What happens if you plug your computer into eth3 and eth4?
Nothing. No IP address assigned on eth3 or eth4.
Did you also fix the other DHCP servers?
Let's review the config again.
Hi,
Yes, I changed all the DHCP server names.
Here is the current configuration:
admin@EdgeRouter-X-SFP-6-Port:~$ show configuration all
firewall {
all-ping enable
broadcast-ping disable
ipv6-name WANv6_IN {
default-action drop
description "WAN inbound traffic forwarded to LAN"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
ipv6-name WANv6_LOCAL {
default-action drop
description "WAN inbound traffic to the router"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow IPv6 icmp"
protocol ipv6-icmp
}
rule 40 {
action accept
description "allow dhcpv6"
destination {
port 546
}
protocol udp
source {
port 547
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
options {
mss-clamp {
mss 1412
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
duplex auto
poe {
output off
}
speed auto
vif 10 {
description "Internet (PPPoE)"
pppoe 0 {
default-route auto
firewall {
in {
ipv6-name WANv6_IN
name WAN_IN
}
local {
ipv6-name WANv6_LOCAL
name WAN_LOCAL
}
}
mtu 1492
name-server auto
password ****************
user-id xxxxxxxxxx
}
}
}
ethernet eth1 {
address 10.210.1.1/24
description "eth1 Out of Band"
duplex auto
poe {
output off
}
speed auto
}
ethernet eth2 {
description "eth2 to openwrt"
duplex auto
poe {
output off
}
speed auto
}
ethernet eth3 {
description eth3
duplex auto
poe {
output off
}
speed auto
}
ethernet eth4 {
description eth4
duplex auto
poe {
output off
}
speed auto
}
ethernet eth5 {
description "eth5 spf"
duplex auto
speed auto
}
loopback lo {
}
switch switch0 {
description switch0
mtu 1500
switch-port {
interface eth2 {
vlan {
pvid 100
vid 200
vid 300
vid 400
}
}
interface eth3 {
vlan {
pvid 200
}
}
interface eth4 {
vlan {
pvid 300
}
}
vlan-aware enable
}
vif 100 {
address 10.210.10.2/24
description VLAN100
mtu 1500
}
vif 200 {
address 10.210.20.2/24
description VLAN200
mtu 1500
}
vif 300 {
address 10.210.30.2/24
description VLAN300
mtu 1500
}
vif 400 {
address 10.210.40.2/24
description VLAN400
mtu 1500
}
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name LAN1 {
authoritative enable
subnet 10.210.1.0/24 {
default-router 10.210.1.1
dns-server 10.210.1.1
lease 86400
start 10.210.1.38 {
stop 10.210.1.243
}
}
}
shared-network-name LAN2 {
authoritative enable
subnet 10.210.2.0/24 {
default-router 10.210.2.1
dns-server 10.210.2.1
lease 86400
start 10.210.2.38 {
stop 10.210.2.243
}
}
}
shared-network-name VLAN100 {
authoritative disable
subnet 10.210.10.0/24 {
default-router 10.210.10.2
dns-server 1.1.1.1
lease 86400
start 10.210.10.51 {
stop 10.210.10.201
}
}
}
shared-network-name VLAN200 {
authoritative disable
subnet 10.210.20.0/24 {
default-router 10.210.20.2
dns-server 1.1.1.1
lease 86400
start 10.210.20.52 {
stop 10.210.20.202
}
}
}
shared-network-name VLAN300 {
authoritative disable
subnet 10.210.30.0/24 {
default-router 10.210.30.2
dns-server 1.1.1.1
lease 86400
start 10.210.30.53 {
stop 10.210.30.203
}
}
}
static-arp disable
use-dnsmasq disable
}
dns {
forwarding {
cache-size 150
listen-on eth1
listen-on switch0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
outbound-interface pppoe0
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
unms {
}
}
system {
analytics-handler {
send-analytics-report false
}
crash-handler {
send-crash-report false
}
host-name EdgeRouter-X-SFP-6-Port
login {
user admin {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone UTC
}
admin@EdgeRouter-X-SFP-6-Port:~$
I think you need to add additional listen-on lines:
listen-on switch0.100
listen-on switch0.200
listen-on switch0.300
listen-on switch0.400
Love to, but I just lost access to the web gui. It worked, and then I walked away for a cup of water, and it was no longer accessible.
I can get in via SSH, but the http interface is dead. Tried in Safari and Chrome:
It just hangs when I hit the webserver on port 443 on safari, and hangs on login on Chrome.
Does not make any sense. I won't walk away for a drink again.
Very strange.
Have you tried plain http (port 80)?
I just unearthed my old ER-X, and the configuration looks largely the same for the switch and DHCP.
Try restarting the ER-X and see what happens.
Restarted it by typing
reboot now
in the CLI.
It came back up, but the web server is still unavailable on 443 and 80. I can still get in on ssh.
I will try to add the listeners with the cli......
Suddenly it came back on port 80.
No idea why.
dns {
forwarding {
cache-size 150
listen-on eth1
listen-on switch0
listen-on switch0.100
listen-on switch0.200
listen-on switch0.300
listen-on switch0.400
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
Do I need the cache-size 150?
Yes, leave the cache size line.
Any progress on the ability to get an IP when plugged into eth3/eth4?
1 Like
Yes, progress!
Got 10.210.20.52 for vlan 200 when I plugged it into eth3.
Got 10.210.30.53 from vlan 300 when plugged into eth4
Fantastic!
Now, connect port eth2 to your AP and let's see if it works now!
I and it did nothing.
I plugged my notebook into the same port eth2, and got an IP 10.210.10.51, which was correct.
I presume the problem lies with the TpLink router. I will plug into the TPLink openwrt rj45 port and see what I can see.
Let's review the config of the TP-Link device again:
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
Out of luck.
I disconnected the TPLink and plugged my notebook into it:
I got in on 10.90.0.2
Based on the last time we were configuring that device…
It has a static ip above, and dhcp is disabled.
Try connecting to your computer and setting your computer’s Ethernet port to 10.1.1.5/24 then try to access the device via 10.1.1.2.
1 Like
Ok got in. Thx
# for i in `echo network dhcp wireless firewall`;do echo "############## $i #########";cat $i;don
e
############## network #########
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdb5:d374:7d45::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
# bridge-vlans 100 200 300 400
config bridge-vlan
option device 'br-lan'
option vlan '100'
list ports 'lan:u*'
config bridge-vlan
option device 'br-lan'
option vlan '200'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '300'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '400'
list ports 'lan:t'
# vlan 100 pvid for admin subnet
config interface 'lan'
option device 'br-lan.100'
option proto 'static'
option ipaddr '10.90.0.2'
option netmask '255.255.255.0'
option ip6assign '60'
# interface vlans
config interface 'vlan200'
option device 'br-lan.200'
option proto 'none'
config interface 'vlan300'
option device 'br-lan.300'
option proto 'none'
config interface 'vlan400'
option device 'br-lan.400'
option proto 'none'
############## dhcp #########
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option ignore '1'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
############## wireless #########
config wifi-device 'radio0'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option txpower '20'
option country 'PA'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
#option network 'lan'
option network 'br-lan.100'
option mode 'ap'
option ssid '0750_nomap'
option encryption 'sae-mixed'
option key 'XXXXXXXXXX'
config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
option channel '1'
option band '2g'
option htmode 'HT20'
option txpower '27'
option country 'PA'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
#option network 'lan'
option network 'br-lan.100'
option mode 'ap'
option ssid '0720_nomap'
option encryption 'sae-mixed'
option key 'XXXXXXXXXX'
config wifi-iface 'wifinet200_radio0'
option device 'radio0'
option network 'br-lan.200'
option mode 'ap'
option ssid '2005g_nomap'
option encryption 'sae-mixed'
option key 'XXXXXXXXXX'
config wifi-iface 'wifinet200_radio1'
option device 'radio1'
option network 'br-lan.200'
option mode 'ap'
option ssid '2002g_nomap'
option encryption 'sae-mixed'
option key 'XXXXXXXXXX'
############## firewall #########
config defaults
option syn_flood 1
option input REJECT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name wan
list network 'wan'
list network 'wan6'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-IPSec-ESP
option src wan
option dest lan
option proto esp
option target ACCEPT
config rule
option name Allow-ISAKMP
option src wan
option dest lan
option dest_port 500
option proto udp
option target ACCEPT
### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
# option src lan
# option src_ip 192.168.45.2
# option dest wan
# option proto tcp
# option target REJECT
# block a specific mac on wan
#config rule
# option dest wan
# option src_mac 00:11:22:33:44:66
# option target REJECT
# block incoming ICMP traffic on a zone
#config rule
# option src lan
# option proto ICMP
# option target DROP
# port redirect port coming in on wan to lan
#config redirect
# option src wan
# option src_dport 80
# option dest lan
# option dest_ip 192.168.16.235
# option dest_port 80
# option proto tcp
# port redirect of remapped ssh port (22001) on wan
#config redirect
# option src wan
# option src_dport 22001
# option dest lan
# option dest_port 22
# option proto tcp
### FULL CONFIG SECTIONS
#config rule
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 80
# option dest wan
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
# option target REJECT
#config redirect
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 1024
# option src_dport 80
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
It's 11 p.m here, and I have to sleep.
I really think progress has been made with the ER-X, and this means the Openwrt TPlink RE650 should sort itself out.
Thank-you so much for all of your help.
I will check back in tomorrow.
Good night!