Vlan on each port serves me very well, I have several dumb switches and I will connect one onto each port and have physical separated vlans (no need to share ports). But the devices and interfaces not sure and I don't know how to make them use internet on Vlan2.