Setting up VLANs for Multizone DHCP

Installing and Using OpenWrt
1

Hello world,

I have this

root@turris:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd0:5769:6ab9::/48'

config interface 'wan'
        option proto 'pppoe'
        option username '*'
        option password '*'
        option ipv6 'auto'
        option mtu '1492'
        option _orig_ifname 'eth1'
        option _orig_bridge 'false'
        option ifname 'eth1.7'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '5t 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '0 5t'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '1 5t'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option vid '4'
        option ports '2 3 5t'

config interface 'LANoben'
        option proto 'static'
        option ifname 'eth0.2'
        option ipaddr '10.10.10.1'
        option netmask '255.0.0.0'

config interface 'Cam'
        option proto 'static'
        option ifname 'eth0.3'
        option ipaddr '192.168.111.1'
        option netmask '255.255.0.0'

config interface 'DMZ'
        option proto 'static'
        option ifname 'eth0.4'
        option ipaddr '10.111.222.1'
        option netmask '255.255.255.0'

As you can tell, I would like separate zones for seperate vlan on separate ports. Each zone should get an own ip and subnet range and be strongly isolated from each other, the dmz even from among each other. So I wrote this:

root@turris:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option port '0'
        option localservice '1'
        option nonwildcard '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'server'
        option ra 'server'
        list dhcp_option '6,192.168.1.1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'LANoben'
        option leasetime '12h'
        option limit '150'
        option interface 'LANoben'
        option start '10'
        list dhcp_option '6,10.10.10.1'
        option ra 'server'
        option dhcpv6 'server'
        option ra_management '1'
        option force '1'

config dhcp 'Cam'
        option start '100'
        option leasetime '12h'
        option interface 'Cam'
        option limit '2'
        list dhcp_option '6,192.168.111.1'

config dhcp 'DMZ'
        option start '100'
        option limit '150'
        option interface 'DMZ'
        option leasetime '1h'
        list dhcp_option '6,10.111.222.1'
        option netmask '255.255.255.0'
        option force '1'

and this

root@turris:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option network 'lan LANoben'
        option forward 'REJECT'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wan2'
        option input 'DROP'
        option forward 'DROP'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config include
        option path '/usr/share/firewall/turris'
        option reload '1'

config include
        option path '/etc/firewall.d/with_reload/firewall.include.sh'
        option reload '1'

config include
        option path '/etc/firewall.d/without_reload/firewall.include.sh'
        option reload '0'

config rule
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config rule 'turris_wan_6in4_rule'
        option enabled '0'

config zone 'dmz'
        option output 'ACCEPT'
        option enabled '1'
        option name 'dmz'
        option input 'REJECT'
        option forward 'REJECT'
        option network 'DMZ'

config forwarding 'guest_turris_forward_wan'
        option name 'dmz to wan forward'
        option dest 'wan'
        option enabled '1'
        option src 'dmz'

config rule 'guest_turris_dns_rule'
        option name 'dmz dns rule'
        option proto 'tcpudp'
        option dest_port '53'
        option target 'ACCEPT'
        option enabled '1'
        option src 'dmz'

config rule 'guest_turris_dhcp_rule'
        option name 'dmz dhcp rule'
        option proto 'udp'
        option src_port '67-68'
        option dest_port '67-68'
        option target 'ACCEPT'
        option enabled '1'
        option src 'dmz'

config redirect 'adblock_dns'
        option name 'Adblock DNS'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option target 'DNAT'

config zone
        option name 'cam'
        option input 'ACCEPT'
        option forward 'REJECT'
        option output 'ACCEPT'
        option network 'Cam'

config forwarding
        option dest 'lan'
        option src 'cam'

config forwarding
        option dest 'wan'
        option src 'cam'

config forwarding
        option dest 'cam'
        option src 'lan'

config forwarding
        option dest 'dmz'
        option src 'lan'

config redirect
        option enabled '1'
        option target 'DNAT'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option name 'Adblock Guest'
        option src 'dmz'

The behaviour I expect is that, depending on the zone a host connects to, they dynamically get a configuration to use the internet. The behaviour I see instead is

  1. a host known from one zone (and therefore with a dhcp lease) gets the same configuration in a different zone disabling wan access.
  2. an unknown host connecting to the dmz zone gets a configuration from the lan range and is unable to connect to wan until I manually change it.

Could you point out what I've misconfigured or could try reinitializing? Many thanks,
P

2

You need to disable dynamic DHCP and use only static leases for all pools/zones except the one you want to use as a default.

3

Thanks for the quick reply! So if I wanted dynamic configuration, I would need additional DHCP server per zone, I can't have one central DHCP server with multiple pools?

I was hoping openwrt would be able to do something like this: https://help.ui.com/hc/en-us/articles/218889067-EdgeRouter-How-to-Create-a-Guest-LAN-Firewall-Rule

1 Like
4

Multiple DHCP pools can be served by a single dnsmasq instance.

5

Thanks for this pointer. I am now looking at dnsmasq config to bind pools to interfaces.

1 Like
6

Here it is:

7

Thanks, but this I already have and it is not doing what I expect. I am now trying to add

config dnsmasq lanoben
...
list interface ...

config dnsmasq dmz
...
list interface ...

to /etc/config/dhcp

8

Those are DNS instances, they are completely different from DHCP pools.

9

It seems I don't understand your advice. What would I need to change to have dynamic configuration in different pools in different vlan?

1 Like
10

It seems I misunderstood you.
The advice applies when you want to run multiple DHCP pools on the same interface.
But, there's no need to disable dynamic DHCP if you use a separate interface per DHCP pool.
In fact, your initial DHCP config looks fine, but the VLAN config is questionable.

1 Like
11

It seems I might have misconfigured the adress ranges:

I now have only /24 subnets (netmask 255.255.255.0 for each interface) and was able to connect a new device to dmz and dynamically obtain a working host configuration.

There seems to be an issue left with devices changing interface / VLAN during dhcp lease. While they get a second configuration, they don't get online. It's a less critical issue.

1 Like
12

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.