VLAN issues when upgrading to 24.10

Nainsurvolte · June 21, 2025, 1:45am

I have tried twice to install 24.10 and twice I have hit a brick wall for no apparent reason.

I run currently latest 23.05.5 with all the latest updates. All is good... I then flash to 24.10.1. The LAN is getting internet but all other VLAN I have configured do not seem to work. Anything linked and tied to those VLAN do not manage to get an IP, as if the DHCP service of each interface was not working. With the latest update failure, I simply re flash the router with the 23.05.5 and it all went back up without doing anything... I am baffled.

Setup is a WRT3200ACM flash to 23.05.5. Its connected to a switch controlled by Omada to run the rest of the network with access point.

psherman · June 21, 2025, 1:47am

Let's see your current config.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Nainsurvolte · June 21, 2025, 2:06am

I dont use the wireless on the router.

Network File

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd76:c969:7b80::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan.99'
        option proto 'static'
        option ipaddr '192.168.0.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device
        option name 'wan'
        option macaddr '32:23:03:e0:66:a0' 
        option ipv6 '0'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan3:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan4:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '40'
        list ports 'lan3:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '50'
        list ports 'lan2:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '60'
        list ports 'lan2:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '99'
        list ports 'lan1:u*'
        list ports 'lan2:u*'

config interface 'Tho'
        option proto 'static'
        option device 'br-lan.50'
        option ipaddr '10.133.20.55'
        option netmask '255.255.255.0'

config interface 'IoT'
        option proto 'static'
        option device 'br-lan.20'
        option ipaddr '10.173.20.22'
        option netmask '255.255.255.0'

config interface 'Video'
        option proto 'static'
        option device 'br-lan.30'
        option ipaddr '10.173.30.33'
        option netmask '255.255.255.0'

config interface 'VoIP'
        option proto 'static'
        option device 'br-lan.10'
        option ipaddr '10.173.10.11'
        option netmask '255.255.255.0'

config interface 'Guest'
        option proto 'static'
        option device 'br-lan.60'
        option ipaddr '172.16.173.40'
        option netmask '255.255.255.0'

config device
        option name 'br-lan.10'
        option type '8021q'
        option ifname 'br-lan'
        option vid '10'
        option ipv6 '0'

config device
        option name 'br-lan.20'
        option type '8021q'
        option ifname 'br-lan'
       option vid '20'
        option ipv6 '0'

config device
        option name 'br-lan.30'
        option type '8021q'
        option ifname 'br-lan'
        option vid '30'
        option ipv6 '0'

config device
        option name 'br-lan.50'
        option type '8021q'
        option ifname 'br-lan'
        option vid '50'
        option ipv6 '0'

config device
        option name 'br-lan.40'
        option type '8021q'
        option ifname 'br-lan'
        option vid '40'
        option ipv6 '0'

config interface 'Home'
        option proto 'static'
        option device 'br-lan.40'
        option ipaddr '10.173.40.44'
        option netmask '255.255.255.0'

config device
        option name 'br-lan.30'
        option type '8021q'
        option ifname 'br-lan'
        option vid '30'
        option ipv6 '0'

DHCP

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'opnmirabel'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '2'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'Tho'
        option interface 'Tho'
        option start '50'
        option limit '100'

config dhcp 'IoT'
        option interface 'IoT'
        option start '20'
        option limit '35'
        option leasetime '12h'

config dhcp 'Video'
        option interface 'Video'
        option start '30'
        option limit '40'
        option leasetime '12h'

config dhcp 'VoIP'
        option interface 'VoIP'
        option start '10'
        option limit '15'
        option leasetime '12h'

config dhcp 'Guest'
        option interface 'Guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'Home'
        option interface 'Home'
        option start '40'
        option limit '100'
        option leasetime '12h'

Firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'Home'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'Home'

config forwarding
        option src 'Home'
        option dest 'wan'

config zone
        option name 'Tho'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'Tho'

config zone
        option name 'IoT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'IoT'

config zone
        option name 'Video'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'Video'

config forwarding
        option src 'Tho'
        option dest 'wan'

config forwarding
        option src 'IoT'
        option dest 'wan'

config forwarding
        option src 'Video'
        option dest 'wan'

config zone
        option name 'VoIP'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'VoIP'

config forwarding
        option src 'VoIP'
        option dest 'wan'

config zone
        option name 'Guest'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'Guest'

config forwarding
        option src 'Guest'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'Home'

config forwarding
        option src 'lan'
        option dest 'IoT'

config forwarding
        option src 'Home'
        option dest 'Video'

psherman · June 21, 2025, 2:21am

I do see a few issues:

For example...

and this:

The router's address must be outside the DHCP pool. Here you have the router address on the .55 yet your pool is from .50-.149.

I see this also on the IoT, Video, VoIP, and Home networks. The only ones that don't have the problem are the guest and lan.

A common convention is to use either the top or bottom of the network address space for the router. In a /24, that would be the .1 or .254 address. This isn't a requirement, but often prevents exactly the problem you have here.

The only other things I see that could be a potential problem is the 802.1q stanzas. Remove these:

(remove all of them).

Aside from that, are the port-VLAN memberships as you want? It's worth reviewing, since, for example, you don't have any port(s) that trunk all of your VLANs.

Nainsurvolte · June 21, 2025, 5:41am

I changed all the static address of each interface to put them all out of the range. Its something I overlooked and never thought of... Ever since I set everything up, its been working with no issues. But, we never know...

For the 8021q, I think they got created as I was removing the IPV6 automatic setup. But I did unconfigure them all.

For how the VLAN membership is done, it set across 3 of 4 physical port. I leave the 4th one open in case I loose the network and need to connect the laptop directly in. The VLAN are grouped according the bandwidth they generally use. I dont know if its good, but dont see how its bad and its been working well since 22.03.

Going for the weekend, will see upon my return if these fix changed something. If it does, I would still dont quite understand why its working as it was on 23.05 and not 24.10. Will let you know.

psherman · June 21, 2025, 5:49am

It's fine if it accomplishes your goals. But I don't think that the bandwidth will be any different if it's on one physical port or two.

Nainsurvolte · June 26, 2025, 4:19pm

Router is hooked up to a 24 port switch which is doing all the internal work. The router is only routing and managing the WAN. I'd say for my usage, I am over the top. But I like to have things setup straight, have no bottle neck and additional controls.

I manage to, somehow, resolved the thing, although, I still don't quite understand what was wrong.

Came back, and despite all the changes above, it was still only working for LAN and Guest.
I deleted all VLANs, upgraded to 24.10, still not working
I then stumbled on a piece of setup in Omada that I had done: Legal DHCP Server. Obviously, after changing all interface static IP, that was no good anymore. I disabled that option, and everything came back. I reenabled it setting proper DHCP address to see if that was the culprit in the first place (incompatibility between OpenWRT and Omada) but no, it worked

In the end, it does not explain why after I upgraded with my initial setup it was not working, unless OpenWRT started not liking to have interface IP included in the range. After I changed the interface IP, it was most definitely blocked by Omada.

Thanks for the help.

system · July 6, 2025, 4:19pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.