I'll describe first my setup before asking about the VLANs setup.
My ISP is Hyperoptic which provides "Gigabit" internet connection + VOIP. This comes as a cat5 ethernet to my home.
This goes to the hyperoptic router which is handling the voip telephone and have almost everything disabled (wifi, etc) and to my new pfsense router with a ethernet cable as WAN.
pfsense router is responsible for DHCP, DNS, firewall rules and VLAN separation.
An ethernet cable as LAN connects to a TP-Link Archer 7 v2 repurposed router. This is now working as a bridged AP for providing Wireless capabilities to my network.
The ethernet cable which comes from pfsense connects to port 1 of Switch in Archer 7 v2.
Port 2 of the Switch is connected to a simple (unmanaged) switch which shares the network.
The WAN port and interfaces in OpenWRT are not used (I should probably delete the interfaces).
OpenWRT have bridged LAN interface including wifi interfaces (2) + switch interface
The above works properly for all devices incuding wireless but I'd like to adjust it a bit with the following:
Set LAN to run over a VLAN instead (vlan.id 20), getting DHCP from pfsense
Add an IOT wifi which runs on a separate VLAN (vlan.id 30), getting DHCP from pfsense
Add a GUEST wifi which runs on a separate VLAN (vlan.id 40), getting DHCP from pfsense
I've been trying to read about setting a VLAN trunc port in OpenWRT on port 1 of the switch and use port 2 as VLAN 20 (LAN which goes to the unmanaged switch) but can't find anything concrete. Also considering the fact if I set the VLANs wrongly I could lose access to the OpenWRT interface I though it's better to ask.
So let's start with something small for now:
How can I setup a new GUEST wifi which runs over VLAN.id 30 on port 1? This won't have an actual physical port assigned to it as I expect to have only wifi IOT. I've setup a new Wireless interface and assign it to a new VLAN (with id 30) but I'm not sure about the tagging against Port 1.
PS: In pfsense I've already setup the VLANs and interfaces but everything seems to be untagged.
The switch on the Archer C7v2 can be set up using LuCI, or through the command line.
The driver can support a total of 128 VLANs. Use of VID over 127 will require setting the vid option explicitly.
jeff@office:~$ swconfig dev switch0 help
switch0: mdio-bus.0(Atheros AR8327), ports: 7 (cpu @ 0), vlans: 128
I typically configure directly in /etc/config/.network, but all of this can be done through LuCI
Set the VLANs as "tagged" on the ports that you want to be trunks, untagged on those that are intended for devices that aren't using VLAN tags.
Since you're using external DHCP (and possibly DNS) on several of your subnets, disable DHCP and DNS for those subnets on the OpenWrt box.
I typically set a management interface up on a trunked VLAN, or on a specific switch port. Confirming this is up and running helps avoid connectivity loss.
For this, just define a "bridge" and don't associate it with the switch if using OpenWrt DHCP and DNS. If using external DHCP and DNS, then you'll need to trunk it to the box providing those services (and, perhaps NTP).
You'll need firewall rules to prevent cross-VLAN routing.
Thanks for the suggestion but it didn't work as I expected. As @jeff suggested I had setup WAN port as a Management interface so I wasn't locked out.
I'll try something even simpler:
Set a VLAN with id 20 on Port 2 which should go through Port 1 as tagged. Port 2 should connect a physical cable.
Bear with me for a minute as I describe my thoughts.
If I understood correctly on the Luci switch interface set "off" on all different rows (VLANs) for port 2 except the VLAN I'm interested on which is 20 on this case. Then on Port 1 it should be tagged in VLAN 20 row. So anything which belongs to VLAN 20 which is Port 1 and Port 2 should be tagged with VLAN.20 when transmitted from Port 1.
On the interface I'll need to create an interface, let's say LAN, which has physical interface set as eth1.20 (VLAN 20) and IP static on a network/ subnet which matches the interface from pfsense (10.120.20.0/24 in this case).
With the above settings I should be able to plug an ethernet cable on Port 2 and receive an IP from pfsense DHCP on the 10.120.20.0/24 network. And if DHCP works then I am able to connect to pfsense and if something doesn't work after (like DNS etc) then it's Firewall rules for that interface.
Am I missing something obvious on the above scenario?
So after some configuration play I managed to define a "Guest" Wifi interface and bridge it to VLAN 40 which have Port 1 as tagged and Port 4 as untagged. This work as expected and cooperates to pfsense for DHCP / DNS. So overal the GUEST vlan is setup and working as intented.
Now to a more complicated setup of setting the LAN up.
LAN should run on VLAN 20 and should include Port 1 as tagged, Port 2 and Port 3 as untagged along with Wifi from radio0 ("local0") and from radio1 (local1). As you suggested above to setup a L3 interface on it of 10.120.20.2/24 is set
With the above configuration the Port 3 is working fine and I got a DHCP lease from pfsense on the 10.120.20.0/24 network but anything from Wifi connections can't reach pfsense.
I'm not sure why the VLAN 20 configuration would be different than the GUEST, essentially it's the same thing extended to more Ports and Wifi netowrks.
Firewall is set to "Unspecified" so it shouldn't interfear.
What you described isn't too complicated. If I understand you correctly...all you need to do is change:
eth0.1 to eth0.20 on the LAN interface
Change 1 to 20 under Network > Switch
properly tag/untag the LAN ports in question
and get rid of whatever VLAN 20 settings are already present
That depends on your Global Firewall settings. It's always good to place Interfaces in a properly configured Firewall Zone. I'm not even sure why your LAN Interface isn't in the LAN Firewall Zone - like default.
Then something wrong is with the switch. Check again if ports are configured properly in terms of vlan without tagging.
Other than that, you have configured 3 Interfaces in Openwrt with static IPs and gateways. This is wrong. There can be only one gateway, or it will be a mess. Since the Archer is a bridged AP as per your first post, you should keep only one managed interface with IP and Gateway. All routing functions are handled by pfSense.
From my understanding so far your PC is able to get address from pfSense DHCP server on ports 2 and 3. So VLAN20 works fine and packets are sent untagged out of the ports. If you connect it on port 4 you should get IP in VLAN40, according to your diagram.
If the cables work in these test cases, then they are fine. You don't need any special cable for VLANs.
The problem seems to be on the Netgear switch. Try to connect any dumb switch on ports 2 or 3 and verify that hosts connected on that will acquire settings.
Agreed I think it's something with the Netgear switch (and the OpenWRT Access Point where the Wifi which is bridged with VLAN.20 doesn't get IP from DHCP either.
So since this is a OpenWRT forum I'll stick to the OpenWRT questions and deal with the Netgear part myself.
Any idea why would the Bridged Interface (LAN) between VLAN.20 (eth1.20) and Access Points LAN2G (wlan1) and LAN5G (wlan0) only work for physical ports 2, 3 (marked untagged on the Switch UI) and not the wireless?
Note that the VLAN.40 setup works perfectly fine for both Port 4 and GUEST wifi (wlan1-1) and the firewall rules on pfsense are very similar and allow DHCP and DNS requests.
What is it not working here?
The SSID is broadcasting?
The clients can connect successfully?
Do you see DHCP Discovery packets traversing from Openwrt towards pfSense?
Post your firewall configuration also just in case...