Packet lose on bridged vlans

i have tp-link wr741nd v4.25 flashed with openwrt 18.06.1. here my vlan config:

swconfig dev switch0 show
Global attributes:
enable_vlan: 1
mirror_monitor_port: 15
Port 0:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 0
link: port:0 link:up speed:1000baseT full-duplex txflow rxflow
Port 1:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 4
link: port:1 link:down
Port 2:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 3
link: port:2 link:up speed:100baseT full-duplex auto
Port 3:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 2
link: port:3 link:down
Port 4:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 1
link: port:4 link:down
VLAN 0:
vid: 0
ports: 0t
VLAN 1:
vid: 1
ports: 0t 4
VLAN 2:
vid: 2
ports: 0t 3
VLAN 3:
vid: 3
ports: 0t 2
VLAN 4:
vid: 4
ports: 0t 1

when i add eth0.1, eth0.2, eth0.3, eth0.4 into br-lan bridge, computers connected to the lan ports of the router stop seeing it. the router stops reply to client pings, clients stop receiving addresses from the dhcp server. how can i fix this issue?

What are you trying to do?

Would you sketch out your network, since knowing that you want to configure four VLANs isn't very helpful by itself.

In my network there are several devices for viewing iptv. part of them use multicast, another part use unicast through udpxy. I would like to enable igmp snooping to exclude multicast traffic on ports where he was not asked. and I would like all these devices to be on the same physical network.

If on the same physical network, if you then segregate by VLANs, then all of the clients will need to be VLAN-aware and (manually) configured for VLAN access on their connections.

I'm not sure that using VLANs is going to gain you anything -- all the packets will still be present "on the wire". If anything, it will make congestion worse as you might be multicasting more than one VLAN.

clients do not necessarily have vlan support, because all router lan ports configured to untagged mode.

as I wrote at the beginning, this configuration works fine on another router and I want to repeat it on this. but for some reason this configuration does not work on this router.

you can try to repeat this config:

vlan     cpu0      lan1     lan2      lan3      lan4
1        tagged    untag    off       off       off
2        tagged    off      untag     off       off
3        tagged    off      off       untag     off
4        tagged    off      off       off       untag

after this you can add interfaces eth0.1, eth0.2, eth0.3 and eth0.4 into bridge br-lan

I don't think you can accomplish what you want, which I understand to be traffic for certain clients to be sent only over certain physical ports, without either putting each of the ports on their own subnets, or by providing static routes for the specific hosts.

My guess is that if you look at your routing table it is not doing what you want. Mapping the physical ports to interfaces is only the start of the configuration I believe you'll need to perform.

Jeff I think what he wants is to turn the device into a smart switch, bridge each port in the CPU instead of switch hardware, and by doing that also enable igmp snooping on the Linux bridge and limit the multicast spam.

that's exactly what i need!

When you say it doesn't work what are symptoms, try to be as specific as possible for us to help.

ok. br-lan bridge successfully created with new interfaces eth0.1, eth0.2, eth0.3, eth0.4 and wlan0(wifi). clients connected via Wi-Fi continue to have access to the router. they can ping router ip, while clients connected to lan ports of the same router lose access to router. they stop receiving ping answers from router. What more detailed information is needed to diagnose this problem? may be tcpdump output is needed or something else?

Can you post your config files, please?

/etc/config/network?

1 Like

Yes, "network" is the most significant for this kind of issue; but "firewall" and "wireless" might be interesting, too.

1 Like

ok. when i will be near router i will copy configs here

with this configs router stop responding on pings from clients connected to lan ports:

/etc/config/network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd3c:3f33:53a4::/48'

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option delegate '0'
	option type 'bridge'
	option igmp_snooping '1'
	option ifname 'eth0.1 eth0.2 eth0.3 eth0.4'

config interface 'wan'
	option proto 'dhcp'
	option ifname 'eth1.1'
	option delegate '0'
	option force_link '1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '1'
	option ports '0t 1'

config interface 'tv'
	option proto 'static'
	option ifname 'eth1.21'
	option ipaddr '10.136.214.174'
	option netmask '255.255.252.0'
	option delegate '0'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option vid '2'
	option ports '0t 2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '3'
	option ports '0t 3'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option vid '4'
	option ports '0t 4'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option channel '11'
	option hwmode '11g'
	option path 'pci0000:00/0000:00:00.0'
	option htmode 'HT20'
	option disabled '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'psk2'
	option key '11111111'
	option network 'lan'
/etc/config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan lan2 lan3 lan4'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option input 'ACCEPT'
	option output 'ACCEPT'
	option name 'tv'
	option masq '1'
	option network 'tv'
	option forward 'ACCEPT'

config forwarding
	option dest 'tv'
	option src 'lan'

Your "lan" zone at the firewall includes networks "lan lan2 lan3 lan4", but only "lan" is a valid network name; however, I do not think this should cause the behaviour you explain.

Could you please execute these commands, and post the results here:
"brctl show"
"ifconfig"

Also, just for testing purposes, could you disable IGMP snooping and try again?

ip route show
and
ip -6 route show
would also be helpful

brctl show

bridge name bridge id STP enabled interfaces
br-lan 7fff.0023cd197fb7 no eth0.1
wlan0
eth0.2
eth0.3
eth0.4

ifconfig

br-lan Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::223:cdff:fe19:7fb7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:14816 errors:0 dropped:0 overruns:0 frame:0
TX packets:15477 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1408941 (1.3 MiB) TX bytes:3198246 (3.0 MiB)

eth0 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
inet6 addr: fe80::223:cdff:fe19:7fb7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:13029 errors:0 dropped:0 overruns:0 frame:0
TX packets:16454 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1418078 (1.3 MiB) TX bytes:3074297 (2.9 MiB)
Interrupt:5

eth0.1 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:12723 errors:0 dropped:0 overruns:0 frame:0
TX packets:13840 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1164826 (1.1 MiB) TX bytes:2832862 (2.7 MiB)

eth0.2 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:163 errors:0 dropped:0 overruns:0 frame:0
TX packets:778 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9416 (9.1 KiB) TX bytes:48202 (47.0 KiB)

eth0.3 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:75 errors:0 dropped:0 overruns:0 frame:0
TX packets:883 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5053 (4.9 KiB) TX bytes:61109 (59.6 KiB)

eth0.4 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:68 errors:0 dropped:0 overruns:0 frame:0
TX packets:876 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4261 (4.1 KiB) TX bytes:57614 (56.2 KiB)

eth1 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B9
inet6 addr: fe80::223:cdff:fe19:7fb9/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:74 errors:0 dropped:0 overruns:0 frame:0
TX packets:35 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5382 (5.2 KiB) TX bytes:7194 (7.0 KiB)
Interrupt:4

eth1.1 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B9
inet6 addr: fe80::223:cdff:fe19:7fb9/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:5526 (5.3 KiB)

eth1.21 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B9
inet addr:10.136.214.174 Bcast:10.136.215.255 Mask:255.255.252.0
inet6 addr: fe80::223:cdff:fe19:7fb9/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:738 (738.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:962 errors:0 dropped:0 overruns:0 frame:0
TX packets:962 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:72366 (70.6 KiB) TX bytes:72366 (70.6 KiB)

wlan0 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B8
inet6 addr: fe80::223:cdff:fe19:7fb8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2032 errors:0 dropped:0 overruns:0 frame:0
TX packets:3238 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:265129 (258.9 KiB) TX bytes:546413 (533.6 KiB)

ip route show

10.136.212.0/22 dev eth1.21 scope link src 10.136.214.174
192.168.1.0/24 dev br-lan scope link src 192.168.1.1

ip -6 route show

unreachable fd3c:3f33:53a4::/48 dev lo metric 2147483647 error -148
fe80::/64 dev eth0 metric 256
fe80::/64 dev br-lan metric 256
fe80::/64 dev wlan0 metric 256
fe80::/64 dev eth1 metric 256
fe80::/64 dev eth1.1 metric 256
fe80::/64 dev eth1.21 metric 256
unreachable default dev lo metric -1 error -128
ff00::/8 dev eth0 metric 256
ff00::/8 dev br-lan metric 256
ff00::/8 dev wlan0 metric 256
ff00::/8 dev eth1 metric 256
ff00::/8 dev eth1.1 metric 256
ff00::/8 dev eth1.21 metric 256
unreachable default dev lo metric -1 error -128

with igmp snooping turned off:

Summary

root@OpenWrt:~# brctl show
bridge name bridge id STP enabled interfaces
br-lan 7fff.0023cd197fb7 no eth0.1
eth0.2
eth0.3
eth0.4
wlan0
root@OpenWrt:~# ifconfig
br-lan Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::223:cdff:fe19:7fb7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:695 errors:0 dropped:0 overruns:0 frame:0
TX packets:501 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:49992 (48.8 KiB) TX bytes:79019 (77.1 KiB)

eth0 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
inet6 addr: fe80::223:cdff:fe19:7fb7/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:14218 errors:0 dropped:0 overruns:0 frame:0
TX packets:19324 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1535188 (1.4 MiB) TX bytes:3480497 (3.3 MiB)
Interrupt:5

eth0.1 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:92 errors:0 dropped:0 overruns:0 frame:0
TX packets:118 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5265 (5.1 KiB) TX bytes:8319 (8.1 KiB)

eth0.2 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:180 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:13334 (13.0 KiB)

eth0.3 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:177 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:13150 (12.8 KiB)

eth0.4 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:177 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:13150 (12.8 KiB)

eth1 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B9
inet6 addr: fe80::223:cdff:fe19:7fb9/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:74 errors:0 dropped:0 overruns:0 frame:0
TX packets:35 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5382 (5.2 KiB) TX bytes:7194 (7.0 KiB)
Interrupt:4

eth1.1 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B9
inet6 addr: fe80::223:cdff:fe19:7fb9/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:5526 (5.3 KiB)

eth1.21 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B9
inet addr:10.136.214.174 Bcast:10.136.215.255 Mask:255.255.252.0
inet6 addr: fe80::223:cdff:fe19:7fb9/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:738 (738.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1032 errors:0 dropped:0 overruns:0 frame:0
TX packets:1032 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:77126 (75.3 KiB) TX bytes:77126 (75.3 KiB)

wlan0 Link encap:Ethernet HWaddr 00:23:CD:19:7F:B8
inet6 addr: fe80::223:cdff:fe19:7fb8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2980 errors:0 dropped:0 overruns:0 frame:0
TX packets:4512 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:345766 (337.6 KiB) TX bytes:713072 (696.3 KiB)

lan2, lan3 and lan4 appeared in the firewall configuration after I made separate interfaces lan2 for eth0.2 lan3 for eth0.3 and lan4 for eth0.4 with separate ip addresses for each interface, lan2, lan3, lan4 was deleted, but records in firewall config remain