[SOLVED] Need help configuring a separate LAN using the WAN port

[huj3r]

Hi there

I have a C7 V2 configured as an AP and I'd like to use the WAN port so that the device I connect it to lives in its own LAN, with internet access but incapable of seeing or contacting the hosts on the main LAN.

I have read multiple threads but I cannot figure out how things should be configured.

This is my network file:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdba:fd2c:4f2e::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.2'
        list ports 'eth1.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.2'
        option gateway '192.168.1.1'
        list dns '8.8.8.8'
        list dns '9.9.9.9'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

DHCP is disabled since the main router takes care of that part.

This is how switching looks like from LuCI:

I am using OpenWRT 21.02

Thanks for any advice you could provide!

Update 21-05-2021: I have created a wiki page with the steps here: https://openwrt.org/user/huj3r/separate_lan_using_wan_port

[WereCatf]

1. You've got both VLANs connected to br-lan: remove VLAN2 from it, then create a new interface (e.g. "LAN2") with just VLAN2 in it and give it IP-address 192.168.2.1 or similar.
2. Create a new firewall-zone for LAN2 and disable forwarding from LAN<->LAN2
3. Create a new firewall-rule for LAN2 to allow forwarding from LAN2 to !192.168.1.0/24 -- the exclamation-mark inverses that rule, ie. it basically says "allow forwarding to anything except to the 192.168.1.0/24-network"
4. You need to add a static route on your main router for 192.168.2.0/24, with 192.168.1.2 as the gateway.
5. Add a firewall-rule for LAN-zone to allow forward from !192.168.1.0/24 to LAN2-zone, or allow forwarding from any to LAN2, if you want to be able to connect from LAN to LAN2, but not vice versa.

[huj3r]

@WereCatf

You've got both VLANs connected to br-lan: remove VLAN2 from it

Thank you for your reply! I am almost able to follow all of it, but getting stuck at this step right now: how do I know which is which?

Is eth0.2 corresponding to the WAN ethernet port on the C7, or is it eth1.1? I cannot find a cross-reference in the Network -> interaces or in Network -> Switch that would let me understand this.

Edit: I think it's eth0.2 because eth0 is one of the CPU ethernets and .2 must correspond to VLAN 2?

[WereCatf]

@huj3r

how do I know which is which?

The .2 is VLAN 2, .1 is VLAN 1, ie. the dot followed by a number indicates the VLAN.

[huj3r]

@WereCatf

The .2 is VLAN 2, .1 is VLAN 1, ie. the dot followed by a number indicates the VLAN.

Thanks! Was having some trouble at understanding the Switch page; now I still need to keep a bridge for the regular ethernet ports even if it has only eth1.1 in it because it is needed for the WLAN, is that right?

[WereCatf]

A bridge groups different network-ports together and allows for traffic to flow between them, so yes, if you want WLAN and the LAN-ports to all be part of the same LAN-network, they all need to be part of the same bridge.

[huj3r]

@WereCatf

create a new interface (e.g. "LAN2") with just VLAN2 in it and give it IP-address 192.168.2.1 or similar.

Thanks; here you mean that I should assign a static address to the new interface so that it creates its own separate network, but do I leave the main router as IPv4 gateway? I guess so

[WereCatf]

Yes. Don't forget to set up a DHCP-server up on LAN2 as well.

Do let me know, if you need more help. It may take a while for me to reply, though, because I'm kind of busy at the moment.

[huj3r]

@WereCatf

Yes. Don't forget to set up a DHCP-server up on LAN2 as well.

Do let me know, if you need more help. It may take a while for me to reply, though, because I'm kind of busy at the moment.

Thanks! I already added the DHCP server. You have been extremely helpful, I was thinking perhaps once I am done I could add a wiki page about this.

@WereCatf

or allow forwarding from any to LAN2, if you want to be able to connect from LAN to LAN2, but not vice versa.

Indeed, that's what I am going for!

@WereCatf

2. Create a new firewall-zone for LAN2 and disable forwarding from LAN<->LAN2
3. Create a new firewall-rule for LAN2 to allow forwarding from LAN2 to !192.168.1.0/24 -- the exclamation-mark inverses that rule, ie. it basically says "allow forwarding to anything except to the 192.168.1.0/24-network"

I created these rules

1. accept forward LAN -> LAN2
2. reject forward LAN2 -> LAN
3. accept forward LAN2 -> any

Because of the order it should still work as intended? I can SSH into a LAN2 host from LAN however LAN2 hosts have no internet. Perhaps I need NATing too?

I already did step 4 (adding a static route on the main router) and DHCP is working fine, but it just can't route packets through the default route (192.168.2.1, which can be pinged though).

root@debian:~# ip route
default via 192.168.2.1 dev eth0 proto dhcp metric 100 
169.254.0.0/16 dev eth0 scope link metric 1000 
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.186 metric 100 
root@debian:~# ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.194 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=64 time=0.221 ms
^C
--- 192.168.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1029ms
rtt min/avg/max/mdev = 0.194/0.207/0.221/0.013 ms

[WereCatf]

@huj3r

I already did step 4 (adding a static route on the main router) and DHCP is working fine, but it just can't route packets through the default route (192.168.2.1, which can be pinged though).

Are you sure you added the static route correctly?

[WereCatf]

1. Set up VLANs:
   

   

2. Remove the VLAN2 from br-lan, then create a new bridge br-lan2 using VLAN2. Then proceed to create a new interface LAN2 with br-lan2.
   

   

3. Configure LAN2
   

   

4. Don't forget the firewall-zone for LAN2
   

   

5. Set up the zones.
   

   

6. Set up minimal rules for Internet-connectivity.
   

   

Disclaimer: different router than OP's. The same procedure applies, however. Another --possibly easier -- option would be proper tagged VLANs, but that requires the main router to support those as well.

[huj3r]

@WereCatf

Are you sure you added the static route correctly?

Only on the main router, yes; I didn't reboot the router but I applied the changes.

@WereCatf

Set up VLANs:

Check

@WereCatf

Remove the VLAN2 from br-lan, then create a new bridge br-lan2 using VLAN2. Then proceed to create a new interface LAN2 with br-lan2.

I didn't create br-lan2 for it! Will do it.

@WereCatf

Configure LAN2
Don't forget the firewall-zone for LAN2

Check; but will have to repeat it.

Thanks!

[huj3r]

@WereCatf

Another --possibly easier -- option would be proper tagged VLANs, but that requires the main router to support those as well.

It is another device with OpenWRT so I could also do that.

I followed all the instructions but still no routing

My /etc/config/firewall:

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config include
        option path '/etc/firewall.user'

config zone
        option name 'LAN'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'lan'
        option forward 'ACCEPT'

config zone
        option name 'LAN2'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'LAN2'

config forwarding
        option src 'LAN'
        option dest 'LAN2'

config rule
        option name 'LAN2_fwd_internet'
        option src 'LAN2'
        option dest '*'
        list dest_ip '!192.168.2.0/24'
        option target 'ACCEPT'

My /etc/config/network:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdba:fd2c:4f2e::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.2'
        option gateway '192.168.1.1'
        list dns '8.8.8.8'
        list dns '9.9.9.9'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

config device
        option type 'bridge'
        option name 'br-lan2'
        list ports 'eth0.2'

config interface 'LAN2'
        option proto 'static'
        option device 'br-lan2'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

The /etc/config/network on the main router:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fa12:816e:8ab3::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1.1'
        option igmp_snooping '1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.1'
        list dns '8.8.8.8'
        list dns '9.9.9.9'

config interface 'wan'
        option proto 'pppoe'
        option ipv6 'auto'
        option device 'eth0.6'
        option username 'internet'
        option password 'ppp'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 4 3 2 1'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '6'
        option ports '0t 5t'

config device
        option name 'eth0.6'
        option type '8021q'
        option ifname 'eth0'
        option vid '6'

config route
        option interface 'lan'
        option target '192.168.2.0/24'
        option gateway '192.168.1.2'

I do not need any LAN IP on br-lan2 and I do not need any forwarding for packet replies coming back from internet into the LAN2 hosts?

[huj3r]

Found the culprit:

I was testing only with pings, but I had never enabled ICMP in the traffic rule my bad...
I noticed that traceroute was doing successful reverse DNS and then tried a curl command and found the issue; many thanks for all the help! I will start a wiki page, perhaps we could add there also the other approach with native VLANs?

[WereCatf]

@huj3r

list dest_ip '!192.168.2.0/24'

The firewall rule is wrong, by the way: it's supposed to be !192.168.1.0/24, ie. to any zone except LAN.

@huj3r

I was testing only with pings, but I had never enabled ICMP in the traffic rule my bad...

That's my bad: I should have told to set the protocol to 'Any'. When you're used to doing things like this, it's sometimes a little too easy to forget to mention every single thing someone with less experience needs to know about

@huj3r

I will start a wiki page

You should maybe ask others here as well for some opinions on whether you should do a whole new page or just extend an existing one. I mean, you are basically just setting up a guest network here, even if you are doing it for your own uses, and there are some pages for guest networking there already.

Also, this setup is kind of minimal: if you e.g. wanted to be able to have port-forwarding from the main-router's WAN into some devices on LAN2, you'd also need to add a new rule on LAN2-zone that allows forwarding from 'any' to the desired port of the desired device on LAN2.

Currently you don't need one for general Internet-traffic, because when a device on LAN2 contacts something on the Internet, the routers now consider a connection between that device on LAN2 and the something on the Internet as having been established and thus allow for related traffic in the other direction as well. Alas, if you have port-forwarding set up, there is no connection established between the device on LAN2 and whatever on the Internet yet, so there has to be a rule to allow the traffic in even without there being a pre-established connection.

Anyways, I'll look into explaining the basic setup for a tagged VLAN later on. I'll leave the Wiki-stuff to you; I have Asperger's syndrome and I am not always particularly clear or efficient in my communications.

[huj3r]

@WereCatf

@huj3r

list dest_ip '!192.168.2.0/24'

The firewall rule is wrong, by the way: it's supposed to be !192.168.1.0/24, ie. to any zone except LAN.

Yes, I put in the right one already.

@WereCatf

@huj3r

I was testing only with pings, but I had never enabled ICMP in the traffic rule my bad...

That's my bad: I should have told to set the protocol to 'Any'. When you're used to doing things like this, it's sometimes a little too easy to forget to mention every single thing someone with less experience needs to know about

It's ok, we can share the blame on this I remember looking at the combo box options for a minute but I didn't connect the dots. I am inexperienced with OpenWRT and the web UI very often leads me to dead ends (I am not saying it is a bad UI, just not great for me).

@WereCatf

You should maybe ask others here as well for some opinions on whether you should do a whole new page or just extend an existing one. I mean, you are basically just setting up a guest network here, even if you are doing it for your own uses, and there are some pages for guest networking there already.

Also, this setup is kind of minimal: if you e.g. wanted to be able to have port-forwarding from the main-router's WAN into some devices on LAN2, you'd also need to add a new rule on LAN2-zone that allows forwarding from 'any' to the desired port of the desired device on LAN2.

Currently you don't need one for general Internet-traffic, because when a device on LAN2 contacts something on the Internet, the routers now consider a connection between that device on LAN2 and the something on the Internet as having been established and thus allow for related traffic in the other direction as well. Alas, if you have port-forwarding set up, there is no connection established between the device on LAN2 and whatever on the Internet yet, so there has to be a rule to allow the traffic in even without there being a pre-established connection.

I understand; I could not find any wiki page explaining anything similar though.

@WereCatf

Anyways, I'll look into explaining the basic setup for a tagged VLAN later on. I'll leave the Wiki-stuff to you; I have Asperger's syndrome and I am not always particularly clear or efficient in my communications.

Thanks for the help so far! I didn't have any problem understanding what you wrote, but I also have little experience with OpenWRT so every option is a question for me.