VLAN and DSA, can someone help?

[fluffymadness]

Hi. Right now I'm trying to migrate my VLAN Setup that was done via switchconfig on an er-x to a Nanopi r2s
Despite reading and searching I'm not really sure how I can configure the same via DSA.

I'd like to have the following setup

The r2s only has one lan port
So I'd need to tag VLAN100 and VLAN200
On the cisco switch from port 2 and 3 I'll just make port based vlans (no tags needed)

I want to have the following on vlan100:

192.168.1.x (dhcp)

and on vlan200

192.168.2.x (dhcp)

I tried to get some information out of:

VLAN

WRT3200ACM and DSA

Hi, Thanks! I managed to solve my DSA configuration. Setup with multiple bridges is not working ok, because there is a problem in communication between tagged and untagged interfaces in the same bridge. So, it seems that setup with single bridge is working fine. VID | lan0 | lan1 | lan2 | lan3 | wan | ---------------------------------------- 201 | t | t | u | u | | 202 | t | t | | | | 204 | t | t | | | | 2 | | | | …

and came up with the following so far: (which probably has some errors or missing stuff)

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd47:251f:0166::/48'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth1.100'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'vlan200'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ifname 'eth1.200'

config device 'lan_eth1_dev'
        option name 'eth1'
        option macaddr '3e:7e:de:ae:66:f2'

config interface 'wan'
        option ifname 'eth0'
        option proto 'dhcp'

config device 'wan_eth0_dev'
        option name 'eth0'
        option macaddr '3e:7e:de:ae:66:f1'

config interface 'wan6'
        option ifname 'eth0'
        option proto 'dhcpv6'

Also would I need a script to bring everything up, like the one in the wrt3200acm post I linked above?
Maybe someone can point me in the right direction. Thanks

[kmarzic]

Hi,
I have similar setup - on LAN interfaces few tagged network.
I have also NanoPI R2S, and my setup is similar, and your should be something like this:

# cat /etc/config/network

...
config interface 'lan'
        option type 'bridge'
        option ifname 'eth1'
        option proto 'static'
        option ipaddr '192.168.89.1'
        option netmask '255.255.255.0'
        option ip6assign '64'

config interface 'vlan100'
        option proto 'static'
        option ipaddr '10.254.100.1'
        option netmask '255.255.255.0'
        option ifname '@lan.100'
        option ip6assign '64'
        option ip6hint '1'

config interface 'vlan200'
        option proto 'static'
        option ipaddr '10.254.200.1'
        option netmask '255.255.255.0'
        option ifname '@lan.200'
        option ip6assign '64'
        option ip6hint '1'
...

# cat /etc/hotplug.d/iface/21-lan
#!/bin/sh
[ $INTERFACE = lan -a $ACTION = ifup ] || exit 0

#### enable VLAN filtering
ip link set dev br-lan type bridge vlan_filtering 1

#### clear out vlan 1
bridge v del dev eth1 vid 1
bridge v del dev br-lan self vid 1

#### set vlans eth1
bridge v add dev eth1 vid 100
bridge v add dev eth1 vid 200

#### set vlans cpu port
bridge v add dev br-lan self vid 100
bridge v add dev br-lan self vid 200
#### END

Make sure to do backup of your router before trying it.
I think it should work.

[fluffymadness]

@kmarzic

option ifname '@lan.100'

thanks for the reply
shouldn't there be @lan.200 on vlan200?
One thing i don't understand is...is the ip

'192.168.89.1'

the default ip the router would be accessible at, if the device
connected to the eth port doesn't have vlan tag support?
Otherwise if there is tagging it would be 10.254.100.1 or 10.254.200.1 depending on the tag?

[fluffymadness]

So in my case that would be

# cat /etc/config/network

...
config interface 'lan'
        option type 'bridge'
        option ifname 'eth1'
        option proto 'static'
        option ipaddr '192.168.178.1'
        option netmask '255.255.255.0'
        option ip6assign '64'

config interface 'vlan100'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ifname '@lan.100'
        option ip6assign '64'
        option ip6hint '1'

config interface 'vlan200'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        option ifname '@lan.200'
        option ip6assign '64'
        option ip6hint '1'
...

[fluffymadness]

These are my dhcp entries
under /etc/config/dhcp

...
config dhcp 'vlan100'
        option interface 'vlan100'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'vlan200'
        option interface 'vlan200'
        option start '100'
        option limit '150'
        option leasetime '12h'
...

This is what i configured on the cisco switch.
Nothing working so far. There's probably something I'm missing here

Vlan ID 1,100,200 all show excluded on ge2 and ge3

[kmarzic]

Hi, yes, it was typo, I corrected my post, @lan.200 is in vlan200 block.
Don't forget file 21-lan.
I think that some IP adrees should be in lan block.
That is the reason why 192.168.89.1 is there.

[fluffymadness]

I gave the 21-lan exec permission and then rebooted.
Sadly I'm not getting any ip address on ge2 or ge3 and can't ping the router under 192.168.1.1 or 2.1. If i connect my client to ge4 to ge8 I'm untagged as expected and can then access the router under 192.168.178.1

[mk24]

Technically the Nanopi R2S is not DSA, it is two independent Ethernet ports to the CPU, no switch.

On the Cisco switch, make VLAN 1 tagged in the trunk cable, or remove it so only 100T and 200T are present. All VLANs on a trunk to OpenWrt should be tagged. On the OpenWrt side, make sure that plain eth1 (without a VLAN tag) is not mentioned in any of the OpenWrt networks.

Also try it without the @ signs, just eth1.100.

[fluffymadness]

ok, the above script can't work...seems the bridge command is not available on my r2s.
Is there another command that has to be used instead of
e.g

bridge v add dev eth1 vid 100

or is the script needed at all?
Since everything seems to work properly....I guess this should be the only line that is needed then ????

# cat /etc/hotplug.d/iface/21-lan
#!/bin/sh
[ $INTERFACE = lan -a $ACTION = ifup ] || exit 0

#### enable VLAN filtering
ip link set dev br-lan type bridge vlan_filtering 1

[fluffymadness]

@mk24
Thanks.
Everything working now.
Just for reference. I'm not using the script above anymore and everything is working fine