Setting up VLAN on AVM Fritz!Box 4040 not working

game · March 6, 2019, 6:42pm

Hello,

I upgraded from a TP-Link TL-WR841N to a AVM Fritz!Box 4040 Router as it has my desired specs and a good price. After a successful installation of OpenWRT v18.06.2 everything works as expected until I try to set up VLANs in the LuCI Web-GUI.

The default "switch0" configuration on the Fritz!Box 4040 is:

VLAN ID	CPU (eth0)	LAN 1	LAN 2	LAN 3	LAN4
1	untagged	untagged	untagged	untagged	untagged

My desired "switch0" configuration is:

VLAN ID	CPU (eth0)	LAN 1	LAN 2	LAN 3	LAN4
1	tagged	off	off	untagged	untagged
2	tagged	off	untagged	off	off
3	tagged	untagged	off	off	off

This configuration is working as expected on my old TL-WR841N (OpenWRT v18.06.2) device.
If I connect to the Fritz!Box via the LAN4 Port and apply this configuration, I can't connect to the device (LAN4 port) anymore. Error Message in the Web-GUI: "Failed to confirm apply within 30s, waiting for rollback" and no SSH connection after that.
The only solution I found was to re-flash the device.

When I saved the desired configuration (connected on the LAN4 port) without applying, the default "LAN" interface auto-migrated from "eth0" to "eth0.1".

The "VLAN on WAN" is an unsupported function on the Fritz!Box 4040. But I'm not trying to set up The VLAN for the WAN port.

Did I do anything wrong? Is this a bug? I would appreciate any help.

jeff · March 6, 2019, 6:49pm

The IPQ40xx has, well, a "different" way of handling VLANs.

See, for example, IPQ40xx Switch Config "Strangeness"

I don't (yet) know the complete set of limitations, nor have I looked at the DTS for your device, but at least on the device I am working with, it seems that there is a "hard wiring" of the ports that "normal" OpenWrt-style configuration can't overcome.

Guessing, your use of VLAN 2 conflicts with the typical configuration of the VLAN used by default by the "wiring" of the WAN port to the internal drivers.

game · March 6, 2019, 8:12pm

@jeff Thanks a lot for the prompt and useful answer!

After reading through the linked and other related threads, I guess this switch for this device is just not fully supported.
You seem to know quite a lot relating this topic. Do you think there is a solution on the horizon?
I'm not as technical but compiling a patched version might be possible for me. Would chunkeeys patch be a help in my case?
Even as I like the new device quite a lot I'm thinking of returning it without proper VLAN support in OpenWrt.

Here is a bug report concerning this topic.

jeff · March 6, 2019, 8:13pm

I wouldn't say that I know a lot about the topic, just been dealing with trying to bring up an IPQ4019 device and trying to understand what the options are. My initial feeling is that VLAN configuration might eventually be possible, within the pre-assigned "groups", either by patching or by modification of the DTS. Either would require a custom build. I'm impressed by the three-radio device I'm working with, but don't know how far I can extend its utility.

arstom · July 17, 2019, 8:30am

Are there any updates on this topic? I would really like to use my 4040 with VLAN.

jeff · July 17, 2019, 9:58am

VLAN trunking seems functional on a dual-nic EA8300. Bridging the LAN/WAN ports needs to be done in the CPU

Pilot6 · July 17, 2019, 10:32am

I checked that VLANs work perfectly on IPQ4018, but you can't setup using Luci, because it removes port 5. That causes wan port disabled.

If you do setup in /etc/config/network, all works OK.

VLAN on WAN also works if you tag correctly.

arstom · July 17, 2019, 10:39am

Thank you very much for your really fast reply

Can I use the configuration from here: IPQ40xx Switch Config "Strangeness" ?

Pilot6 · July 17, 2019, 10:44am

Sure you can setup a similar config.

VLANs work OK, but at the moment setup is not supported by Luci.

Pilot6 · July 17, 2019, 10:53am

The only problem is that vid 1 and 2 are fixed. If you describe your use case, I can help to create a config.
What is the usage of your vlans?

DDK · July 17, 2019, 11:13am

yep, but you need to do it via the /etc/config/network file, not using LuCi's web interface.

Wireshark is your friend - if your computer's network card lets the packets thru that is...

in my case ( compex WPJ428 ) ( dts here )
"eth0" is really "switch0:port5", "eth1" is really "switch0:port4".

When I use VLANS on teh different connector ports I have to specify "eth0.xx" or "eth1.xx" as there seems to be double tagging happening ( the devicetree sets tags for sw0:port4 and sw0:port5 to be "LAN and WAN" ie. vlan 1 and 2 - maybe it's using different CPU mdio or GMAC interfaces ?) .

and then still load the vlan map to the switch knwoing which switch (sw0:port4) port is connected to which "eth" in linux ( eth1 )

it'sconfusing if you are used to the "regular" configs like the ar71xx where it would just be eth0.1 for lan and eth0.2 for wan, eth0 is the cpu "bus" / mdio or gmac into the switch.

my full config for say, VLAN 12 and 15 would be something like this :

config interface priv_lan
   option interface 'eth1.12'

config interface guest_lan
   option interface 'eth0.15'

config switch
   option name 'switch0'
   option reset '1'
   option enable_vlan '1'

config switch_vlan 'eth1_12'
   option device 'switch0'
   option vlan '12'
   option vid '12'
   option ports '0t 4t'

config switch_vlan 'eth0_15'
   option device 'switch0'
   option vlan '15'
   option vid '15'
   option ports '0t 5t'

arstom · July 17, 2019, 11:20am

Thank you very much for your help. But I could set it up meanwhile.

What do you think? Should we add a note to https://openwrt.org/toh/avm/avm_fritz_box_4040 that VLAN is still working? In my opinion the description on that page is a little bit unclear and/or confusing.

Pilot6 · July 17, 2019, 11:26am

Yes, I added a note to NBG6617, that is based on the same chip. Maybe some addition is required to explain tagging on WAN.