VLAN communication issue

Installing and Using OpenWrt
5

Ok... so the config mostly looks good -- and it's easy to get the forwarding that you want.

If you want to be able to reach comp3 from lan, you'll add a forwarding rule like this:

config forwarding
	option dest 'Comp3firewall'
	option src 'lan'`

You can of course create rules similar to those but with more granularity. For example, you can limit by source or destination IPs, you can use destination ports, etc... the options are endless. You can also achieve the reverse where you have something wide open except for specific hosts and/or ports. But fundamentally, the forwarding from one network to another is only permitted if you specifically allow it.

The intra-zone forward rule (in the zone definition) affects the default forwarding between two or more networks that are contained within the same zone. Obviously ACCEPT will allow forwarding, DROP / REJECT will not. The same options for granularity exist here, too.

All other inter-zone forwards are allowed by means of forwarding rules and/or traffic rules.

A few minor things to note. These are all nit-picks, so not a big deal and they won't break anything

  1. You may have noticed that 25.12 uses a new method to define the IP address and subnet -- CIDR notation. That is, the IP address 192.168.10.1/24 defines both the IP and the subnet size/mask, instead of using two lines (one for ipaddr and the other for ntemask). 25.12 does still support the 2 line method, so it's not a problem, but you might consider using that same notation for the other networks.

  2. I recommend explicitly indicating that each port is untagged+PVID. That is done by adding :u* to the end of each port -- for example: list ports 'lan1:u*'would be the method for below:

  1. On the wireless, you have isolation enabled on each SSID. That is fine, but may not be ideal if you find that you need to be able to have devices talk to each other (for example, using AirPlay or ChromeCast doesn't work if isolation is enabled).

  2. This rule is unnecessary for the lan (since it has input set to ACCEPT) and you can delete it:

  1. For the other networks, you only need 53 (DNS) and 67 (DHCP). You can remove 68.

Now