Hi,
Thanks for the new rc release. There has been changes in VLAN support in the various rc's so not sure if my problems are due to those changes or am doing something wrong. If latter please ignore as not related to rc3 (admins feel free to remove my comment in this case). And this is long too, sorry.
So, I have the followings problems. By the way using image:
OpenWrt 21.02.0-rc3, r16172-2aba3e9784
- after system upgrade from rc2 without keeping previous config, add more physical ports to factory default 'br-lan' bridge. Save 'General device options' then Save&Apply. Then try to enable VLAN filtering on 'br-lan', add new VLAN ID 1 like this
Then a new VLAN ID 2 but the moment I press 'Add' eth1:untugged turns to tagged:
Is this a GUI glitch? Anybody has seen this? Or something weird happens my side only?
- Now, I try to save the new VLAN filtering config: I press 'Save' something happens as I can see cogwheel but form remains as is, does not go back/up to device form. If I press 'Save' again nothing happens (looks like but see below, point 3). So have to 'Dismiss' this form and back on Device form. Now 'Save & Apply' fails:
Only choice is 'Dismiss'.
Am I doing something wrong here, cannot create VLAN filtering this way? Should first create new VLAN device then set VLAN filtering?
If I refresh GUI I can see the new VLAN devices created so I guess indeed the problem is that new VLAN devices are not created. Is this a bug or feature?
- As I saved twice the VLAN filtering config before it looks like this now:
Also, as can see the untagged ports are shown as tagged although network is:
# /etc/config/network
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'
list ports 'eth2'
list ports 'eth3'
config interface 'lan'
option proto 'static'
option ipaddr '10.0.0.2'
option netmask '255.255.255.0'
option ip6assign '60'
option device 'br-lan'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'eth1'
list ports 'eth3:t'
config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'eth2'
list ports 'eth3:t'
No explicit ':' notation means untagged, does not it? Or must use 'ethN:u' and 'ethN:t' format?
- I have two of same way configured owrt instances (let's call them R1 & R2) and the plan is to connect them via trunk port (eth3 on both devices) and have two VLANs (id: 1 & 2), assign two interfaces (lan, guest) in their own distinctive firewall zone to each VLAN with different IP subnet (10.0.0.0/24 & 20.0.0.0/24), so both R1&2 has similar config (differences shown inline R1 / R2):
# /etc/config/network
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'
list ports 'eth2'
list ports 'eth3'
config interface 'lan'
option proto 'static'
option ipaddr '10.0.0.1' / option ipaddr '10.0.0.2'
option netmask '255.255.255.0'
- / option gateway '10.0.0.1'
option ip6assign '60'
option device 'br-lan.1'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'eth1'
list ports 'eth3:t'
config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'eth2'
list ports 'eth3:t'
config interface 'guest'
option proto 'static'
option device 'br-lan.2'
option ipaddr '20.0.0.1' / option ipaddr '20.0.0.2'
option netmask '255.255.255.0'
- / option gateway '20.0.0.1'
Looks ok via trunk port connection R1 can be accessed from R2:
# above config generates these routes
root@OpenWrt:/etc/config# ip route
default via 10.0.0.1 dev br-lan.1
10.0.0.0/24 dev br-lan.1 scope link src 10.0.0.2
20.0.0.0/24 dev br-lan.2 scope link src 20.0.0.2
# ping from R2 the lan interface of R1
root@OpenWrt:/etc/config# ping -c1 10.0.0.1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: seq=0 ttl=64 time=0.381 ms
--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.381/0.381/0.381 ms
# ping from R2 the guest interface of R1
root@OpenWrt:/etc/config# ping -c1 20.0.0.1
PING 20.0.0.1 (20.0.0.1): 56 data bytes
64 bytes from 20.0.0.1: seq=0 ttl=64 time=0.446 ms
--- 20.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.446/0.446/0.446 ms
# ping from R2's lan interface the guest interface of R1
root@OpenWrt:/etc/config# ping -c1 -I 10.0.0.2 20.0.0.1
PING 20.0.0.1 (20.0.0.1) from 10.0.0.2: 56 data bytes
64 bytes from 20.0.0.1: seq=0 ttl=64 time=0.328 ms
--- 20.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.328/0.328/0.328 ms
# ping from R2's guest interface to lan interface of R1
root@OpenWrt:/etc/config# ping -c1 -I 20.0.0.2 10.0.0.1
PING 10.0.0.1 (10.0.0.1) from 20.0.0.2: 56 data bytes
64 bytes from 10.0.0.1: seq=0 ttl=64 time=0.288 ms
--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.288/0.288/0.288 ms
Is this legit behavior, should VLAN1 able to talk to VLAN2? Are they not supposed to be distinctive virtual lans segregated from each other? Is this because default route will send traffic through?
root@OpenWrt:/etc/config# ip ro
10.0.0.0/24 dev br-lan.1 scope link src 10.0.0.2
20.0.0.0/24 dev br-lan.2 scope link src 20.0.0.2
root@OpenWrt:/etc/config# ping -c1 -I 10.0.0.2 20.0.0.1
PING 20.0.0.1 (20.0.0.1) from 10.0.0.2: 56 data bytes
64 bytes from 20.0.0.1: seq=0 ttl=64 time=0.337 ms
--- 20.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.337/0.337/0.337 ms
No, it is not because of default route. So what am I missing, what is wrong here: different VLAN, different zone, still there is route between the two VLANs??
# /etc/config/firewall
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'guest'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'guest'