I want to create 2 separate networks accessing the same Internet connection. The devices on each network should not be able to access devices on the other network, but should be able to talk with other devices on the same network.
I think I understand VLANs are the solution, but I am unsure how to properly set it up.
Devices on 1 network will be exclusively wireless, the other one might see an occasional wired device for network management.
EAP245 seem to support assigning a VLAN ID based on SSID.
Is it possible to simply create 2 SSIDs and assign a VLAN ID to each on the AP? Do I need a managed switch between the APs and the router? How do I then configure OpenWrt?
I you are using an unmanaged switch all VLAN's are visible on any port of the switch.
This means that anyone, who has physical acces to the LAN cable on any AP is able to access all VLAN's.
If you are running OpenWrt on the APs too, you will be able to restrict Wifi and/or the secound LAN port of the AP to only one VLAN.
Other firmware may vary.
So in most cases its required to use a small managed switch. Of course this could be a another router with at least 3 LAN/WAN ports running OpenWrt.
I use some GS108TV3 and Archer C7V5 in a similar scenario with 5 VLAN's.
In my case it is acceptable to have every VLANs on every port of the switch, as the second network is only accessible via wireless with it's own SSID. It's basically about sharing an internet connection with a neighbour, and allowing them to have communication between their devices. They don't have access to any hardware.
Bear in mind I am not very familiar with VLANs and how packets are tagged and handled. How do you configure it in OpenWrt? Which VLAN ID should be used on the EAP245?
As long as your unmanaged switch passes tagged frames intact, that should work fine. Pretty sure everything made in the gigabit era does.
In Network -> Interfaces, Devices tab, select the "Add Device Configuration" button at the bottom. In the dialogue that comes up, Choose device type "VLAN (802.1q)", the base device is the NanoPI's LAN interface, and any number between 2 and 4096 as the VLAN ID. Accept the default interface name it offers you, save and apply. The result acts like just another interface, use it any way you like. Then tell one of your APs to use that VLAN ID. [not familiar with the stock firmware, hopefully it's obvious]. Everything to do with the other AP can just stay default.
This created a device. I have added a MAC address and the default MTU of 1500. I then created a static address interface with this device, with different IP range (192.168.1.1 vs 192.168.2.1) For the firewall rules, I have copied the default lan ==> wan rule. Internet access is still missing.
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Also, with unmanaged switches, some will not work properly when presented with tagged frames. They are not designed for use with VLANs and should be avoided in most cases since the behavior is undefined. Some unmanaged switches will pass those tags properly, but there are some that can cause major issues. So keep that in mind if things seem to be problematic.
You do not need to specify those options - by default, they will reference the router, so that shouldn’t be changing anything. What do the hosts on that network get via dhcp (ip address, router, subnet mask, dns)?
What happens if you run the following ping tests from a host on the friends network:
I think those options were added to the lan DHCP server by the AdGuard installation script here. Is it possible those modifications are the problem?
ip: 192.168.2.226
router: 192.168.2.1
subnet: 255.255.255.0
it would seem there is no DNS server. is that possible?
PING 192.168.2.1 (192.168.2.1): 56 data bytes
64 bytes from 192.168.2.1: icmp_seq=0 ttl=64 time=3.526 ms
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=3.252 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=64 time=2.724 ms
64 bytes from 192.168.2.1: icmp_seq=3 ttl=64 time=1.421 ms
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto: No route to host
ping: sendto: No route to host
Request timeout for icmp_seq 0
ping: sendto: No route to host
Request timeout for icmp_seq 1
ping: sendto: No route to host
Request timeout for icmp_seq 2
I don’t see anything wrong with your config, unless I’m missing something silly.
I would recommend either trying official openwrt (and not bothering with overclocking), or ask your question with the maintainers of the build you are using - it is very likely that the problem is related to a difference between pure openwrt and this customized version.
Even the official 21.02 build would not work with the previous config. I managed to get it to work with the following modification:
list dhcp_option '6,192.168.2.1'
list dhcp_option '3,192.168.2.1'
must be added to the VLAN DHCP options.
also, adguardhome.yaml must be modified to add 192.168.2.1 to the DNS address as follows:
dns:
bind_hosts:
- 192.168.1.1
- 192.168.2.1
Now internet access works from every device. However, devices within the FRIENDS zone cannot reach each other. here is the latest config, on vanilla OpenWrt with AdGuard.
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdc4:8e18:9740::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth1'
config device
option name 'eth1'
option macaddr 'redacted'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth0'
option macaddr 'redacted'
config interface 'wan'
option device 'eth0'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0'
option proto 'dhcpv6'
config device
option type '8021q'
option ifname 'eth1'
option vid '2'
option name 'eth1.2'
option macaddr 'redacted'
config interface 'FRIENDS'
option proto 'static'
option device 'eth1.2'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
Unmanaged switches should not be used with tagged networks because the behavior of VLANs through an unmanaged switch is undefined. Some work fine, others don't work at all, and some sort of work. Hard to say if this is impacting your setup.
Both devices are on wifi -- are they connected to the same AP (if you have multiple APs, this could be relevant).
do you have isolation enabled on your wifi configuration? post your /etc/config/wireless config file
cat: can't open '/etc/config/wireless': No such file or directory
There are 2 APs configured identically. During my tests, all relevant hosts were connected on the same AP. IP addresses of the APs are 192.168.1.2 and 192.168.1.3, netmask 255.255.255.0. While writing this, I'm wondering if this might be the problem. VLAN FRIENDS is assigning IPs in the 192.168.2.xx range. Does that mean that traffic from one host can't go to the router and back to another host through the AP? Would I need to change the net mask on some devices, or firewall rules?
