Stuck configuring VLAN´s

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi Everyone,

Iam running Openwrt 24.10 on a NWA50x Pro connected to an Opnsense Firewall through an unmanaged Switch.

I got the Device setup as an "Dumb AP" with a static IP in the Range of the trusted LAN-Net. DHCP, firewall is regulated by the firewall as expected.

Now ive been trying to add my guest und io vlan´s to the Zyxel consultating multiple Guides, Vides and existing Threads - but i cant get it to work.

The setup is working with no issues using an Ubiquite U6 Lite (which i want to replace with an Openwrt-Device).

At the moment i managed to add VLAN´s to the br-lan bridge (After multiple LOckouts/Crashes i must say). Now i started adding a Test-.Wifi´s for the LAN Net and the guest Net - applying the new wireless config i got locked out again a few times but now it stuck - however when i connect to the test-guest network the devices get´s an ip from the LAN Range and not the guest Range.

Could someone please review my config? I know iam missing something but i cant get trough to it... Iam willing to learn

Network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdf6:d550:420::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	option ipv6 '0'
	option igmp_snooping '1'
	list ports 'eth0'
	list ports 'vlans.72'
	list ports 'vlans.86'
	option vlan_filtering '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.64.0.89'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '10.64.0.1'
	list dns '10.64.0.1'

config device
	option name 'eth0'
	option ipv6 '0'

config bridge-vlan
	option device 'br-lan'
	option vlan '72'
	list ports 'eth0:t'
	list ports 'vlans.72:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '86'
	list ports 'eth0:t'
	list ports 'vlans.86:t'

config interface 'guest'
	option proto 'static'
	option device 'br-lan.72'
	option ipaddr '10.72.0.89'
	option netmask '255.255.255.0'
	option gateway '10.72.0.1'

config interface 'iot'
	option proto 'static'
	option device 'br-lan.86'
	option ipaddr '10.86.0.89'
	option netmask '255.255.255.0'
	option gateway '10.86.0.1'

Wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option channel '1'
	option htmode 'HE20'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'LAN'
	option encryption 'psk2'
	option key '*****'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option band '5g'
	option channel '36'
	option htmode 'HE160'
	option cell_density '0'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'ap'
	option ssid 'TESTguest'
	option encryption 'psk2'
	option key '****'
	option network 'guest"

DHCP

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option ignore '1'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option ignore '1'

Firewall

config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	list network 'guest'
	list network 'iot'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

Thanks!

2

This config has many errors. Fortunately, since there's just one ethernet port, it should not be too difficult to get this working...

Start by returning br-lan to the default state:

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

Then, delete all of this:

Create 2 new bridges like this:

config device
	option name 'br-guest'
	option type 'bridge'
	list ports 'eth0.72'

config device
	option name 'br-iot'
	option type 'bridge'
	list ports 'eth0.86'

Then edit your guest and iot networks to use those bridges and they should also be unmanaged:

config interface 'guest'
	option proto 'none'
	option device 'br-guest'

config interface 'iot'
	option proto 'none'
	option device 'br-iot'

Delete these:

And remove the guest and iot networks from the lan firewall zone:

Restart and test again.

3 Likes
3

:grimacing: :rofl:

Thanks for the quick reply!

Iam not yet comfortable using ssh for editing configs, but i will try to figure it out through the gui.

Edit:
I dont want to count the chickes before they hatch but think i got it translated to the gui and working. In hindsight, keypoint for me was that you can add custom devices (eth0.VLAN.ID) and just to leave the matching Interface unmanaged.

4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.