VLAN Setup to Extend Home Network

finch · 2019-10-15T20:06:43.582Z

Why are you using WAN port again? Sorry, I might be missing something, but config with tagged LAN3 seems viable to me (or at least give it a try).

willowen100 · 2019-10-15T20:07:57.140Z

@finch This is the network setup I'm trying to setup.

VLAN Setup to Extend Home Network Network and Wireless Configuration

Okay Cisco packet tracer was too complex and fiddly. Instead I've used Visio from Microsoft. Here's the result. [Network%20Layout] AP/Router1 is the main router and connects to the ONT/fibre modem downstairs. In my previous setup there was a cable between the ONT/fibre modem and AP/router2, hence I want to use VLAN trunking to connect AP/router1 and AP/router2 in-directly using the WAN cable to the trunk (shown at the top of the picture) to bridge them together. The trunk connected upstairs …

finch · 2019-10-15T20:12:30.565Z

Yes, I've seen that picture. But my point is that there is chance that you simply cannot add WAN port to be part of same VLAN together with all other ports due hw limitation.

EDIT: I'm talking from my personal experience with TP-Link TL-WR841N (crappy router I know), where WAN port is not part of a switch so my attempts to use it as trunk port failed, but using any other port was OK and is working perfectly fine. Like I said, maybe it's not your case, but I would give it a try.

psherman · 2019-10-15T20:14:03.743Z

finch:

Learn basics and terminology (for example trunking and tagging is just different name for same thing). Highly recommend book Packet Guide to Routing and Switching by Oreilly

Just a nit here, but trunking and tagging are very much different concepts, although tagging is required for trunking.

Tagging
Tagging a network literally adds a tag (the VLAN ID) to the ethernet frames indicating which VLAN the frame belongs to. Equipment must be configured to listen for tagged VLANs and will only listen to the specific VLAN IDs that are specified. All non-specified VLAN IDs (tagged) and possibly the untagged network will be ignored. This compares to an untagged network that doesn't have a VLAN tag attached -- most consumer equipment only works with untagged ethernet (at least by default) and will simply ignore any tagged frames (unless configured otherwise).

Similarly, switching (and routing) equipment that is VLAN aware will utilize the tagged ethernet frames to ensure that packets are switched properly. Even ports that have an untagged network configured will assign a VLAN ID internally on the VLAN aware switch fabric (untagged data entering a port has a tag added so it can traverse the switch fabric, and it is removed as the data is exiting the port).

If I haven't explained this well, let me know and I'll see if I can clarify it or make up some analogies.

Trunking
Trunking is the act of sending multiple networks over the same wire. If your wire carries only one network, even if the network is tagged, it is not a trunk.

Generally speaking, you may have 0 or 1 untagged network, plus 0, 1, or many tagged networks that are carried over the same physical link.

So for example:

1 untagged + 0 tagged = 1 network ==> this is not a trunk.
0 untagged + 1 tagged = 1 network ==> this is not a trunk.
1 untagged + 1 tagged = 2 networks ==> this constitutes a trunk.
0 untagged + 2 tagged = 2 networks ==> this is also a trunk

finch · 2019-10-15T20:16:09.340Z

Yeah, sorry I was not 100% exact. I was referring to Oreilly's book

“When a port is used to interconnect switches and convey VLAN information, the operation of the port is changed to a trunk. For example, on a Cisco switch the mode command would be used to make this change. Other vendors indicate that the port is now “tagged,” indicating that a VLAN id will now be inserted into the frames.”

Excerpt From: Bruce Hartpence. “Packet Guide to Routing and Switching.” Apple Books.

willowen100 · 2019-10-15T20:22:39.559Z

So I have the understanding of the trunk. I want to send multiple connections down one physical wire.

Hear me out.

Instead of trunking the two LAN's and WAN down the physical WAN port in OpenWrt, would I be better off doing the trunking on the switch? What I mean by this is have three physical leads from the OpenWrt router to the switch and then do the trunking on the switch itself rather that doing it with OpenWrt?

That way the one LAN port from the router provides the Private LAN to the switch so all the clients connected to the 24-port switch will benefit from the fast switch fabric. Another cable from LAN port 2 will provide the Guest LAN and finally the WAN port will be connected too.

EDIT
Diagram to explain

Network Layout v2.png7883×3750 399 KB

EDIT 2
I have successfully setup the WAN and two LAN's to connect to the OpenWrt router simply segmenting the switch into three.

Ports 13, 15, 17, 19, 21 & 23 are VLAN 5 (Private LAN) | Port 3 UPLINK from OpenWrt
Ports 14, 16, 18, 20, 22 & 24 are VLAN 10 (GuestLAN) | Port 4 UPLINK from OpenWrt
Port 1 is VLAN 20 (WAN) | Port 2 UPLINK from OpenWrt

All of the above are untagged.

Correct me if I'm wrong. If I wanted to trunk VLAN 5 and VLAN 10 to my WAN I assume I would assign a tag to port 2 shown in the screenshot below?

Netgear Trunking.png1080×420 59 KB

jeff · 2019-10-15T20:27:34.257Z

I trunk everything on the same wire. There is no significant benefit with the hardware in most SoCs to having multiple wires, unless you're pushing over a gigabit/sec over multiple VLANs to multiple devices. Even then, you'd be better off connecting those devices directly to the "real" switch than dealing with the bottleneck of the SoC's switch.

finch · 2019-10-15T20:49:09.378Z

What I mean by this is have three physical leads from the OpenWrt router to the switch and then do the trunking on the switch itself rather that doing it with OpenWrt?

yes, that is option too.

Anyway, last thing on my mind is. In case of wireless network, make sure you have bridged wlan interfaces with your vlans. I remember, that for example in my setup I had to setup bridge even for just single wireless interface to make vlans (guest wifi) functional.

willowen100 · 2019-10-15T20:57:19.254Z

Yes I have bridged the WLAN's.

bridged WLAN's.png982×454 19.5 KB

finch · 2019-10-15T21:16:45.713Z

Aha finally I think I understand your requirements. I was bit confused what is purpose of WAN in your network.
From my understanding your vlans are:

5 - private
10 - guest

And both those vlans are using internet connection through shared WAN port (which is separate vlan itself).

So basically you need to create three interfaces (one for every vlan). Let's say

LAN: (bridge over ethX.5 and wlanX)
GUEST_LAN: (bridge over ethX.10 + wlanY)
WAN: (bridge over ethX.20) maybe single ethX.20 is OK too

and then setup zone forwarding from LAN and GUEST_LAN to WAN (masquerade)

Regarding switch config:

I would remove tagging from WAN port for VLAN ID 5 and 10 (it's not necessary since you'll actually route traffic). For VLAN ID 20 I would change tagging from CPU(eth0) to CPU (eth1) as in openwrt page example.

willowen100 · 2019-10-15T21:24:52.296Z

I'm glad you're understanding me

finch · 2019-10-15T21:26:29.160Z

yep sorry sometimes I'm slow thinker.

willowen100 · 2019-10-15T21:28:41.021Z

Doing the trunking and routing on the switch seems to be my favour at the moment.

I have 3 RJ45 cables going from my OpenWrt router to three ports on the switch. I have created three VLAN's so that my switch is segmented. I'm currently connected to my guest network, so if this post uploads I know I've got internet access haha.

See my EDIT 2

VLAN Setup to Extend Home Network Network and Wireless Configuration

So I have the understanding of the trunk. I want to send multiple connections down one physical wire. Hear me out. Instead of trunking the two LAN's and WAN down the physical WAN port in OpenWrt, would I be better off doing the trunking on the switch? What I mean by this is have three physical leads from the OpenWrt router to the switch and then do the trunking on the switch itself rather that doing it with OpenWrt? That way the one LAN port from the router provides the Private LAN to the swi…

finch · 2019-10-15T21:31:29.722Z

Ok, I see. As others suggest it will be probably faster. Anyway If you change your mind, I'm pretty sure you can make it (also with just single eth cable) on openwrt router as I suggested.

willowen100 · 2019-10-15T21:36:32.095Z

Well I know that the untagged ports I set for VLAN 5 on my switch I can connect to my wired devices so that they have a switch fabric between them, meaning there is no need for Link Aggregation to the router's 4 LAN ports.

In regards to adding the two LAN's to the WAN port for trunking, would you say I'm doing it correctly by tagging the physical WAN port on the switch from the VLAN's? It is shown in the last screenshot.

My next task of course is doing these VLAN's in reverse on my smaller 5-port switch and bringing it back into the second AP/router.

finch · 2019-10-15T21:53:34.639Z

Well I know that the untagged ports I set for VLAN 5 on my switch I can connect to my wired devices so that they have a switch fabric between them, meaning there is no need for Link Aggregation to the router's 4 LAN ports.

my question would be, how do you plan to access internet from those wired devices without having router in the way? Is your modem capable of doing some routing/dhcp,nat etc...?

willowen100 · 2019-10-15T22:02:09.005Z

The 24 port switch will have several wired devices plugged into it on a VLAN that will match the OpenWrt one. There will be one dedicated port that will connect the switch VLAN to one of the LAN ports on the OpenWrt router.

mk24 · 2019-10-15T22:09:07.141Z

Don't set tagged and untagged on the same port. There are two kinds of connections you can set up. A trunk cable has all packets tagged with their different VLANs. A user cable has one VLAN untagged and the rest off. This is used to provide one network to a device such as a PC that is not aware of VLANs.

The CPU ports should also be set up as trunks in the switch -- vlans either tagged or off as needed. Since there are two CPU ports it is common to dedicate one to the WAN link and the other one for LAN like functions, either the actual lan or the guest networks. Then attach them to the kernel networks (wan, lan, etc) using the ethX.Y notation.

Though it will appear in the list, when you are using VLANs on an eth port do not connect plain ethX (without a dot and VLAN) to anything.

finch · 2019-10-15T22:11:09.397Z

Ah, ok. It would bit easier if exterior cable was plugged directly to AP/Router1 (not to 24p switch as on picture).

mk24 · 2019-10-15T22:14:53.233Z

You can continue the trunk through a managed switch to a device such as an OpenWrt router that is VLAN capable. Set that port tagged on all the VLANs that you want to forward. The main router needs the cable modem, the LAN PC's and APs, and the guest APs. Meanwhile AP2 only needs the LAN and guest on its trunk, you can leave out the modem.

If your ISP speed is more than 500 Mb you would want to plug the main router directly into the cable modem so that having to share a trunked port is not a bottleneck. At lower speed it won't matter.