Router static IP inaccessible from connected device on VLAN

Let's start over from scratch. Feel free to take a backup first, but I think we should start from the default config and build from there.

Before doing that, though... what is the output of

ubus call system board
root@OpenWrt:~# ubus call system board
        "kernel": "5.10.146",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 5 (v7l)",
        "model": "Linksys MR8300 (Dallas)",
        "board_name": "linksys,mr8300",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "22.03.2",
                "revision": "r19803-9a599fee93",
                "target": "ipq40xx/generic",
                "description": "OpenWrt 22.03.2 r19803-9a599fee93"

Ok... so you might as well take this opportunity to upgrade to 23.02.3 which was released recently. Do not keep settings when you run the upgrade -- this will get us to the default state. Then post your network config file... we'll build this one VLAN at a time.

I don't think 23.02.3 is available for my router.

1 Like

OK, after much nail-biting and rebooting it is upgraded

Great! Post the default network config.

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr ''
        option netmask ''

config globals 'globals'
        option ula_prefix 'fd92:3d3e:2bc5::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr ''
        option netmask ''
        option ip6assign '60'

config interface 'wan'
        option device 'eth1'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth1'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 0'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '5 0'

K... we'll start with just adding VLAN30.

Before you do anything that I'll recommend below, it makes sense to enable wifi on this device... you can use the basic setup -- just put in an SSID + encryption type + password + country code in the wifi config, and enable it. This will be how you can connect to the device even if we mess up the wired configuration.

Once that is working, you cand do the rest...

add this to the netwok config file

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '30'
        option ports '4t 0t'

config device
        option type 'bridge'
        option name 'br-vlan30'
        list ports 'eth0.30'

config interface 'vlan30'
        option proto 'static'
        option device 'br-vlan30'
        option ipaddr ''
        option netmask ''
        option gateway ''

And then edit br-lan to remove eth0

config device
        option name 'br-lan'
        option type 'bridge'

Now, in the firewall file, add network vlan30 to the lan zone.

Connect port 4, restart the router and see if you can access from another device connected to the the network.

OK, changes done. Router is inaccessible from the connected devices but is accessible from wifi.

The connected PC has an IP address( allocated by the pfsense server from the non-VLAN segment not from vlan 30.

I can only access the router from my phone(I only have a pc not a laptop) so it is tricky to download any files.

Since the PC is on a different subnet, you need to check your pfsense router's firewall rules to see if you've allowed inter-vlan routing. The ideal case is to connect a wired computer directly to vlan30 and then test from there.

The other thing you should verify is that the other end of the wire that connects to lan4 is properly configured for vlan30 tagged on that port. Is it connected directly to your router? a managed switch? or an unmanged switch?

just noticed VLAN functionality is not enabled on the switch. I'll turn that on and restart.

No change there, unfortunately.

I don't want inter-vlan routing

The only computer currently on VLAN30 is the pfsense firewall. It is correctly configured for vlan's as it was correctly supplying addresses for vlan's 10, 30 and 41 before hand.

I have a ethernet cable from a usb/ethernet adapter on my PC to port1 of the router and then a cable from port 4 of the router directly to the pfsense server. It is configured to serve addresses on untagged requests and addresses 192.168.nn.0/24 where nn = the vlan id which can be 10, 30, 41, 42 or 43. this is the new/test network while I work out how to config openwrt. I also have a second cable from my pc through a wifi hub to an unmanaged switch and then a managed switch without vlans to a separate port of the pfsense firewall - this is the original/production network.

I can ping from the pfsense server

Thanks for all your help. It is 01:00 in the morning here for me so I need to go to bed. I'll study the changes you suggested to try to understand what you were proposing tomorrow after work and see if I can complete it myself. Meanwhile if you have any ideas please post them.

Once again, thanks for your help.

In general, that's fine. But if you try to test connectivity from a device on another subnet, it will not be able to reach a host on another subnet, so your PC > OpenWrt test should not surprise you.

This means traffic is flowing properly over the VLAN.

It should be fairly straightforward from here. You'll be setting up VLANs on tagged on the CPU and port 4 (0t 4t). If you want to connect those VLANs with a wifi network, you'll then create a new bridge for the VLAN, a new network interface (proto none), and then go into your wireless file and create a new SSID. Associate the VLAN network with the SSID and it should work.

Typically, in a multi-VLAN dumb AP config, you should not have an address on any VLANs except for the one used for management.

Do yourself a favour and upgrade (again) to a current master/ snapshot build. 22.03.x and earlier is using a very quirky swconfig based switch driver for ipq40xx, while master has been migrated to a properly working DSA driver at the end of last year, which makes your configuration a lot easier.



Hi, so I examined the config you sent and replicated the relevant sections for the other VLANS and it is all working now. Thanks very much for your help.

Thanks for the suggestion. I've had a look but I am a bit nervous about bricking my brand new router at this point especially as it is all working now.

Thanks for your suggestion.

Glad it is working.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.