Recommended Network Configuration

Hi all,

I am new to LEDE and this is my first post on this forum. I am using a Linksys WRT1900AC flashed with the latest LEDE build.

After reading through an overwhelming number of informative articles on both the OpenWRT and LEDE websites, I am seeking some personalized advice on how best to segment our home network into three different sections based on security levels and target usage.

My goal is be have one isolated wireless network (without any guest access) on say on 192.168.3.x where our mobile devices can all connect and browse the Internet. Then, a first LAN network for fixed workstations / NAS file storage on 192.168.4.x, and lastly a second LAN network for our teenage children to use their own fixed workstations on 192.168.5.x.

Ultimately, the networks should not be accessible to one another (i.e. wireless devices will not be able to access either of the LAN networks).

Has anyone here with a similar setup able to provide any tips or advice on how I would go about setting this up?

Any help would be appreciated.

I do have a similar setup:

  • VLAN1 - Default LAN made by LEDE (with IPv6)
  • VLAN2 - Default WAN on LEDE (with various tunnels)
  • VLAN3 - Second Network (with IPv6)
  • VLAN4 - LAN for tunneled AMPRNet /24 (no IPv6)
  • VLAN5 - Public Servers (no DHCP, no IPv6)
  • VLAN6 - Guest WLAN (with IPv6)

As you can see, on a device with only 4 LAN ports, I'd also have to trunk. I also have quite diverse settings on each LAN.

  • You can begin by creating new Interfaces in the LuCI web GUI - you will bridge them, and number them to the next available VLAN number (e.g. eth0.3, eth0.4, etc...)
  • Make a new Firewall Zone for each interface created.
  • Setup forwarding to/from networks, as desired on the LuCI Firewall - General Settings page (e.g. I permit VLAN1 to contact VLAN4, but not vice versa...)
  • If any of your LAN IPs are Public or via tunnels (as in my case), change your default forwarding and input rules to DROP.

Lastly:

Hi lleachii,

Thanks for your reply.

So, I followed your guide by creating three separate interfaces and a firewall zone for each. I just need some further clarity on points three and four of your response.

Setup forwarding to/from networks, as desired on the LuCI Firewall - General Settings page (e.g. I permit VLAN1 to contact VLAN4, but not vice versa…)

Do you have any resources or examples I could follow to help me understand this further?

If any of your LAN IPs are Public or via tunnels (as in my case), change your default forwarding and input rules to DROP

What do you mean by LAN IPs being Public? Are you referring to Windows desktop clients on one of the LAN networks I created? How would this affect a static VPN connection which I am hoping to setup as well?

Those not listed, are Public.

See: https://wiki.openwrt.org/doc/uci/firewall

You're setting up a conventional guest network, twice. Both should (independently) forward to the Internet, but not anywhere else.

First make two additional networks, guest1 and guest2. Set them to static IP addresses 192.168.4.1 and 192.168.5.1. Enable a DHCP server on each.

Presuming all your users are wireless, create two additional wifi APs and link them to the guest networks. If you want wired access to those networks, you will need to configure your switch with VLANs so that some of the Ethernet ports are guest and some are regular LAN. That is for further study. Get wireless working first.

Then make two firewall zones, such as guest1 and guest2, and configure them both to forward to WAN. Attach them to their respective guest networks.

@MK, most of our devices are Ethernet wired so I need to have two separate LANs, one for work, and one for our children. All mobile wireless devices (x3) should go through one wireless network. This is how I came up with the idea of having three separate Networks. Please tell me if my thinking is wrong, I am new to LEDE and keen to learn from others.

Hi all,

So, on my first two attempts at setting up my WRT1900AC v1, I managed to screw things up using the Luci interface so I reset my router back to default and am having another shot at it using smarTTY instead. I think it had something to do with the port switch numbering being out of sync on Luci so rather than modify anything I am seeking further input.

Keeping in mind that I would like to run three independent networks (1 x WLAN, 2 x LAN) with two of these networks going though an OpenVPN connection, could someone please point me in the right direction of modifying my default config file before moving onto the next steps?

Welcome to Smart Terminal.
root@192.168.1.1:~# cat /etc/config/network
sh: /usr/bin/xauth: not found

BusyBox v1.25.1 () built-in shell (ash)

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix '<redacted>'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option ifname 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth1'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 5'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6'

Thanks

You're not wrong.

Hummm....
See: Separate subnet on physical port #4
And: Use WireGuard interface for specific devices only

You can also make a separate WiFi SSID for the children, and attach it to the second LAN.

Baby steps. Forget Ethernet for a bit. First create a guest network bridge, guest WLAN AP, and guest firewall zone. Get all that working. Then do it again for your IoT devices. It is real simple to test over wireless.


Log in via wifi while messing with the switch. Saves headache of losing your Ethernet connection.

The default configuration of the switch has two untagged VLANs, to simply connect one CPU port (eth0) to the 4 LAN ports, and the other CPU port to the one WAN port. You need to start tagging on eth0 so that you can have more than one VLAN going in to the various network bridges.

So change VLAN1 to '0t 1 2 3 5' And in the network interface, change eth0 to eth0.1. This should now work the same as it did before. Now you are ready to break some of the LAN ports out into new VLANs.

Create a new VLAN say 3, with ports '0t 1' Meanwhile remove port 1 from VLAN1, so VLAN1 is '0t 2 3 5'. Attach eth0.3 to one of your guest networks. Now the port 1 cable goes to the guest network instead of the LAN.

The LUCI page showing connect status is very useful to identify the port numbering on the router case vs. the logical port numbers. Plug in a live cable and see which one changes to connected. On the command line you can observe connection status with swconfig dev switch0 show.

Hey @mk24 thanks for the pointers and sorry for taking so long to write back.

So, after reviewing your instructions regarding the VLANS, I think I have this right but wanted to run it by you first before I edit the config file in smarTTY. Could you please review it and let me know if I am on the right track?

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'        

config interface 'lan2'
        option type 'bridge'
        option ifname 'eth0.3'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

config interface 'wan'
        option ifname 'eth1'
        option proto 'dhcp'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 5'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '4 6'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t 1'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option ports '0t 2'

config switch_vlan
        option device 'switch0'
        option vlan '5'
        option ports '0t 3'

I also found the following setup that assigns VLANS to each port on the WRT1200AC / WRT1900AC v2. I am aware that the ports eth0 and eth1 need to be switched on this but would it still work with current build?

https://superuser.com/questions/1061327/how-to-setup-vlans-per-interfaces-on-linksys-wrt-1900-acs-openwrt-chaos-calmer

config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

#wan port
config switch_vlan
    option device 'switch0'
    option vlan '1'
    option vid '100'
    option ports '4 5t'

#port 1
config switch_vlan
    option device 'switch0'
    option vlan '2'
    option vid '2'
    option ports '3 6t'

#port 2
config switch_vlan
    option device 'switch0'
    option vlan '3'
    option vid '3'
    option ports '2 6t'

#port 3
config switch_vlan
    option device 'switch0'
    option vlan '4'
    option vid '4'
    option ports '1 6t'

#port 4
config switch_vlan
    option device 'switch0'
    option vlan '5'
    option vid '5'
    option ports '0 6t'

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix ' ( ...whatever your prefix is... ) '

#Lan on switch port 1
config interface 'lan'
    option force_link '1'
    option proto 'static'
    option netmask '255.255.255.0'
    option ipaddr '192.168.0.1'
    option ifname 'eth1.2'

#Another local network on switch port 2
config interface 'someothernetwork'
    option proto 'static'
    option ifname 'eth1.3'
    option ipaddr '192.168.8.1'
    option netmask '255.255.255.0'

#WAN on the wan port
config interface 'wan'
    option ifname 'eth0.100'
    option proto 'dhcp'

#Wireless
config interface 'wi'
    option type 'bridge'
    option _orig_ifname 'wlan0 wlan1'
    option _orig_bridge 'true'
    option proto 'static'
    option ipaddr '192.168.6.1'
    option netmask '255.255.255.0'

Best regards