Tp link archer c7 v2 vlan


when i connect to port 1,3,4 i get DHCP and works fine but port 2 DHCP doesnt work and fails to connect any suggestion why this is happening?
my end goal have 5 vlans each with its respective port and the 5th one will trucked on port4

root@OpenWrt:~# cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fde0:b00f:141a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1.1'

config interface 'lan'
	option device 'eth1.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2 4 5'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 6t'
	option vid '2'

config device
	option name 'eth1.29'
	option type '8021q'
	option ifname 'eth1'
	option vid '29'
	option multicast '1'

config device
	option name 'eth1.30'
	option type '8021q'
	option ifname 'eth1'
	option vid '30'

config device
	option type '8021q'
	option ifname 'eth1'
	option vid '33'
	option name 'eth1.33'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 3'
	option vid '3'

config interface 'lan3'
	option proto 'static'
	option device 'eth1.3'
	option ipaddr '10.36.33.1'
	option netmask '255.255.255.0'

You don't need the 802.1q stanzas... delete them:

Reboot and test again. If it still doesn't work, please post the updated network config file as well as the DHCP and fireawall files.

1 Like

my appoligies i had earlier posted the wrong config. the is updated config

root@OpenWrt:~# cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fde0:b00f:141a::/48'

config interface 'lan'
	option device 'eth1.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2 4 5'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 6t'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 3'
	option vid '3'

config interface 'lan3'
	option proto 'static'
	option device 'eth1.3'
	option ipaddr '10.36.33.1'
	option netmask '255.255.255.0'

firewall:

root@OpenWrt:~# cat /etc/config/firewall 

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'
	list network 'wan6'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vms'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'lan3'

config forwarding
	option src 'vms'
	option dest 'wan'

dhcp:

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'lan3'
	option interface 'lan3'
	option start '100'
	option limit '150'
	option leasetime '12h'

Change the default policy for the input chain to ACCEPT or create the necessary DNS and DHCP firewall rules as for a guest network.

https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guest-wlan#firewall

1 Like

I did that and it worked. Thank you. i did try the same before but for some reason it didn't work then. between now and then i have restarted and updated the packages not sure if that was a reason too.

i am bit confused with having an interface on eth1.29 vs having an interface on a bridge which has base device eth1.29.

currently i have my switch as: (i think my device doesn't have the DSA architecture yet)

Now i removed (uncofigure) any bridge device here:

And i have added an interface directly onto the VLAN just the way WAN was default configured:

reasoning for me to do this: i want to two vlans which will have two different network.

now when i look at the network file i see the interface has an option as bridge but expection was it would not have a bridge since i directly connected it to switch vlan like the wan was configured:

root@OpenWrt:~# cat /etc/config/network 

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdcb:26b2:5a86::/48'

config interface 'lan'
	option device 'eth1.29'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option type 'bridge'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 3 4'
	option vid '29'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 6t'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 2 5'
	option vid '33'

config interface 'lan33'
	option proto 'static'
	option device 'eth1.33'
	option ipaddr '10.36.33.1'
	option netmask '255.255.255.0'
	option type 'bridge'

can you explain why the option type 'bridge' is set? Chatgpt tells me

In OpenWrt, when you define an interface with a VLAN device (ethX.Y), it automatically creates a bridge interface for that VLAN. This bridge is necessary to connect multiple physical or virtual interfaces together at Layer 2 (the data link layer) of the OSI model.

but if thats true then why in the Devices screenshot there is no bridge device?

If you decide to attach wifi interfaces to these networks later, you will need to create bridge devices.

I don't know how the original question was asked, but that is not true. You must create the bridge device(s) manually.

Option type 'bridge' is no longer used in the interface sections and this is a wrong mix of old and new syntax.

# Old syntax
config interface 'lan33'
	    option ifname 'eth1.33' <-- ifname, not device
	    option type 'bridge'
 	    ...

# New syntax
config device
        option name 'br-lan33'
        option type 'bridge'
        list ports 'eth1.33'

config interface 'lan33'
	    option device 'br-lan33'
	    ...
2 Likes

@fOO223Fr - would you be able to clarify a bit about your process? Specifically...

The last line (option type 'bridge') doesn't belong here (as has been established and I think fixed already), but it sounds like it ended up there after you used LuCI to adjust the configuration, but without any direct modification of the config file (i.e. you didn't mention using a text editor or UCI commands). Can you confirm that this is the case? If so...

Because that syntax has been deprecated and is no longer valid, I'm really interested to know exactly what is causing that line to appear. I'd like to try to find the culprit. If you have some time to replicate the process you used earlier via LuCI (documenting every step along the way), we can look again to see if the line re-appears. If so, I'll try to replicate on one of my devices, and then maybe narrow down what is causing this.

If, OTOH, you did actually make the change directly (text editor/CLI), please let us know (and don't be ashamed).... just trying to make sure we don't have an obscure bug somewhere.

Thanks!

i tried to replicate the process but couldn't i will keep an eye on it and if it appears again in interface again i will come back with the reproducible steps

1 Like

the help from @pavelgl unblocked me but now i have two new problems:

  1. hosts from iot vlan can ping hosts in other vlans. i expect that to happen only for mgmt

  2. when i connect using wire to port 4 i except to get a ip from psn vlan but i dont get anything :frowning:

root@OpenWrt:~# cat /etc/config/firewall 

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config zone
	option name 'vms'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'vms'

config zone
	option name 'stg'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'stg'

config zone
	option name 'psn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'psn'

config zone
	option name 'mgmt'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'mgmt'
	option masq '1'

config forwarding
	option src 'vms'
	option dest 'wan'

config forwarding
	option src 'stg'
	option dest 'wan'

config forwarding
	option src 'psn'
	option dest 'wan'

config forwarding
	option src 'mgmt'
	option dest 'wan'

config zone
	option name 'iot'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'
	option masq '1'

config forwarding
	option src 'iot'
	option dest 'wan'

config forwarding
	option src 'mgmt'
	option dest 'psn'

config forwarding
	option src 'mgmt'
	option dest 'stg'

config forwarding
	option src 'mgmt'
	option dest 'vms'

config forwarding
	option src 'mgmt'
	option dest 'iot'

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdc9:baec:6677::/48'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2'
	option vid '29'
	option description 'mgmt'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 3'
	option vid '30'
	option description 'vms'

config switch_vlan
	option device 'switch0'
	option vlan '4'
	option ports '0t 4'
	option vid '32'
	option description 'stg'

config switch_vlan
	option device 'switch0'
	option vlan '5'
	option vid '33'
	option description 'psn'
	option ports '0t 5t'

config switch_vlan
	option device 'switch0'
	option vlan '6'
	option ports '0t 5t'
	option vid '34'
	option description 'iot'

config interface 'vms'
	option proto 'static'
	option device 'eth1.30'
	list ipaddr '10.36.30.1/24'

config interface 'stg'
	option proto 'static'
	option device 'eth1.32'
	list ipaddr '10.36.32.1/30'

config interface 'psn'
	option proto 'static'
	option device 'eth1.33'
	list ipaddr '192.168.33.1/28'

config interface 'mgmt'
	option proto 'static'
	option device 'eth1.29'
	list ipaddr '10.36.29.1/29'

config device
	option type 'bridge'
	option name 'br-iot'
	list ports 'eth1.34'
	option bridge_empty '1'
	option ipv6 '0'

config interface 'iot'
	option proto 'static'
	option device 'br-iot'
	list ipaddr '192.168.34.1/24'

config device
	option name 'eth0.2'
	option type '8021q'
	option ifname 'eth0'
	option vid '2'
	option ipv6 '0'

config switch_vlan
	option device 'switch0'
	option vlan '7'
	option ports '1 6t'
	option vid '2'
	option description 'wan'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'psn'
	option interface 'psn'
	option start '0'
	option limit '150'
	option leasetime '12h'
	option force '1'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option force '1'

config dhcp 'vms'
	option interface 'vms'
	option start '0'
	option limit '150'
	option leasetime '12h'

ip a and traceroute

$ ping 10.36.29.1
PING 10.36.29.1 (10.36.29.1) 56(84) bytes of data.
64 bytes from 10.36.29.1: icmp_seq=1 ttl=64 time=16.7 ms
^C
--- 10.36.29.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 16.681/16.681/16.681/0.000 ms
$ traceroute 10.36.29.1
traceroute to 10.36.29.1 (10.36.29.1), 30 hops max, 60 byte packets
 1  10.36.29.1 (10.36.29.1)  1.155 ms  1.214 ms  1.558 ms
$ traceroute 10.36.30.1
traceroute to 10.36.30.1 (10.36.30.1), 30 hops max, 60 byte packets
 1  OpenWrt.lan (10.36.30.1)  1.314 ms  1.266 ms  1.651 ms
$ traceroute 10.36.32.1
traceroute to 10.36.32.1 (10.36.32.1), 30 hops max, 60 byte packets
 1  10.36.32.1 (10.36.32.1)  1.069 ms  1.119 ms  1.295 ms

It appears that from a device on the iot network you ping/traceroute the router itself, not devices on other VLANs. This is normal behavior because the default policy for the input chain of the iot zone is set to ACCEPT and thus it allows access to all router interfaces.

Is the device connected to port 4 configured to accept tagged frames with VLAN ID 33?

Option start defines the first address in the DHCP pool. 0 is the network IP address, so it is not a valid value. The first IP address in the pool will be 1 and it overlap with the router's IP address set for the psn interface.

This causes problems in the latest releases and should be avoided.

1 Like

Thank you

Does the device connected to port 4 need to be configured to accept tagged frames? because interfaces are different (psn and iot) anyone connecting to iot which is through wifi and anyone connecting with wire on port4 is part of psn

the expectation is when any packet arrives at port4 via wire then it gets tagged 33 and when any packet arrives at port4 via wireless then it gets tagged 34

config wifi-iface 'default_radio1'
	option device 'radio1'
	option mode 'ap'
	option ssid 'OpenWrt-2.4'
	option encryption 'none'
	option network 'iot'

@fOO223Fr - I want to tell you that you are vindicated! I wrote up my findings about how this line is seemingly randomly appearing in config files when it shouldn't.

2 Likes

If you connect to psn or iot wirelessly, you will get an IP on the respective network.

This does not apply to wired devices. Currently port 4 only works with tagged frames - vid 33 (psn) and vid 34 (iot). The connected device must be configured to work with tagged frames and it will receive an IP depending on the tag set (33 or 34).

Usually, this approach is not used with end devices, but when the traffic of several VLANs needs to be carried over a single cable.

If you want the device connected to port 4 to get an IP on the psn network, just set the port to untagged for vid 33.

Thank you again. Yes yesterday night this is what i ended up doing with help of a local friend who is good with networking. We also concluded that the DSA architecture (used it in my broken wrt1900ac) is much easy to understand than "Switch" tab. Not sure where to track any progress on that topic for this device.

Things are good now except i realized the archer c7 v2 is too old to do pppoe with NAT and maxes out at 200Mbit/s:

haha i see that. wonderful piece and congratulations on being able to reproduce a bug which you didn't even face to begin with! You must have some super power to read into problems and being able to reproduce.. :smiley:

Thanks. As you can guess, I've seen the results of that bug enough times as to be baffled about how so many people had that deprecated/invalid line in their configs! I had a few ideas about what could cause it, so just a few minutes into my testing and I found the 'problematic' sequence.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.