Tomato Router + OpenWrt AP1 and AP2 VLAN

kriznik · July 25, 2019, 10:50am

Hello folks,
I'm in need to get some professional help from you, as VLAN is driving me crazy

I'm trying to make three separated networks in my house which has got following topology

Main router running Tomato,
AP1 (openwrt 18.x,lan AP,wifi AP) connected by lan
AP2 (openwrt 18x,wifi AP) connected by lan

both AP's are now "Dumb AP" : https://openwrt.org/docs/guide-user/network/wifi/dumbap

I'm perfectly able to create three separated networks on Tomato, which will work as I need. But I need to provide extended wifi signal by AP1 and AP2 which then I need to send to the Router which should assign those to appropriate networks.

So my guess was to use VLAN tags to identify what is what as clients from AP's have to go by LAN

I've tried to make new interface with eth1.4 in openwrt with given wifi, but tomato is not really picking that information on it's side (it looks)
So I've added tagged lan ports into VLAN 4 on tomato, but as well no luck

work in progress:
tomato:

openwrt

Can somebody please give me a help?
I'm kind of lost what is needed and where... And I'm pretty sure it can be done

Thanks a milliontimes!

eduperez · July 25, 2019, 12:09pm

Once you bridge everything together (in the OpenWrt device), you no longer have any isolation...

What you are trying to do is called "trunking". On all nodes, you have to defined several VLANs, tagged on both the internal and external port, then use separate interfaces and networks on each VLAN.

trendy · July 25, 2019, 12:16pm

On Tomato you need to have tagged vlan interfaces for each Wifi towards the access points.

On each AP you need to create a vlan interface that connects to the router and bridge it with the Wifi interface.

kriznik · July 25, 2019, 12:33pm

note: AP's are not connected to the router by Wifi, but via LAN

So i have this

which is what I think you mentioned as vlan interfaces for each wifi as wifi0.3 is bridged to br2 in Tomato

right?

kriznik · July 25, 2019, 12:34pm

(i can't post more than one image per post)

and then on AP I've done:
lans

kriznik · July 25, 2019, 12:35pm

but it's not getting IP from the router as normal lan does
lan-o

(and I guess it's because they have same MAC)

trendy · July 25, 2019, 1:24pm

You cannot pass vlans over wifi anyway.

I have no experience with Tomato, so that would be only guessing.

Better post the output of the OpenWrt routers using preformatted text (Ctrl-Shift-c)
uci show network; uci show wireless
The principle however is to bridge the wired vlan interface of the OpenWrt router that connects to the Tomato with the Wifi instance. For example eth0.4 and wlan0

kriznik · July 25, 2019, 3:47pm

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0 eth1'
        option proto 'dhcp'

config interface 'lan6'
        option proto 'dhcpv6'
        option ifname '@lan'
        option reqprefix 'no'

config switch
        option name 'switch0'
        option reset '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 1 2 3 4 5t'
        option vid '1'

config interface 'lans'
        option type 'bridge'
        option ifname 'eth0.4 eth1.4'
        option proto 'dhcp'

wifi

config wifi-device 'radio0'
        option type 'mac80211'
        option hwmode '11g'
        option path 'platform/qca955x_wmac'
        option htmode 'HT20'
        option channel '11'
        option legacy_rates '1'

config wifi-iface
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'xxxx'
        option key 'xxxx'
        option encryption 'psk2'

config wifi-iface
        option device 'radio0'
        option mode 'ap'
        option ssid 'yyyy'
        option network 'lan'
        option hidden '1'
        option encryption 'psk2'
        option key 'yyyy'

config wifi-iface
        option device 'radio0'
        option mode 'ap'
        option ssid 'separated-test'
        option encryption 'psk2'
        option key 'mysuper123pass'
        option network 'lans'

kriznik · July 26, 2019, 6:50am

so ... I have been able to get it to work on AP2 which is "dumber" of those two, only wireless AP with one lanport which connects ap to the router

config interface 'guest'
        option type 'bridge'
        option proto 'static'
        option ifname 'eth1.3'
        option ipaddr '192.168.1.3'
        option netmask '255.255.255.0'

^ This works
Unfortunately the second AP which has got switch in it as it is formely router, I'm not yet able to get it work.
I've disabled same services, removed switch part from network setting and still no luck. ;/

slh · July 26, 2019, 7:31am

Ignore its WAN port for starting (proto=unmanaged), only use the LAN ports.

kriznik · July 26, 2019, 7:57am

I do, my lan cables are connected to the LAN not WAN and I've removed WAN interface completely, but still no luck

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'main'
        option type 'bridge'
        option proto 'static'
        option ipaddr '10.10.1.2'
        option netmask '255.255.255.0'
        option ifname 'eth1'

config interface 'main6'
        option proto 'dhcpv6'
        option ifname '@main'
        option reqprefix 'no'

config interface 'guest'
        option type 'bridge'
        option proto 'static'
        option ifname 'eth1.3'
        option ipaddr '192.168.1.2'
        option netmask '255.255.255.0'

kriznik · July 26, 2019, 9:30am

I'm slowly getting there... It does look I need to define VLAN's on Dumb AP as well to pass it thru, It's not yet fully done, but looks like the way is kind-ish right

damn

trendy · July 26, 2019, 12:45pm

I mentioned it here as well.




               +----------------+
               |                |
               | Tomato         |
               |                |
               +----------------+
                       ^    ^Trunk Ports
                       |    |
                       |    |
                       |    +---+---------------+
                       |                        |
                       |                        |
                       +Trunk Port              +Trunk Port
               +-----------------+        +-----------------+
               |                 |        |                 |
               |   Dumb AP1      |        |  Dumb AP2       |
               |                 |        |                 |
               +-----------------+        +-----------------+
                SSID bridged to each VLAN interface

Trunk port means that it carries different vlans and optionally an untagged native vlan.
So if the uplink on AP1 is eth0, you need to create vlan interfaces eth0.x and bridge them with the appropriate wireless interface
In Tomato you need to create the same vlan interfaces on each downstream port towards the APs.

kriznik · July 26, 2019, 10:14pm

yeah, I thought that if switch is configured as unmanaged, it will just pass information without need to tag is, as my unmanaged switches across the house do. But unfortunately this one needed vlans to be configured and tagged as disabling switch functionality was not enough

anyway, thanks for your inputs which helped me to see some light at the end of the tunnel

kriznik · July 28, 2019, 8:20pm

so, after some time I'm back
since dumber AP2 is working flawlessly, dumb AP1 is kind of jelly.

AP2 does not have switch inside, so it's only sending tagged clients from wifi to eth1.x (where x is VLAN ID on tomato)
and it goes like this:

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'main'
        option type 'bridge'
        option proto 'static'
        option ipaddr '10.10.1.3'
        option netmask '255.255.255.0'
        option ifname 'eth1'
        option gateway '10.10.1.1'
        option dns '10.10.1.1'

config interface 'main6'
        option proto 'dhcpv6'
        option ifname '@main'
        option reqprefix 'no'

config interface 'guest'
        option type 'bridge'
        option proto 'static'
        option ifname 'eth1.3'
        option ipaddr '192.168.1.3'
        option netmask '255.255.255.0'

obviously different wireless ssid is assigned to gues/main
This is working solution which I'm happy about.

But AP1 which is TL-WR1043ND v2.1 (and so it have switch)
when client is connected to wifi on AP1 it's working, but it's uterly slow, like superabsolute slow with ping to main router over 30s
So I guess there is some issue with that switch still
Configuration goes like this:

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd71:bc20:2d9a::/48'

config interface 'main'
        option type 'bridge'
        option ifname 'eth1.1'
        option proto 'static'
        option netmask '255.255.255.0'
        option ipaddr '10.10.1.2'
        option gateway '10.10.1.1'
        option dns '10.10.1.1'

config interface 'main6'
        option proto 'dhcpv6'
        option ifname '@main'
        option reqprefix 'no'

config interface 'guest'
        option type 'bridge'
        option proto 'static'
        option ifname 'eth1.3'
        option ipaddr '192.168.1.2'
        option netmask '255.255.255.0'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 1 2 3 4'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '5 6t'
        option vid '2'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '0t 4t'

It is working like in terms clients gets right IP from right dhcp BUT when connected to this AP, their internet or even local net is unusable.

But honestly I've run out of ideas where to look, how to inspects what is going on when connected to that AP where packets possibly goes and why it is so slow.
I kind of believe it's because that switch and more than anything I've wanted to get rid of it from configuration completely as is at AP2, but without it it's not working as expected....

anything I'm missing in my configuration and somebody can spot... please?
Thanks

trendy · July 29, 2019, 11:13am

I don't see any mistake, other than you don't need an IP on the guest interfaces, unless you want your guests to access the APs. If not, leave them unmanaged.
For the slowness issue, run top or htop and check if something is slowing your CPU down.

kriznik · July 29, 2019, 11:30am

what do you mean I dont need IP on guest interface? You suggest to run is as dhcp client mode?
(i kind of prefered it that way, but looks like with dhcp mode it's not working at all, eg. it has got same MAC and router probably can't assign correctly different IP's to one MAC)
or?
edit: ah you mean "unmanaged" mode completely, ok i'll try that

and
yeah there was a kworker process with 99% of CPU when wifis were enabled in this configuration. So I guess it's got a hell of work to route those packets somewhere in some kind of loops or smthing
.

Because before (without those VLANS) it was running just normally for couple of years. So again, I guess it's messing with routing.

I'd better like the idea to have it completely unmanaged dumb AP as AP2, but for some reason that switch seems to need to be managed, otherwise it's dropping vlan tags eg. not working ;/

trendy · July 29, 2019, 11:58am

You already have an IP on the main interface for you to manage the APs, so you don't need another IP on the guest interface. You can use the unmanaged protocol, so that it doesn't get any IP.

Enable STP just in case there is some loop in your network.

kriznik · July 29, 2019, 6:39pm

i'll be monitoring it closely for day or two. As it might not be actually related to configuration, I've read over the internet that some people have had 99% cpu by some kmod-led module or whatever.

Or I'll simply configure autorestart each day at 4am .... not nicest solution, but sometimes works best