Hello OpenWRT Community,
I’m going to set up my TP-Link Archer C7 (v5) as a "dumb AP" following the guide on the official OpenWRT documentation site (https://openwrt.org/docs/guide-user/network/wifi/dumbap). My main router is at 10.0.0.1, so I will give the dumb AP 10.0.0.2. The router is running OpenWRT version 23.05.2, with the system specs being a Qualcomm Atheros QCA956X ver 1 rev 0 and firmware version "OpenWrt 23.05.2 r23630-842932a63d". I figured I would factory reset before posting this to make everything more simple.
My bigger goal is to further enhance my home network's security and management by setting up multiple VLANs, specifically for isolating my IoT devices. Each device should automatically be assigned to its own VLAN upon joining the network. These VLANs are intended to keep the IoT devices isolated from each other, only allowing internet access. Furthermore, I want the capability to easily revoke internet access for any device as needed.
To start simple, I want to create two separate VLANs. It's crucial for the IoT devices not to be aware of these VLANs or have the ability to communicate with each other. Their only permitted connection should be to the internet.
I'm reaching out for guidance on how to achieve the following:
- How can I configure my network so that IoT devices are automatically assigned to their respective VLANs upon connection?
- What settings or rules need to be implemented to ensure these devices remain isolated from each other while retaining internet access?
- What's the best method to enable/disable internet access for specific VLANs/devices on demand?
Below are some of the system details I can provide for better assistance:
root@OpenWrt:~# ubus call system board
{
"kernel": "5.15.137",
"hostname": "OpenWrt",
"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
"model": "TP-Link Archer C7 v5",
"board_name": "tplink,archer-c7-v5",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.2",
"revision": "r23630-842932a63d",
"target": "ath79/generic",
"description": "OpenWrt 23.05.2 r23630-842932a63d"
}
}
Network config file:
root@OpenWrt:~# vi /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd66:626a:24b4::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth0.2'
option macaddr 'e4:c3:2a:da:4d:29'
config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '2 3 4 5 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '1 0t'
Wireless config file:
root@OpenWrt:~# vi /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option disabled '1'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option channel '1'
option band '2g'
option htmode 'HT20'
option disabled '1'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
