Two vlans, ping each other?

Installing and Using OpenWrt
1

I have two vlan’s on same bridge. One goes through Wireguard and the other through wan. Now I can ping each other, isnt it better to isolate them from each other?

How do I do that? I have firewall zones and tried with nft tabled without luck…

VLAN 1

config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan:u*'

config interface 'lan'
option device 'br-lan.1'
option proto 'static'
option ipaddr ''
option netmask '255.255.255.0'
option ip6assign '60'
option delegate '0'

config device
option name 'br-lan.1'
option type '8021q'
option ifname 'br-lan'
option vid '1'
option mtu '1500'

VLAN 10

config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan:t'

config interface 'Lan2'
option proto 'static'
option device 'br-lan.10'
option ipaddr ‘-'
option netmask '255.255.255.0'
list dns '8.8.8.8'
list dns '8.8.4.4'
option delegate '0'

config device
option name 'br-lan.10'
option type '8021q'
option ifname 'br-lan'
option vid '10'
option mtu '1500'

2

Please be specific about how you ran the test... what was the IP address of the source of the pings, and what was the target IP address?

It depends on your goals. In some cases, it's desirable for networks to be able to communicate with each other. In other cases, you may want isolation. We can't answer for you, nor can we guess since it's very much dependent on your needs/desires/goals for the network.

You don't need to redact the IP addresses here.

you didn't show us the firewall file which is critical.

Let's see the complete relevant parts of the config, and please be sure to observe the formatting guidance.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Screenshot 2025-10-20 at 8.14.14 PM

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/firewall
3

Alright:

Vlan1 = 192.168.120.1
Vlan10 = 192.168.121.1

So i can ping 192.168.121.1 from 192.168.120.1
The only purpose to isolate the from each other is I thought there is a security risk, but maybe im only worried….

Network file:

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr ''
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix ''
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
option ipv6 '0'
list ports 'lan'

config device
option name 'lan'
option macaddr ''

config interface 'lan'
option device 'br-lan.1'
option proto 'static'
option ipaddr '192.168.120.1'
option netmask '255.255.255.0'
option ip6assign '60'
option delegate '0'

config device
option name 'wan'
option macaddr ''

config interface 'wan'
option device 'wan'
option proto 'dhcp'
option type 'bridge'
option peerdns '0'
list dns '8.8.8.8'
list dns '8.8.4.4'
option delegate '0'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'

config interface 'Wireguard'
option proto 'wireguard'
option private_key ''
list addresses ''
list dns ''
list dns ''

config wireguard_Wireguard
option description 'WGPeer'
option public_key ''
list allowed_ips '0.0.0.0/0'
option route_allowed_ips '1'
option endpoint_host ''
option endpoint_port ''

config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan:u*'

config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan:t'

config interface 'Lan2'
option proto 'static'
option device 'br-lan.10'
option ipaddr '192.168.121.1'
option netmask '255.255.255.0'
list dns '8.8.8.8'
list dns '8.8.4.4'
option delegate '0'

config device
option name 'br-lan.10'
option type '8021q'
option ifname 'br-lan'
option vid '10'
option mtu '1500'

config device
option name 'br-lan.1'
option type '8021q'
option ifname 'br-lan'
option vid '1'
option mtu '1500'

and firewall:

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Block-Lan-to-Lan2'
option src 'lan'
option dest 'Lan2'
option proto 'all'
option target 'REJECT'

config rule
option name 'Block-Lan2-to-Lan'
option src 'Lan2'
option dest 'lan'
option proto 'all'
option target 'REJECT'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port ''
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port ''
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'vpnfirewall'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'Wireguard'

config forwarding
option src 'lan'
option dest 'vpnfirewall'

config zone
option name 'Lan2'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'Lan2'
option masq '1'

config forwarding
option src 'Lan2'
option dest 'wan'

4

That is not inter-VLAN routing. It is the router responding to another one of the router's addresses. It is expected behavior.

Your config appears to properly isolate 192.168.120.0/24 from 192.168.121.0/24 and vice versa. You can test this by pinging from any host (other than the router itself) in either network to any other host in the other network (again, not the router).

1 Like