No internet with VLANs

soulflyman · April 11, 2020, 6:59pm

Hi folks,

this is a long post, so I highlight the TL;DR parts and add the config files on the end

My Vision is to have three separate VLANs, one for my home network devices, one for my IoT trash devices an one for guest. Every VLAN should have internet access but should not be allowed to communicate to another VLAN.

Later on I want to secure one WIFI with Radius and add Adblocking. Before I buy a powerful device like the AVM Firtzbox 4040, I tried to test the setup with my TP-Link TL-WR1043ND v4 and later switching out the device when everything worked and I have saved some money.

But I can’t get it to work.

As I said, I want different VLANs and every VLAN should have its own port on the integrated switch an a wifi assigned to it.

I’m testing now for two days and nothing woks. So please help me. I reset my openwrt router and made notes of my last try. And this is my journey where I try to setup two additional and separated VLANs:

Installed version on the router is OpenWrt 19.07.2 r10947-65030d81f3 / LuCI openwrt-19.07 branch git-20.057.55219-13dd17f.

First thing I have done was to set a root password and updating the IP of the ‘lan’ interface from 192.168.1.1 to 10.0.0.99 because 192.168.1.1 is my gateway device that is connected to the ‘wan’ port.

new settings are:
IP 10.0.0.99
Netmask: 255.0.0.0

So the ‘lan’ no longer conflicts with the ‘wan’ and the router has internet, time to update...

I assigned ssh to the ‘lan’ interface and connect via ssh to the router and run this commands to update alle packages:
opkg update && opkg list-upgradable | cut -f 1 -d ' ' | xargs opkg upgrade

Worked well, except for this error:

Collected errors:
* resolve_conffiles: Existing conffile /etc/config/dhcp is different from the conffile in the new package. The new conffile will be placed at /etc/config/dhcp-opkg.
* resolve_conffiles: Existing conffile /etc/config/luci is different from the conffile in the new package. The new conffile will be placed at /etc/config/luci-opkg.

So I moved dhcp-opkg to dhcp and luci-opkg to luci, then i rebooted the router.

I Went to network→switch and added two more VLANs and assign each to one single port on the switch.

So it will look like this:

vlan1 → eth0.1 (switch port 1)
vlan2 → eth0.2 (wan port)
vlan3 → eth0.3
vlan4 → eth0.4

The ports are all untagged except for the CPU Column, there they are all tagged.

I want to leave the ‘lan’ interface nearly as it is (except for the IP change), assign it only to port 1 and bridged with the default wireless network (SSID: OpenWrt). This will be used for management purpose only and should have no devices attached to it permanently. Of course I disable the wifi and configure it as an encrypted one.

Further on I added two new interface in network→interfaces, ‘vlan3’ and ‘vlan4’

vlan3:
    protocol: static
    ip: 10.0.3.1
    netmask: 255.0.0.0
    bridged: yes
    interfaces: eth0.3
    dhcp server: enabled

vlan4:
    protocol: static
    ip: 10.0.4.1
    netmask: 255.0.0.0
    bridged: yes
    interfaces: eth0.4
    dhcp server: enabled

Then I went on to the firewall and added two zones for the new VLANs.

Zone vlan3:
    input: accept
    output: accept
    forward: accept
    covered networks: vlan3
    allow forward destination zone: wan

Zone vlan4:
    input: accept
    output: accept
    forward: accept
    covered networks: vlan4
    allow forward destination zone: wan

Back to network→ interfaces and the interfaces ‘vlan3’ and ‘vlan4’ now have a nice coloring because of the assigned firewall rules.

So last thing todo is the wifi. As mentioned I want to use radius authentication for my wifi in the future, so I removed ‘wpad-basic’ and install ‘wpad’ in system→software and then rebooted the router.

Then I added the two new wireless networks in networks→wireless.

SSID: vlan3
network: vlan3
encryption: wpa-psk (strong)

SSID: vlan4
network: vlan4
encryption: wpa-psk (strong)

With this setup it thought it should be possible to connect to the wifi ‘vlan3’ or ‘vlan4’ and have internet access.

But it does not work. I can connect to the wireless networks and when I check with the command
ip a && ip r I can see that I get an IP assigned and that the used route is the IP of the network interface of the VLAN: 10.0.3.1 as gateway for wireless network ‘vlan3’ and 10.0.4.1 for the wireless network ‘vlan4’.

But no internet. I even can’t access LuCi, neither by 10.0.0.99 nor by 10.0.3.1 or 10.0.4.1.

Can some one please help me to get the VLANs running, or is it not possible with my device?

greetings
sfm

Here are my config files:

/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd38:8b08:383f::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ip6assign '60'
	option netmask '255.0.0.0'
	option ipaddr '10.0.0.99'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '84:16:f9:66:44:a7'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '1'
	option ports '0t 4'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 5'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '3'
	option ports '0t 3'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option ports '0t 2'
	option vid '4'

config interface 'vlan3'
	option proto 'static'
	option ifname 'eth0.3'
	option type 'bridge'
	option netmask '255.0.0.0'
	option ipaddr '10.0.3.1'

config interface 'vlan4'
	option proto 'static'
	option ifname 'eth0.4'
	option type 'bridge'
	option netmask '255.0.0.0'
	option ipaddr '10.0.4.1'

/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option name 'vlan3'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option network 'vlan3'
	option output 'ACCEPT'

config forwarding
	option dest 'wan'
	option src 'vlan3'

config zone
	option name 'vlan4'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option network 'vlan4'
	option output 'ACCEPT'

config forwarding
	option dest 'wan'
	option src 'vlan4'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'vlan3'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'vlan3'

config dhcp 'vlan4'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'vlan4'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option channel '11'
	option hwmode '11g'
	option path 'platform/ahb/18100000.wmac'
	option htmode 'HT20'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'none'

config wifi-iface 'wifinet1'
	option ssid 'vlan3'
	option encryption 'psk2'
	option device 'radio0'
	option mode 'ap'
	option network 'vlan3'
	option key 'supersecure'

config wifi-iface 'wifinet2'
	option ssid 'vlan4'
	option encryption 'psk2'
	option device 'radio0'
	option mode 'ap'
	option network 'vlan4'
	option key 'supersecure'

trendy · April 11, 2020, 7:08pm

Nope.

The mask is wrong, use 255.255.255.0

You may want to limit the input and forward chains for IoT and guest in firewall to REJECT, but you can do that later.

psherman · April 11, 2020, 7:43pm

Start over. Reset to defaults. Do this before anything else because you may have really unpredictable issues due to running okpg upgrade Please see the numerous threads on the topic - the tl;dr: don’t ever use that command unless you know exactly what you are doing and are willing to take the risk that it might mess things up requiring a reset to defaults.

If you want, you can take a backup before you reset. But it might be good to refrain from restoring the backup so you start from a known good state.

Make sure you are up to date with the latest stable release, too

mk24 · April 11, 2020, 8:43pm

What the others said. I didn't read it all but opkg upgrade is never advisable and you're also setting up the three networks wrong.

Your networks for different purposes have to be independent IP subnet blocks. For example 10.0.1.1 with a netmask of 255.255.255.0 (or, the alternate notation of 10.0.0.1/24) then 10.0.2.1 as the basis of the guest network and 10.0.3.1 for IoT. This is typical for home use where you can have about 250 devices in each network. It's also possible to do 10.1.0.1 netmask 255.255.0.0 (10.1.0.1/16), 10.2.0.1 etc which has adddres space for about 65,000 devices in each network.

Netmask 255.0.0.0 makes the entire 10.X.X.X range one single huge network with no room to add another network in the private block under 10. Do not do that.

soulflyman · April 12, 2020, 12:13pm

Okay, I have done a reset and I'm now back on the latest stable release.

Okay I have only changed from wpad-basic to wpad in system->software because I want to use radius authentication for one wifi in the future. No other updates or installations.

Then I have changed the subnetmask as you advised an I have a different result. When I connect to the WIFI vlan3 I get an IP in the correct subnet range (10.0.3.139), but when I ping 1.1.1.1 I can't reach it:

$ ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
92 bytes from OpenWrt.lan (10.0.3.1): Destination Port Unreachable
92 bytes from OpenWrt.lan (10.0.3.1): Destination Port Unreachable

Is this a problem of the firewall?

My configs are...
/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd5f:c0cd:af96::/48'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '10.0.0.1'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '84:16:f9:66:44:a7'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '1'
	option ports '4 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '3'
	option ports '3 0t'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option vid '4'
	option ports '2 0t'

config switch_vlan
	option device 'switch0'
	option vlan '5'
	option ports '1 0t'
	option vid '5'

config interface 'vlan3'
	option proto 'static'
	option ifname 'eth0.3'
	option type 'bridge'
	option netmask '255.255.255.0'
	option ipaddr '10.0.3.1'
	option gateway '192.168.1.1'

config interface 'vlan4'
	option proto 'static'
	option ifname 'eth0.4'
	option type 'bridge'
	option netmask '255.255.255.0'
	option ipaddr '10.0.4.1'

config interface 'vlan5'
	option proto 'static'
	option ifname 'eth0.5'
	option type 'bridge'
	option netmask '255.255.255.0'
	option ipaddr '10.0.5.1'

/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option name 'vlan3'
	option output 'ACCEPT'

config forwarding
	option dest 'wan'
	option src 'vlan3'

config zone
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option name 'vlan4'
	option output 'ACCEPT'

config forwarding
	option dest 'wan'
	option src 'vlan4'

config zone
	option input 'ACCEPT'
	option forward 'REJECT'
	option name 'vlan5'
	option output 'ACCEPT'

config forwarding
	option dest 'wan'
	option src 'vlan5'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option channel '11'
	option hwmode '11g'
	option path 'platform/ahb/18100000.wmac'
	option htmode 'HT20'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'none'
	option disabled '1'

config wifi-iface 'wifinet1'
	option encryption 'psk2'
	option device 'radio0'
	option mode 'ap'
	option network 'vlan3'
	option key 'supersecret'
	option ssid 'vlan3'

config wifi-iface 'wifinet2'
	option encryption 'psk2'
	option device 'radio0'
	option mode 'ap'
	option network 'vlan4'
	option key 'supersecret'
	option ssid 'vlan4'

config wifi-iface 'wifinet3'
	option encryption 'psk2'
	option device 'radio0'
	option mode 'ap'
	option network 'vlan5'
	option key 'supersecret'
	option ssid 'vlan5'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'vlan3'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'vlan3'

config dhcp 'vlan4'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'vlan4'

config dhcp 'vlan5'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'vlan5'

soulflyman · April 12, 2020, 12:20pm

config interface 'vlan3'
        ....
	option gateway '192.168.1.1'

was only a test if this fixes the problem but that didn't work

mk24 · April 12, 2020, 1:16pm

When you define the new firewall zones you have to associate them to a network. Both option name and list network like lan and wan have.

soulflyman · April 12, 2020, 1:43pm

Strange in LuCi it was associated with the network an the interface was also colored in the interfaces list. I removed the interface from the firewall rule and added it back and now it works.

Thank you all for your help!

system · April 22, 2020, 1:43pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.