Solved: Vlan tagging for ISP

oscar · June 29, 2018, 2:10pm

Hello,
my internet provider requires vlan 7. I have tried a couple of settings without success. It remains unclear to me

which ports to tag
how, i.e. "tagged, untagged, off

Probably straight forward, but it is too much for my stretched brain

The switch ports on my Archer C7 v2 are

0	eth1
1	WAN
2	LAN1
3	LAN2
4	LAN3
5	LAN4
6	eth0

The corresponding section in /etc/config/network at the moment is:

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

Any advice is appreciated.

Cheers
Oscar

mk24 · June 29, 2018, 2:39pm

Set the second VLAN to number 7 instead of 2.
Make the WAN Ethernet port (1) tagged in that VLAN.
Leave the eth0 CPU port (switch port 6) untagged like in the default configuration. The switch hardware will handle adding and removing tags. Set up that way, the WAN network should be attached to eth0, not eth0.7.

dlakelan · June 29, 2018, 2:40pm

Change that to vlan 7 and ports 1t 6t

Then be sure to change the physical layout of wan to use eth0.7 you can do it in Luci.

oscar · June 29, 2018, 5:33pm

Seems that this is the reason why I did not get it .
@mk24 proposes to tag port WAN only (config switch_vlan option device 'switch0' option vlan '7' option ports '1t 6' I suppose)

@dlakelan implies I'd need to tag port eth0 as well

Consistent, but, is it really the same?

dlakelan · June 29, 2018, 5:51pm

In your current settings, eth0 is tagged "option ports '1 6t'" this connects the WAN labeled physical port to the switch hardware untagged, but sends the packet to the CPU tagged (the switch tags it).

Instead you need the WAN port to send things tagged because that's what your ISP wants. and it wants them tagged with VLAN 7. One correct way to do this is:

option ports '1t 6t'

and then make the WAN "interface" connect to eth0.7

another option is to make port 6 (eth0) untagged, and make WAN interface connect to simply "eth0", since it only interacts with one VLAN and it's therefore unambiguous. The switch hardware will stick the tag on when it goes out the WAN port. But I don't recommend this, I generally used tagged interfaces on infrastructure equipment where possible (ie. routers, switches, APs etc)

dlakelan · June 29, 2018, 5:53pm

Since your ISP is sending you tagged packets, they will come in port 1 tagged, and if you don't make eth0 also tagged, then the switch will actually strip the tag to send it to your router. And vice versa, you'll send untagged packets and the switch will add the tags. Not that this is a problem, but it seems to me like we're better off just having the whole path tagged.

juppin · June 29, 2018, 6:11pm

Assuming port 6 is the cpu port (eth0) and port 1 is the physical wan port.

I would do it as (switch does not change vlan tag):

config interface 'wan'
	option ifname 'eth0.7'
	...
config interface 'wan6'
	option ifname 'eth0.7'
	...

config switch_vlan
        option device 'switch0'
        option vlan '7'
        option ports '1t 6t'

Or you could also do (switch does remove vlan tag for incoming packages and adds it for outgoing packages):

config interface 'wan'
	option ifname 'eth0'
	...
config interface 'wan6'
	option ifname 'eth0'
	...

config switch_vlan
        option device 'switch0'
        option vlan '7'
        option ports '1t 6'

oscar · June 29, 2018, 7:23pm

Unfortunately, none of the suggestions worked. I always made the changes directly to the network file, but the physical connection to eth0.X in LuCI. Also rebooting did not help.

It was also stressfull to revert to the previous status. I did it in LuCI, but still no connection to the internet. Then I looked into the network file

cat /etc/config/network (stripped)
config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3 4 5'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '1 6t'

Changed that back to what it was

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3 4 5'
        
config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

i.e. removed the vid option lines (which I did not put in there, must be from LuCI), restarted network, and internet was back. I don't understand that.

mk24 · June 29, 2018, 7:42pm

It appears you were never running "1t". That is very important, that is the only way the packets will go out over the Ethernet cable to the modem with tags included.

I suggest resetting to a default configuration, make the only change to change the switch config vlan number from 2 to 7 and change port 1 from untagged to tagged. Then set up your pppoe WAN normally on eth0.

The vid option optional in many cases. It is the tag number that is actually in the packet. It has a possible range from 1 to 4094. The vlan option is an index into the switch's table of VLANs. Most consumer equipment has a table much smaller than 4094. I think the switch in the C7v2 can handle up to vlan=127. Many 10/100 SoCs only allow 16.

If you set a vlan but not a vid, it uses the same number for both. This is fine when the vlan numbers are smaller than the maximum table size supported.

You can run swconfig dev switch0 show to read what actually ended up loaded into the switch hardware.

dlakelan · June 29, 2018, 7:49pm

Are you trying to get like a second "channel" on the WAN? (ie. for TV data or something)?

You say "internet was back" but if your ISP requires you to send vlan tag 7 then neither of your configs, nor the default config should ever have worked in the first place.

In any case, if you need vlan 7 then set it up like @mk24 says above. If you need vlan7 to be a second channel then please describe more fully what exactly you need to send and receive on the ISP side?

oscar · June 30, 2018, 11:02am

The modem is able to tag the data. Currently, I am using this way, but I want to handle it through the router

dlakelan · June 30, 2018, 4:05pm

When you say modem, does the modem get removed from the circuit when you set up your router to tag packets? If it's feeding your router untagged packets and expecting untagged packets, then it will likely ignore your packets once they are tagged. I assume the tags are for some hardware farther upstream.

oscar · June 30, 2018, 4:36pm

Sorry, I don't understand. The modem is actually a router, set into bridged mode. For the vdsl profile I can tick to use vlan and then specify the number. When I made the changes on the lede-router, I ticked off usage of vlan before.
I believe in bridged mode the modem either tag or not, depending on the setting. It should not strip tags off, whether they are on outbound data from the router or on inbound from the ISP.

dlakelan · June 30, 2018, 5:08pm

I haven't seen you post a correct config and tell us whether it works or not. I can't really figure out if you tried a correct config, and it didn't work (say, because sending / receiving tagged packets isn't actually supported by your router/modem) or if you never actually configured it correctly and that's why it didn't work.

based on your description of what you need, you should have:

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3 4 5'
        
config switch_vlan
        option device 'switch0'
        option vlan '7'
        option ports '1t 6t'

and then make WAN connect to eth0.7

this does what you asked for: tag packets outgoing / incoming on WAN with VLAN 7. if that doesn't work it's because you're mistaken about what is needed, or haven't configured your ISP modem/router correctly.

oscar · June 30, 2018, 7:07pm

I have to admit that I did not provide much data, I reckoned this would be a simple thing.
My Archer C7 is sitting behind a modem-router ('modem') that has been put into bridged mode. The modem can handle vlan tagging. Here is a screenshot:

Modem still connected to the internet:
Screenshot_20180630_193037

And this is the corresponding network setting on the Archer C7:

cat /etc/config/network 

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'left unchanged'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option delegate '0'
        option ifname 'eth1.1'

config interface 'wan'
        option proto 'pppoe'
        option username 'ISP login name'
        option password 'ISP password'
        option delegate '0'
        option ipv6 '0'
        option peerdns '0'
        option dns '213.73.91.35 208.67.220.220 208.67.222.222'
        option ifname 'eth0.7'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3 4 5'

config switch_vlan
        option device 'switch0'
        option vlan '7'
        option ports '1t 6t

This is the setting that did not work, no internet connection. I rebooted both devices, waiting for at least 10 minutes. No joy.

Reverted back on both Archer C7 and modem, rebooted both, and internet access was back.

From the data provided above it should be clear what is needed. What is wrong?

mk24 · June 30, 2018, 7:19pm

There's no need for a VLAN tag here. If you have your public IP arriving at your router, and incoming connections pass through the modem, that is all that is possible.

VLAN tagging is for cases where the ISP does not let the customer configure the modem, and it is set up to use VLAN tags. Mostly this is done so the ISP has a separate VLAN for their IPTV boxes. When there is just Internet service, with one Ethernet cable from the modem to the router, it does not need to be tagged.

dlakelan · June 30, 2018, 7:57pm

@oscar, you've turned off vlan tagging on the router/modem so it's not surprising that it doesn't like getting vlan tags.

I don't see any reason for you to have vlan tags in this setup.

What's wrong seems to be your supposition that somehow you have to tag your packets vlan 7.

mpa · June 30, 2018, 11:23pm

VLAN 7 tagging is commonly used on German xDSL even without a second channel like IPTV.

Do you expect any benefit from this? You could just keep the working configuration and be done with it.

dlakelan · June 30, 2018, 11:42pm

Sure, but on the connection between his router and his ISP equipment, he's turning off vlan tagging on the ISP device, and then sending tagged packets to it... and somehow being surprised that it doesn't work.

If he turns on vlan tagging on the ISP equipment and has tagging on his LEDE router, it may work, but it has basically zero benefit unless he wants a second channel on his WAN side. vlan tagging is explicitly used to multiplex/de-multiplex different "channels"

slh · June 30, 2018, 11:49pm

It does make sense to do the vlan tagging on the (OpenWrt-) router, instead of making the modem do it for the router - and for several configurations it's even necessary (e.g. 'internet' on vlan tag 7, IP-TV on vlan tag 8, keeping the modem management interface untagged, etc.). How that is about to be configured on the modem is another question, I'm personally doing exactly that (vlan tagging on the router, not the modem), but using a different VDSL modem - so I can't really help you with the vmg1312-b30a (your wan6 configuration should use option ifname '@wan' though).