New to openwrt need with VLAN and dhcp

jei1965 · February 13, 2024, 9:05pm

I am running openwrt 23.05.02 on a linksys E8450. My plan for this router is to setup 4 vlan 120 for IOT, 199 for lan, 203 for guest, and 204 for my personal Wifi devices. I followed OneMarcFifty video about VLAN in 2021 VLAN video.

using br-lan which is bridges all lan port,

I added the 4 vlan's. I assigned port 4 as a trunk port so all vlan's are tagged on that port
I assigned port1 as a vlan.199 untagged port with primary vlan id
I assigned port 2 as untagged to vlan 120.

I created an interface IOT that is connected to br-lab.120 and enabled the DHCP on it.
I created a wireless interface that is connected to the IOT interface.

This is the issue I am running into:
I connect my laptop to port 2 and I get an IP address in the vlan 120 IP range and it has access to the internet. When I try to connect to the wifi on vlan120 I don't get an IP address.

I am not sure what I am I missing. Here is a copy of all my configuration files. Any help would be greatly appreciated.

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd21:f30b:10d7::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option device 'br-lan.199'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

config bridge-vlan
	option device 'br-lan'
	option vlan '199'
	list ports 'lan1:u*'
	list ports 'lan4:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '120'
	list ports 'lan2'
	list ports 'lan4:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '203'
	list ports 'lan4:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '204'
	list ports 'lan4:t'

config interface 'IOT'
	option proto 'static'
	option device 'br-lan.120'
	option ipaddr '192.168.120.1'
	option netmask '255.255.255.0'

config interface 'Guest'
	option proto 'static'
	option device 'br-lan.203'
	option ipaddr '192.168.203.1'
	option netmask '255.255.255.0'

config interface 'WIFI'
	option proto 'static'
	option device 'br-lan.204'
	option ipaddr '10.0.204.1'
	option netmask '255.255.255.0'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/18000000.wmac'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1a143000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'HE80'
	option disabled '1'

config wifi-iface 'wifinet0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'TestWifi'
	option encryption 'none'
	option network 'IOT'

/etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'IOTZone'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'IOT'
	option input 'REJECT'

config forwarding
	option src 'IOTZone'
	option dest 'wan'

config zone
	option name 'GuestZone'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'Guest'

config forwarding
	option src 'GuestZone'
	option dest 'wan'

config zone
	option name 'WifiZone'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'WIFI'

config forwarding
	option src 'WifiZone'
	option dest 'wan'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'IOT'
	option interface 'IOT'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'Guest'
	option interface 'Guest'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'WIFI'
	option interface 'WIFI'
	option start '100'
	option limit '150'
	option leasetime '12h'

psherman · February 13, 2024, 11:10pm

I don't see any obvious reason why port 2 and the TestWifi wifi SSID would be any different from each other.

That said, a few thoughts:

add :u* after port lan2 to explicitly specify the port as untagged+PVID

The IOTZone doesn't allow input. This is a typical approach for IoT/untrusted devices, but you need to allow DHCP and often DNS in order for the network to function as expected -- I don't see any rules to this effect. Is it possible that you have your computer's ethernet port using a static IP and not DHCP?

Anyway, for now, change input to ACCEPT for the purposes of reducing variables while testing. This can be tightened later.

Also, you haven't set the country codes on your radios -- be sure to do that.

Finally, make sure you're connecting to this AP. If you happen to be connecting to something else downstream (i.e. another AP, ultimately connecting to the router on port lan4), the problem could be related to downstream configuration errors, not the OpenWrt side.