I’ve been trying to configure vlans on an R7800 and WRT1900acs v2 running openwrt-24.10.1 with no joy. But based on some of the reading I’ve done it may be that I don’t need vlans anyway. All I’ve wanted to do is have an isolated physical lan port with internet and without gui access, plus an isolated wifi network without gui access.
Is that as secure as having vlan filtering too would be? If not, what are the additional steps necessary to configure vlan filtering? (When I go back and enable vlan filtering in br-lan.1 I’m been presented with yet another vlan device.)
A bit of clarification is needed here. is this one network that has one physical lan port + wifi, or are these two independent networks, one that has only a single physical lan port, and the other that has only wifi?
Security is a largely a function of the firewall. VLAN/bridge-vlan filtering is really a layer 2 concept for the Ethernet connections where you have different networks on the Ethernet ports. Depending on your actual goals, bridge-vlans may or may not be necessary, but can be used safely even if not strictly required to achieve the goal.
Also, you mention two devices... how are these related to each other? Do they both need to participate in the additional networks?
Hi and thanks for replying. Lan port 4 and the guest wifi are on the same network.
Re 2 devices...do you mean the second device I mentioned at the end? That one only showed up after I finished the lan port/wifi config and then tried to add vlan filtering to the mix.
If what I've done is secure, great. But if you could advise how to achieve it with vlan filtering too, I'd appreciate it. I have an Openwrt One arriving next month and am looking forward to setting it up.
In that case, you need to use bridge-VLANs. There is a tutorial here.
In your title and first sentence:
... are both of these in use on the same network? Is the desire to have both of them configured with VLANs? Which one is the main router? Is the other operating as a bridged AP?
The good part, in 24.10.x both wrt1900acs and r7800 use DSA based switch configurations, means you only need to learn/ use a single approach (syntax and and semantics). psherman has already hinted you at the guide for DSA.
True. I've been playing with the config, but still no joy. Once I add it and reboot I'm unable to get back into the GUI. Should it be as simple as adding the following and then configuring the firewall and wifi?
config bridge-vlan
option device 'br-lan'
option vlan '123'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
What you've got there is largely correct, but there is a bit more nuance...
The default lan interface will have device br-lan which will no longer be valid once you establish bridge-VLANs.
That default lan also uses an interface address of 192.168.1.1 which I see you are using for VLAN123. That will conflict if you haven't deleted or renamed the default lan.
And, if you have deleted/renamed the default lan, make sure tour new VLAN123 network is associated with the lan firewall zone so that you don't lose access.
[quote="Ontarier, post:8, topic:233432, full:true"]
Thanks for that. You know, even with my level of knowledge I thought it odd, but since nothing worked as expected I reverted to the example config. But we're closer! I assigned VLAN123 a new IP. But that's the IP address I get on all 4 lan ports, despite lan4 being configured with it's own IP. And Luci won't let me save a wifi config using VLAN4, so I must have done something else wrong.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
And now you can edit the lan interface to use br-lan.3.
I also recommend explicitly specifying that VLAN 123 should be untagged + PVID on its ports by adding :u* to each port like this:
config bridge-vlan
option device 'br-lan'
option vlan '123'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
Do the same on VLAN 4.
You didn't post your firewall config file -- make sure that network VLAN123 and/or VLAN4 is either in the lan firewall zone or is otherwise explicitly allowed input to the router such that you won't get locked out.
Looks good. However, VLAN 4 won't be able to get a DHCP lease because it has input = reject, and no rule to allow DHCP (udp port 67) and there's also no DNS rule (not required, but frequently used; udp+tcp port 53)
And with those recommendations I get the right IP address on lan4. Thanks so much for all this. My OpenWrt One just arrived. I'll try to configure it with just the one vlan. Much appreciated!
