Situation: I'm building a roaming WiFi setup using several LAN connected access points running OpenWrt. From what I've read, they should be configured as dumb APs and bridge to the LAN, not doing any routing of their own. I also configured multiple SSIDs for the APs.
Question: How do assign clients to particular VLAN based on which SSID they use if it's a bridged connection?
My understanding is that the DHCP server determines which VLAN to put it on. However, a bridged connection means the SSID information is missing (right?), so the DHCP server cannot determine which VLAN to assign it to. I don't fully understand VLANs, so if I have a misconception about it's function, please tell me.
This is done by means of bridges that include the VLAN (over Ethernet) and the WiFi radio, and then an unmanaged networks interface that uses the bridge device. In swconfig devices, this is achieved with a separate bridge per VLAN, while DSA will do this with bridge-VLANs.
It isn't the DHCP server... it is the network interface to which the VLAN is connected. There is one DHCP server for each network interface, so it just assigns accordingly.
The SSID information is not required at all... it is the VLAN that is bridged to that SSID that matters.
You do seem to have some confusion. You can think of VLANs as separate lanes on a highway... the overall road surface would be the trunk cable (between the router and the AP, for example) that carries multiple 'lanes' that are tagged with their VLAN IDs. (This is a simplistic metaphor only... the lanes have nothing to do with the actual physical conductors in the cable.)
This is done by means of bridges that include the VLAN (over Ethernet) and the WiFi radio, and then an unmanaged networks interface that uses the bridge device.
It is not clear to me how I would implement this.
It isn't the DHCP server... it is the network interface to which the VLAN is connected.
Does this imply that the AP can tag packets to be on any VLAN it chooses?
Hi. I'm having a smilar problem. I've tried following your advice but so far only managed to lock myself out.
I've managed to installed OpenWRT 23 on on a Unfi AP AC PRO, set the management interface to DHCP, disable DHCP and DNS - log back in and then lock myself out creating VLANs and bridges. A walk through would be much appreciated. I'm happy to write it up and add it to the Wiki.
After adding your VLANS on the br-lan bridge device, go back to the "Interfaces" tab and modify you network interfaces and update the "Device" value to the appropriate software VLAN.
For myself, that means that after I add VLANS 11 (for the lan), 13 (for the iot network), and 15 (for the guest network), I would then update the "Device" for the lan interface to "br-lan.11", the iot interface to "br-lan.13", and the guest interface to "br-lan.15". All of this before I click the "Save & Apply" button.
The /etc/config/network would look something to the effect of:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
option stp '1'
list ports 'eth1'
list ports 'lan1'
config interface 'lan'
option device 'br-lan.11'
option proto 'dhcp'
config bridge-vlan
option device 'br-lan'
option vlan '11'
list ports 'eth1:u*'
list ports 'lan1'
config bridge-vlan
option device 'br-lan'
option vlan '13'
list ports 'eth1:t'
config bridge-vlan
option device 'br-lan'
option vlan '15'
list ports 'eth1:t'
config interface 'iot'
option proto 'none'
option device 'br-lan.13'
option defaultroute '0'
config interface 'guest'
option proto 'none'
option device 'br-lan.15'
option defaultroute '0'
After adding your VLANS on the br-lan bridge device, go back to the "Interfaces" tab and modify you network interfaces and update the "Device" value to the appropriate software VLAN.
I went to Network - Switches and created my VLANS.
I have three columns CPU(eth0), Lan1 and and Lan2. I'm not using Lan2. What do I need to select for each VLAN when it comes to CPU(eth0) and Lan1 for my VLANS please from tagged/untagged/off?
I then go to Network - Interfaces and click on the Unconfigure next to br-lan and then click Configure. On the screent that appears I click on Bridge Ports and and add the VLANS I created.
Is this correct? And how do I then create the SSIDs and associate each one with a different VLAN?
@jezcaudle - do you mind if I move your posts to a new thread?
In the meantime, let's also take a look at your current complete configuration. And please confirm that you have a main router upstream of this device that is handling all the VLAN routing, and that this device is purely a bridge AP.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
First thing, I would suggest you create a backup of your device configuration so you always have that available in case things go unexpectedly bad.
Second, since this is for a dumb AP, make sure you have the firewall service disabled.
Third, can you please post the default/etc/config/network for your device? If you can do that, I think I can stub out the changes you need. This is all assuming your comfortable connecting to your device via SSH.
If you can't easily get the default network config (i.e. you don't want to have to factory reset your hardware), you can regenerate it. In case you're not familiar, this block of syntax will take care of regenerating it:
That should leave your current /etc/config/network file intact and create a new /root/network.default file that has all the default values. Post the contents of the /root/network.default here.
Just to confirm: I'm trying to set up a 'dumb' AP. My network router is an OpenBSD box with various VLANS.
The AP is getting it's IP address via DHCP - they are handed out based on MAC address. This is working nicely as well as internal DNS for the AP - I can connect via ip address or host name.
running
tail -f /var/log/daemon | grep "dhcp"
I can see DHCP leases being offered - my iPhone is not being offered one, on the 'development' network or the even the management VLAN - which is 1 btw.
My mangled attempt yesterday did see my iPhone making DHCP requests.
Thank you for your patience.
root@OpenWrt:~# ubus call system board
{
"kernel": "5.15.167",
"hostname": "OpenWrt",
"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
"model": "Ubiquiti UniFi AC Pro",
"board_name": "ubnt,unifiac-pro",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.5",
"revision": "r24106-10cc5fcd00",
"target": "ath79/generic",
"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd1c:24a7:488e::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
option vlan_filtering '1'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3'
option vid '1'
option description 'eth0.1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 2t'
option vid '2'
option description 'Development'
config device
option type 'bridge'
option name 'br-development'
list ports 'eth0.2'
option ipv6 '0'
config interface 'devleopment'
option proto 'none'
option device 'br-development'
root@OpenWrt:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'pci0000:00/0000:00:00.0'
option channel '36'
option band '5g'
option htmode 'VHT80'
option disabled '1'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/ahb/18100000.wmac'
option channel '1'
option band '2g'
option htmode 'HT20'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'devleopment'
option mode 'ap'
option ssid 'OpenWrt'
option encryption 'none'
# dhcp is disabled
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
# firewall is also disabled
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood 1
option input REJECT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name wan
list network 'wan'
list network 'wan6'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-IPSec-ESP
option src wan
option dest lan
option proto esp
option target ACCEPT
config rule
option name Allow-ISAKMP
option src wan
option dest lan
option dest_port 500
option proto udp
option target ACCEPT
# loads of comments
It looks like your hardware is using the old, deprecated swconfig instead of DSA (Distributed Switch Architecture). I've forgotten most everything I had ever learned about the old architecture ever since DSA was an option, so I may be a little clumsy trying to put this together.
But three things before I go there:
Frist, SSH into your device and execute this block and post the output back here:
if grep -sq DEVTYPE=dsa /sys/class/net/*/uevent; then
echo "You have DSA"
fi
If your hardware does support DSA, it would be much easier for me to help you (not to mention DSA is preferrable to swconfig).
Second, can you look at my previous post and post the default /etc/config/network configuration for your device here?
Third, in total, how many physical ethernet ports does your hardware have (wan and lan)?
I will try to make some progress stubbing out what I can, but the default configuration would be a big help to me
I have it working uisng a cable directly in to my OpenBSD server. Using my iPhone to test the thing was a bad idea. The wifi drivers and software are not designed for this - it remembers long deleted Wifi SSID's and passwords. I enedup using my Kali laptop to configure via the web interface and my OpenBSD laptop to connect.
Here is my config:
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd77:719a:3aec::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3'
option vid '1'
option description 'Management'
config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '0t 2t'
option description 'Development'
config switch_vlan
option device 'switch0'
option vlan '3'
option ports '0t 2t'
option vid '3'
option description 'Production'
config device
option type '8021q'
option ifname 'eth0'
option vid '2'
option name 'eth0.2'
option ipv6 '0'
config device
option type 'bridge'
option name 'dev-lan'
option ipv6 '0'
list ports 'eth0'
list ports 'eth0.2'
config interface 'dev'
option proto 'none'
option device 'dev-lan'
config device
option name 'br-prod'
option type 'bridge'
list ports 'eth0'
list ports 'eth0.3'
config interface 'production'
option proto 'none'
option device 'br-prod'
My naming scheme went a bit wobbly, but it works. I'll write up the instructions on how to do this using Luci.
