Two separate LAN sharing the same gateway

cacodemon79 · August 23, 2024, 8:28pm

Hi, I have the following situation: one LAN (10.0.1.0/24) with 3 routers (R1: 10.0.1.1, R2: 10.0.1.2, R3:10.0.1.3) running Openwrt 23.05.4. R1 is connected to internet through PPPoE. I also installed wireguard in R1 to access my LAN when I am not at home. Everything works well.

Now, I would like to create a second/separate LAN (10.0.2.0/24) with a fourth Openwrt router (same version 23.05.4) with the following requirements:

internet connection taken from the first LAN
clients on LAN1 not communicating with clients on LAN2 and viceversa
VPN (wireguard or openvpn) access (different from the VPN in R1)

Is it possible or the first two requirements are in contrast?

I began by:

connecting R1 (Lan port) to R4 (Wan port)
creating the Lan 10.0.2.0/24 in R4
creating the Wan with a static address (IP in LAN1 range: 10.0.1.4)

Now I am a bit confused on how to continue.

At moment I have no internet connection on R4 (I tried with a ping 1.1.1.1 from ssh but the result was "network unreachable").

I imagine I have to set two static routes (one from R1 to R4 and one from R4 to R1) and set something at firewall level but i am not a network expert and I don't know how to continue.

Can you please help me?

Thanks in advance.

psherman · August 23, 2024, 9:10pm

You don't need another router for this purpose. It can all be done on your main router (R1).

Is there a reason you want to do this on a different router?

Also, what are R2 and R3 for -- are they bridged APs or are they also routing? If the latter, why do you have this configuration as compared to having all routing on the main router?

cacodemon79 · August 23, 2024, 10:33pm

Configuring two VLANs, right?

The reasons are:

I would need the second Lan only on occasional basis
I would need to move sometimes R4 to another location (e.g. my parents' house, where I have a similar network situation)
I would prefer to modify R1, R2, R3 configurations as little as possible since they are working well and, additionally, I cannot leave LAN1 clients without internet connection in the meantime that I correctly set R1, R2, R3

My house has three floors. On each floor I put an openwrt router. R1 is the "main" router. R2 and R3 are set as simple access point (wireless and wired). I disabled DHCP and configured R1 as gateway. I am not sure that the correct reply to your question is that R2 and R3 are bridged APs in my case since, as premised, I am inexperienced in networking and I am trying to learn.

Thanks again for your support

psherman · August 23, 2024, 10:37pm

Yes. Exactly.

How about configuring this one to be used as a travel router. Instead of having to plug it into your home network and then disconnect when you move it, just have it as a spare for when you need to go somewhere else.

The one caveat is the VPN configuration -- depending on the commercial VPN provider, you may or may not be able to setup multiple devices. We can get into that detail later, though.

That is understandable. We could work on R4 in the travel router context, and then once you understand how it works, we can work on R1. As long as you follow our guidance, there is usually minimal downtime (measured in minutes).

Ok... as long as they are basic APs, that's great.

cacodemon79 · August 24, 2024, 12:44pm

I totally agree with you.

My purpose is not only to create a second/separate LAN using the same gateway but also to understand a little more about networking.

So, let's start, as you suggested, with R4 in travel configuration.

Supposing that R1 is the main router of a network acting also as gateway (internet connection settings are defined here, e.g PPPoE or DSL settings) and that it can be openwrt based (as in my house) or vendor firmware based with advanced settings, such as static routes (as in my parents' house).

That said, are the following first steps correct?

connecting R1 (e.g. LAN1 port 4, to be removed from LAN1 bridge) to R4 (Wan port)
creating the LAN2 10.0.2.0/24 in R4
creating in R4 the Wan with a static address (IP in LAN1 range: 10.0.1.4)

Thanks again.

psherman · August 24, 2024, 11:21pm

Leave the lan bridge as is -- there is no reason to remove port 4 from the bridge. But otherwise, yes, connect a cable between the wan port of R4 and the lan port of R1.

Yes, this will just be lan -- no need to call it anything different -- it's already defined, you simply need to change the IP address (10.0.2.1 will give you the 10.0.2.0/24 network)

Just use DHCP for the R4 wan. That makes it easy. You can setup a DHCP reservation on the upstream router so that it always gets the same IP address... but in the interest of making this as 'universal' as possible, don't use a static IP on the actual wan interface of R4.

cacodemon79 · August 26, 2024, 10:17pm

Perfect! These first three steps are very clear and easy to reproduce.

Now, what are the next steps? I guess I have to set something at routing and firewall level ...

psherman · August 27, 2024, 5:36am

On R4, create a guest wifi network. If you need to also make this work with ethernet, we'll make a few quick modifications after this is done.

Here's the process:

https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_webinterface

cacodemon79 · August 27, 2024, 11:36pm

Yes, I need it.

Here I have a doubt.

In a previous step I created the "secondary/separate" LAN 10.0.2.0/24 in R4.

In the process described at the abovementioned link the WiFi guest is attached to the new interface "guest" having an IP address (e.g. 10.0.3.0/24) different from the LAN one (10.0.2.0/24).

Is this required in my case or is it sufficient to link the WiFi guest with the existing LAN interface, considering that the LAN 10.0.2.0/24 is already a sort of "guest" network (with regards to the "main" LAN 10.0.1.0/24)?

In my case, is creating a wifi network with a different ip address from the LAN perhaps useful to allow access to the router configuration page from a non-guest network? Or are there other reasons behind?

Sorry for these stupid questions. I am just trying to understand well what I am doing instead of mechanically performing the suggested steps.

Thanks again for your support.

psherman · August 28, 2024, 12:52am

Ok... I thought we were starting from a near-default state. I didn't realize you had already configured a new network. Let's take a look at the configuration of this device to see where things stand.

From there, I'll review and answer other questions based on what I see.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

cacodemon79 · August 28, 2024, 10:34pm

psherman:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Here below you can find the output of the five commands.

# ubus call system board
{
        "kernel": "5.15.162",
        "hostname": "OpenWrt",
        "system": "xRX200 rev 1.2",
        "model": "TP-LINK TD-W8970",
        "board_name": "tplink,tdw8970",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "lantiq/xrx200",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}

# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdf5:ae84:18be::/48'

config atm-bridge 'atm'
        option vpi '1'
        option vci '32'
        option encaps 'llc'
        option payload 'bridged'
        option nameprefix 'dsl'

config dsl 'dsl'
        option annex 'a'
        option tone 'av'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.0.2.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'dsl0'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
        option device 'lan4'
        option proto 'dhcp'

config interface 'wan6'
        option device '@wan'
        option proto 'dhcpv6'

# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel 'auto'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'W1'
        option encryption 'psk2'
        option key 'xxxxxxxx'

# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

psherman · August 29, 2024, 6:07am

This looks generally fine, but one key thing is that you have port lan4 used in 2 places (br-lan and in the wan interface). It appears that your device has 4 ethernet ports, with lan4 used as either lan or wan. If you plan to use it as the wan, it must be removed from br-lan:

Other than that, you should be fine once you fix that and reboot. Connect a cable between lan4/wan and the upstream lan. At that point, you should see normal connectivity on your TD-W8970 and clients that are connected to it

cacodemon79 · September 2, 2024, 10:13am

Ok!
Now I have internet working for TD-W8970 and clients that are connected to it.

Next steps I would like to achieve:

no access to R1 lan clients from R2 lan clients
wireguard connection always active for R2 lan clients

How to proceed?

Thanks again

cacodemon79 · September 4, 2024, 8:00am

For point 1, I imagine I have to set some rules at firewall level.

Any help?