I've been going through this repeatedly to no avail.
I have a VLAN (VLAN 10) designated for security cameras. They are on ports 1, 2, 3, 4, 5, and 6 of a Netgear GC110P.
My router running OpenWRT is a Linksys WRT3200ACM
My cameras show up in OpenWRT with the correct IP and subnet I have designated. I can ping them from Windows with a 0% packet loss.
I can't login to the cameras via web browser. OpenWRT is showing barely any traffic on the interface, too.
Is the problem on my Netgear switch end? I've got all 6 ports as untagged on VLAN 10, and with a PVID of 10. Port 10 is the trunk, tagged VLAN 1 and 10.
It is entirely possible that the web server on the cameras won't respond to requests coming from a different subnet, although usually the pings wouldn't work either. But that entirely depends on how the cameras are setup from the vendor.
Let's take a look at your configs:
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
And cctv is the firewall zone or have you defined a traffic rule ?
In case its not a traffic rule you need to add one which looks like:
src zone: lan
dst zone: iot-network (cctv in your case)
dst ip: <your camera ip> (optional, you can leave this blank if you dont want to limit the rule to one device)
dst port: also optional
target:Accept
You can find it in luci->firewall->traffic rules (tab)
My device on the CCTV end has not managed to get an IPv4 address via DHCP, but somehow has an IPv6 address. I don't see the cameras on my network, but of all the things...
My five IPTV boxes appear. They're not even on that VLAN. In fact, they're on VLAN1, because I couldn't manage to get them configured on the special VLAN I had for them.
The plot thickens.
EDIT: If it makes any difference, those IPTV boxes appear to have a 169.x.x.x loopback address. They work perfectly fine.
I reviewed what you sent via PM -- it is properly redacted. You can safely post that here.
I see a few issues, and once posted, I'll make suggestions (it's helpful for the complete config to be posted first so that there is context for you and for future readers).
Yes, this suggests some significant issues. It may also be related to your switch config, too... but first we'll fix the router's config.
LAN1 goes to a switch in one room. LAN2 goes to a switch in another room. LAN3 belongs to the PoE switch that the CCTV cameras are connected to. LAN4 is for a router configured as an Access Point. Of course, they're tagged on the LAN side and the trunk port on the switch side. Then, the device ports are untagged.
All switches are Netgear G308E. I haven't had issues with them since moving to the OpenWRT Snapshot that someone recommended, resolving a kernel issue.
The PoE Switch, on the other hand, is involved with this mess. It's a Netgear GC110P. Port 10 is a trunk, running to a SFP to RJ45 media converter. That shouldn't be a problem, right? If the router sends tagged packets over fibre, it should still be carried through copper. It's not like the media converter is adding/removing tags? I have also tried a RJ45 to RJ45 trunk connection instead on Port 8, and the issues persist.
Ok... thanks. So it sounds like all ports should have the same VLAN memberships?
I see VLANs 1, 10, 20, 30, and 40. Should they all be tagged on all ports?
Currently you have the following (although there are some issues, especially on port lan4):
Port lan1: 1t, 10t, 20t, 30t, 40t
Port lan2: 1t, 10t, 20t, 30t, 40t
Port lan3: 1t, 10t
Port lan4: 1u, 20u, 40u
What VLAN membership arrangement do you want. Note that port lan4 is invalid because you have 3 untagged networks. There are other things, too, but they are less of an issue.
If the camera are not vlan aware the switch should sent traffic to the device as untagged with pvid of 10 and tagged on port 0 (aka cpu port) as vlan 10.
To explain what it does:
the default vlan for a port should always be untagged, untagged means it removes the tag to the device connected on the port.
having it tagged as vlan 10 on port 0 means the packet gets tagged again for upstream like your router or modem.
now if you want multiple vlans on one port and you had already done as above, the rest should be always considered tagged, tagged to the device on the port and tagged on the cpu, why? Because you can only have one vlan untagged.
LAN1-2 should be tagged with every VLAN because I have devices belonging to various VLANs downstream. LAN3 should only be carrying the CCTV VLAN (10) and I assume VLAN1 for management.
LAN4 is me still trying to figure out how to use a Netgear router as an AP with two SSIDs on their own VLAN. (Guest on 40 and main SSID on 1). I definitely need to clean that up.
This is interesting. I couldn't find anything about them being VLAN aware, but I assumed untagged packets should be carried without issue. They are Axis P3225 LVE network cameras.
Could you draw a quick diagram of your topology (a photo of a sketch on paper is sufficient).
Depending on what is immeditely connected to LAN3, maybe there should only be a single network (untagged), or maybe it should have both. The diagram can be helpful here.
What firmware is running on this netgear device, and what model is it?
