Hello!
Currently, I have a setup similar to that described in the DSA tutorial: multiple br-* (LAN, IoT, Guest) devices bridging different LAN ports. No VLANs.
I want to connect a "smart" (managed) switch to one of the ports and utilize VLANs to assign different ports on the switch to different VLANs and hence bridges.
My idea was to create VLAN devices and then add them to existing bridges and let OpenWRT figure out tagging/untagging, to limit the scope of VLANs to this one port and the new switch. VLAN documentation made me think it's possible:
When you bridge non-VLAN and VLAN interfaces together, the system takes care about adding VLAN ID when sending packet from non-VLAN to VLAN interface, and it automatically removes the VLAN ID when sending packet from VLAN interface to non-VLAN one.
For simplicity, I'm testing with one VLAN and Windows machine instead of the switch. Windows machine is set to use VLAN10 and connected to LAN5 on the router. With this setup, I can access the internet, but I can't access any other devices connected to the router anymore. They are discoverable with arp -a and I can ping them. This makes me think it might be a firewall issue, but I can't figure out where the problem is.
Could you advise if what I'm trying to achieve is possible and what steps I need to take to make it work?
Here are the relevant parts of the config:
Device Info
The snapshot is custom-built, but I only added some packages and uci-defaults.
> ubus call system board
{
"kernel": "6.6.47",
"hostname": "GL-MT6000",
"system": "ARMv8 Processor rev 4",
"model": "GL.iNet GL-MT6000",
"board_name": "glinet,gl-mt6000",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "SNAPSHOT",
"revision": "r27205-5d107bbbbb",
"target": "mediatek/filogic",
"description": "OpenWrt SNAPSHOT r27205-5d107bbbbb"
}
}
/etc/config/network
config device
option type '8021q'
option ifname 'lan5'
option vid '10'
option name 'lan5.10'
config device 'lan_dev'
option type 'bridge'
option name 'br-lan'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'lan5.10'
config interface 'lan'
option proto 'static'
option device 'br-lan'
option ipaddr '192.168.10.1'
option netmask '255.255.255.0'
option ip6assign '64'
option ip6hint '0000'
/etc/config/firewall
I don't have any Traffic rules with lan as src
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option log '1'
config forwarding
option src 'lan'
option dest 'wan'
Some info from the Windows machine
~ $ ifconfig
...
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . : lan
IPv6 Address. . . . . . . . . . . : fdb6:fa1d:ab5c::10
IPv6 Address. . . . . . . . . . . : fdb6:fa1d:ab5c:0:e91:e04b:36ce:79c0
Temporary IPv6 Address. . . . . . : fdb6:fa1d:ab5c:0:b9ce:b74a:8b27:64cf
Link-local IPv6 Address . . . . . : fe80::ca39:a35b:8348:7b58%50
IPv4 Address. . . . . . . . . . . : 192.168.10.70
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::9683:c4ff:fea7:138c%50
192.168.10.1
~ $ Get-NetAdapterAdvancedProperty |
>> Where-Object { $_.RegistryKeyword -eq "VLAN_ID" } |
>> Select-Object Name, DisplayName, DisplayValue
Name DisplayName DisplayValue
---- ----------- ------------
Ethernet VLAN ID 10
