[SOLVED] Please HELP! I'm pulling my brain out!

deanfourie · August 19, 2022, 11:05am

So, as per the diagram below. I'm created 4 wifi networks which I need separated with VLANs along with the management interface.

I want 2 wifi networks to be on VLAN1 and have full LAN access to the router which hands out DHCP DNS etc.

Then I want the other 2 wifi networks on VLAN2 along with the management interface with web access etc with NO internet access.

I cant for the life of my figure out where to tag the interfaces. Nothing is working. Im sure ive set the cisco trunk up correctly but for some reason I just cannot get the vlan traffic to pass through at all!

Any help will save my sanity!

mk24 · August 19, 2022, 12:03pm

On this model, the single Ethernet port is directly connected to the CPU. There is no switch to configure or DSA. Trunking VLANs can be created with the notation eth0.X where X is the tag number. In the GUI, create new VLAN devices by pulling down the device selector and type the new name in the box at the bottom. Be sure to press Enter to make it stay, if you just click out of the form what you typed will disappear.

It would be a good idea to create a temporary "admin" network with wifi access. Then if your Ethernet is not working you can still log into the AP.

deanfourie · August 19, 2022, 12:10pm

Good point. Ill try see if I can figure out what you mean.

How do I create the notation? Eg, is it a Virtual Ethernet interface?

Thanks

deanfourie · August 19, 2022, 12:16pm

Could you go into a little more detail please.

Where do I assign the VLAN? Assign it to the bridge?
Do I need to create these new sub-interface and if so as what?

Im a little confused as the best way to approach this is?

Thanks

mk24 · August 19, 2022, 12:23pm

I assume you have the administrative LAN and the privileged AP already working as a dumb AP configuration with untagged packets on the Ethernet cable going into the default br-lan.

So first change br-lan's port from eth0 to eth0.1, and set up the Cisco switch so the privileged/management LAN is tagged 1 on the cable. Access to the AP by Ethernet should again be possible. You now have a trunking framework in place so that more VLANs can be added.

Then create a new bridge device named br-guest, with eth0.2 as its device. Create a new network interface named guest with protocol Unmanaged (called proto none on the CLI) and br-guest as its device. Create guest APs with guest as their network. When a guest connects, their packets are dumb bridged over to the switch on VLAN 2. The main router will need to receive them and provide all services such as DHCP and DNS.

In the /etc/config/network file, the guest bridge and interface look like this:

config device
    option name 'br-guest'
    option type 'bridge'
    list ports 'eth0.2'
config interface 'guest'
    option device 'br-guest'
    option proto 'none'

deanfourie · August 19, 2022, 12:29pm

Excellent thank you so much, that makes sense.

Will the Cisco switch be able to interoperate these packets though? Does it need to be setup as a trunk or just access ports? Will the unify and openwrt be sending these sub interface tags as 802.1q packets?

Thanks

mk24 · August 19, 2022, 12:34pm

Yes the tags are standard 802.1q. For best interoperability, configure all networks to use tagged packets, i.e. don't have plain eth0 without a VLAN attached to any bridge or interface. It is a pure trunk cable then.

deanfourie · August 19, 2022, 11:28pm

Ok, Here what I have. I still cant get any LAN access. Vlans are 101 and 102, and need LAN access over VLAN101 which has DNS, DHCP etc.

Does it look correct?

Thanks

deanfourie · August 19, 2022, 11:31pm

psherman · August 19, 2022, 11:31pm

It is far easier if we can see the text config files:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

deanfourie · August 19, 2022, 11:36pm

Can I read the contents of these files via GUI?

Would really prefer not to enable SSH

psherman · August 19, 2022, 11:38pm

You could install luci-app-commands which gives you a command shell in the browser. But the deal is that there is a lot of stuff to review, and it is hard to ensure we can see all the relevant details from screenshots.

Are you local to your router or are you doing this over the internet? And if over the internet, are you exposing the web interface to the internet? ssh is far safer than exposing the web interface. If you're local, you can use ssh without any concerns at all.

deanfourie · August 19, 2022, 11:40pm

If I hover over eth0.101, I can see there is some TX throughput. So the interface is trying to send traffic.

Does this mean it could be a issue with the Cisco switch negotiating the trunk?

Thanks

psherman · August 19, 2022, 11:43pm

Maybe...maybe not... but if we can review your text config files, we can verify your configuration.

deanfourie · August 20, 2022, 12:15am

Sure, Here we are.

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'wireless'
        option encryption 'none'
        option network 'wireless'

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdc8:1c14:f964::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.10'

config device
        option type 'bridge'
        option name 'wireless-br'
        list ports 'eth0.101'
        option ipv6 '0'

config device
        option name 'eth0.101'
        option mtu '1500'
        option ipv6 '0'

config device
        option name 'wlan0'

config device
        option name 'eth0'

config interface 'wireless'
        option proto 'none'
        option device 'wireless-br'

config device
        option name 'eth0.102'
        option mtu '1500'
        option ipv6 '0'

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT
root@OpenWrt:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT

# allow interoperability with traceroute classic
# note that traceroute uses a fixed port range, and depends on getting
# back ICMP Unreachables.  if we're operating in DROP mode, it won't
# work so we explicitly REJECT packets on these ports.
config rule
        option name             Support-UDP-Traceroute
        option src              wan
        option dest_port        33434:33689
        option proto            udp
        option family           ipv4
        option target           REJECT
        option enabled          false

# include a file with users custom iptables rules
config include
        option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

deanfourie · August 20, 2022, 1:03am

Does every interface need a different MAC addrees?

psherman · August 20, 2022, 1:31am

It looks like things should work.... what happens when you connect a device to the wireless network "wireless"? Does the client device get an IP address?

deanfourie · August 20, 2022, 1:37am

No, thats the thing. DHCP is not handled by openwrt but by the router. So the fact that its not getting DHCP tells me that the trunk is not good.

Also cannot ping anything on that vlan over layer 2

deanfourie · August 20, 2022, 1:37am

System
Hostname	OpenWrt
Model	Ubiquiti UniFi AC LR
Architecture	Qualcomm Atheros QCA956X ver 1 rev 0
Target Platform	ath79/generic
Firmware Version	OpenWrt 21.02.3 r16554-1d4dea6d4f / LuCI openwrt-21.02 branch git-22.083.69138-0a0ce2a
Kernel Version	5.4.188

psherman · August 20, 2022, 2:00am

I would generally agree... but, with that said, have you verified that the main router is configured properly to provide service to this network? And the have you verified that the trunk between the router and your switch is working as expected? Pro-tip: create an access port on your switch (i.e. VLAN 101 untagged on one port) and plug an ethernet device into that port... this way you can test the wired connectivity to verify things are working there.