OpnSense to Managed Switch to OpenWRT 23.05.4 Bridged AP VLANS Configuration

Installing and Using OpenWrt
1

I have researched and followed many guides over the past few days with no success. Therefore, it was finally time to ask for assistance.

Current Design:
OpnSense router 172.30.3.1 providing Internet and DHCP for 4 x VLANS
(Management) Default VLAN1 172.30.3.x
VLAN10 172.30.10.x tag 10
VLAN20 172.30.20.x tag 20
VLAN30 172.30.30.x tag 30
OpnSense LAN port connected to Netgear Managed Switch, Port 1 with VLAN10,20,30 tagged and VLAN1 untagged. Port 3 to OpenWRT LAN1 port same configuration
Port 3 tested with tagging and untagging on a laptop ethernet port. All VLANs provided DHCP address correctly and access to other VLAN devices.

In LuCI, I configured the LAN interface for static IP with 172.30.3.3 and 172.30.3.1 for the gateway and DNS
I followed the Bridged AP Configuration via LuCI https://openwrt.org/docs/guide-user/network/wifi/wifiextenders/bridgedap
Connected LAN Port 1 to Port 3 on the managed switch and I was able to connect to OpenWRT

I then attempted to add the VLANs to br-lan under the Network>Interfaces Device tab under Bridge VLAN filtering in LuCI
Once I applied the settings, the changes were rolled back as OpenWRT was
no longer accessible.

ubus call system board

{
        "kernel": "5.15.162",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "ASUS RT-AC88U",
        "board_name": "asus,rt-ac88u",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "bcm53xx/generic",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdc6:0e4e:df8a::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'extsw'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '172.30.3.3'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '172.30.3.1'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '18000000.axi/bcma0:7/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '18000000.axi/bcma0:8/pci0001:00/0001:00:00.0/0001:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option disabled '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'
2

The problem is sequencing, which is tricky. I recommend simply editing the text config file directly.

Add bridge-VLANs:

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'
        list ports 'extsw:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan1:t'

Next, edit the lan to use br-lan.1:

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '172.30.3.3'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '172.30.3.1'

Finally, add unmanaged interfaces for the other 3 VLANs:

config interface 'vlan10'
        option device 'br-lan.10'
        option proto 'none'

config interface 'vlan20'
        option device 'br-lan.20'
        option proto 'none'

config interface 'vlan30'
        option device 'br-lan.30'
        option proto 'none'

Now you can create SSID and tie them against lan, vlan10, vlan20, and vlan30.

Restart and it should all work.

1 Like
3

Before you sink much time into this, please check the wireless capabilities first and consider if those meet your expectations.

Broadcom wireless support isn't great, yes this is BCM4366 and brcmfmac -which kind-of works- but the hardware/ firmware severely limits interface combinations (check the iw list output for both PHYs) and I'd also give this a serious burn-in testing (without anything special, without VLANs) before committing it into production use (to evaluate performance and long-term stability).

The wired/ VLAN side will work, the wireless side is its weak point.

5

Thank you very much Peter @psherman :+1:
That worked perfectly.

I was able to test out the wireless and instantly received a DHCP address on each VLAN as hoped.

Unfortunately, I believe I am learning a hard lesson on not using Broadcom chipsets as the only way I could get wireless to connect was to disable encryption. Not sure if that is a known issue or not however it does not relate to the VLAN configuration.

6

Thank you for the reply.

I believe I may have stumbled already on my first issue. I can't enable WPA2 security and connect. Despite typing in the key multiple times and changing it to something more simplistic for testing, my smartphone Samsung S23U will not connect to it. Only if encryption is disabled will it allow a connection.

This was an older router I had lying around that I saw was supported. This was more a proof of concept before looking into some other supported MediaTek based chipset hardware. I have my eye on the GL.iNet Flint 2 (GL-MT6000).

7

WPA2 'should' work (assuming a single wireless AP interface per radio), WPA3 (in any combination) will not; things like 802.11r or 802.11w are questionable at best. But Broadcom is known problematic, even if you picked the best (brcmfmac) of the worst among them, it's still not going to be stellar.

filogic 830 should be another dimension in comparison, apart from being more than twice as fast for starters (802.11ac/ wave1 vs 802.11ax).

1 Like
8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.