I have an Edgerouter X running OpenWrt 18.06.5 with the default configuration.
All of my wired and wireless network clients are connected in a single LAN or VLAN1.
For network security purposes I need to create two LANs with two subnets. 192.168.11.0/24(LAN1) for wireless clients and 192.168.22.0/24 LAN2 for wired clients. Both LANs will be connected to the internet through port eth0 or WAN.
I wanted to divide and assign physical ports of the router such as eth1 and eth2 as LAN1(VLAN1) for Wireless Clients using two access points. The Wired Clients will be using two ports eth3 and eth4 as LAN2 (VLAN3) connected with two switch hubs. Please see the Network Diagram for more details of the network requirements.
I understand from my current research and readings that VLAN is the key and I need to configure the /etc/config/network and /etc/config/firewall config files. VLAN3 has to be created within the switch(Luci) tab and named it as lan2 in the network config file with DHCP enabled. I am hesitant to do it or do some experimentations because I might screw up my Edgerouter X box and won’t be able to use it again.
Might someone out there already have an existing and tested configuration for this kind of setup.
I really appreciate if you could help me. Thanks in advance.
Remove the physical ports from VLAN1 and assign them to VLAN3 (tagged or untagged, depends on the switches 1 and 2). Also include the CPU port as tagged on VLAN3.
Create new interface LAN2 and use physical interface ethX.3 (where X is the number of the internal interface of the Edgerouter switch), add IP/MASK and DHCP settings.
Assign interface LAN2 to a new firewall zone lan2 and allow forwarding to wan zone.
Just in case take a backup before you start.
Connect from the ports labeled eth1 or eth2 when you do all these, not to get locked.
Make use of the Luci roll-back functionality, in case you find yourself locked out, to revert changes.
Click Network --> Interfaces Click "Add new interface" button.
Set the "Name of new interface:" to lan2
Set the "Cover the following interface" to eth0.3
Leave the "Protocol of the new interface" to its default setting "Static address" the click the "submit" button.
LAN2 will be created as a new interface click the edit button.
Set the following fields.
IPv4 Address: 192.168.22.1
IPv4 netmask: 255.255.255.0
IPv4 gateway: 192.168.22.1
Use custom DNS servers: Leave this blank
Note: Please Do not use DNS server unreachable from lan2 interface.
Better don't "Use custom DNS servers" that are unreachable from that interface. If you want the hosts on lan2 to use directly 8.8.8.8, then use option 6 in dhcp server-Advanced Settings tab of the interface.
You can assign the lan2 interface to a new zone also from the Firewall Settings of the lan2 interface tab.
Thanks for your remarks trendy.
I updated the steps above, the custom DNS of lan2 has been remove. No need to specify Custom DNS coz my Openwrt box's DNS is configured with Stubby+dnsmasq for privacy,security and dns encryption. DNSSec Validation is enable in dnsmasq.
New zone also named as lan2 is already been assigned from the firewall setting of lan2 interface tab.
BTW trendy, do I have to enable the bridge interface option in Physical Settings Tab of LAN2 or i have to leave it unchecked?
Not needed. In this field you input the DNS servers that OpenWrt can reach on this interface, so that dnsmasq can use them. In your LAN you don't have any DNS server, so leave it empty.