I am trying to configure an OpenWrt device as a network router / bridge between one Wi-Fi network and two different Ethernet networks.
The OpenWrt device has one Wi-Fi SSID, and I want a single Wi-Fi client to be able to communicate with both of the following networks : 192.168.4.0/24, 192.169.4.0/24
The OpenWrt device itself has : 192.168.4.17, 192.169.4.17
(It does not use 192.168.4.1/192.169.4.1 because it is connected to another router that has 192.168.4.1/192.169.4.1, by lan cables.)
The Wi-Fi client should be able to use: 192.168.4.0/24 -> 192.168.4.1, 192.169.4.0/24 -> 192.169.4.1
[The problem]
I can communicate with the 192.168.4.0/24 network normally. However, when both networks are connected, traffic tends to prefer the 192.168.4.1 path. Even sometimes it seems to be 192.169.4.0/24 uses 192.168.4.1 path so that destination Equipment could not receive the packets.
[Current Configuration]
I configured all LAN ports(ex: LAN1(168), LAN2(169), LAN3(168), LAN4(no use), SFP2(169)) as device br-lan, and made bridge-vlan, option device br-lan, vlan 10, and added ports that are only used(ex: LAN1, LAN2, LAN3, SFP2). Then I connected 'wifi', option device br-lan.10, and added two ips, 192.168.4.17 / 192.169.4.17. Is there any problem in this configuration? Sorry if my explanation is a bit confusing. English isn't my first language.
The first problem you have with your networks is this:
The second network is not part of the RFC1918 address ranges, and therefore is not recommended for use. The RFC1918 addresses are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Using subnets outside the range (i.e. 192.169.x.x) may cause issues with respect to internet connectivity. You should fix this issue first. From the sounds of it, it seems like that needs to be done on an upstream router.
The next issue related to the correct routing of the connections...
It's not clear what address the wifi client has, but it will be necessary for the OpenWrt router to be in routing mode -- this means that the client needs an address on a 3rd subnet (unique and non-overlapping relative to the other two). From there, routing will happen naturally (provided things are configured properly).
I understand that the client should be able to reach both networks, but one thing that is not stated is what path it should take to get to the internet. Please clarify.
Please draw a topology diagram (this can be as simple as a photo of a sketch on paper) that includes the devices, the port labels, and the addresses of each device -- this way we can be sure we understand the physical setup. We'll also need to see your OpenWrt configuration.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
Thank you for your kind reply. First of all, we are going to use this network at an aircraft system(this is why we use two subnets, main and sub), so this network system will never connect to Internet. Thus we decided to use 192.169.0.0, only for our internal network.
Second, I was thinking of wireless-bridge(L2). As we are using Internal Network, Client does not have to connect to the internet. I will draw a topology diagram, and I hope it will help you understand.
** There's a problem uploading an image, so i'll try later..
Brief explanation :
Openwrt router(L2 switch) : 192.168.4.17, 192.169.4.17
router : 192.168.4.1, 192.169.4.1
wireless device : 192.168.4.10, 192.169.4.10
other equipment : 192.168.4.13, ...
Openwrt router works as a L2 switch, to connect Wireless and wired only at Internal Network. I hope this could help you understand...
Are you also sure that something will never connect to both that network and the internet? If you ran out of RFC1918 addresses, of course the next best step is really IPv6, but I've also seen some companies using 198.18.0.0/15 (for local containers).
Note that you are referring to both 192.169.0.0/? and 192.169.4.0/24. There are multiple owners of that IP space, notably 192.169.0.0/24 is assigned to RGnet and 192.168.4.0/24 is assigned to Interac. This is no doubt going to be extremely confusing for anybody who is not on your team today.
We are currently configuring a network for internal aviation systems, so internet access is unavailable. This configuration is for communication between LRUs. Since it will be set up as a completely internal network, you do not need to worry. Thank you for your concern.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
If your device is operating at L2 your solution is just to bridge the wifi to the LAN and configure the switch with one IP on one of the normally-unused ports for maintenance access.
That's literally all you need to do and that will keep people out of it.
Don't use 192.169 it's wrong. Either use 10.168 / 10.169 or 192.168.1 / 192.168.2
and you shouldn't call something an 'air-gapped network' if you can get into it by 802.11 because that's not what the word means.
