vLAN SSID and pfSense

n1md4 · June 4, 2023, 10:57pm

Hi,

I would like to run a vLAN SSID for a 'work' network, the SSID is advertised, but I can not connect to the AP. I'll outline the basic configuration below. Please let me know if the OpenWRT configuration looks sane.

Thanks in advance!

Router running pfSense with a vLAN configured:

igc2 (opt1) 40 Work

The interface has a static IP, is enabled, running DHCP, and has firewall rules to allow connectivity.

Separate AP running OpenWRT, with the following relevant configuration:

config interface 'work'
        option type 'bridge'
        option ifname 'lan.40'
        option proto 'none'

config device
        option type 'bridge'
        option name 'br-work'
        list ports 'lan.40'

config wifi-iface 'work_radio1'
        option device 'radio1'
        option network 'lan.40'
        option mode 'ap'
        option ssid 'work'
        option encryption 'psk2'
        option key 'password'

52: br-work: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether b8:ec:a3:e1:06:8e brd ff:ff:ff:ff:ff:ff
    inet6 fe80::baec:a3ff:fee1:68e/64 scope link 
       valid_lft forever preferred_lft forever
53: lan.40@lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-work state UP qlen 1000
    link/ether b8:ec:a3:e1:06:8e brd ff:ff:ff:ff:ff:ff
...
55: wlan1-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether ba:ec:a3:e1:06:90 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::b8ec:a3ff:fee1:690/64 scope link 
       valid_lft forever preferred_lft forever

psherman · June 4, 2023, 11:15pm

Let’s see the complete config, including the version info.

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board 
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

n1md4 · June 5, 2023, 7:55am

As requested, and with takimata suggestions implimented:

ubus

root@nwa50ax-01:~# ubus call system board 
{
        "kernel": "5.10.127",
        "hostname": "nwa50ax-01",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "ZyXEL NWA50AX",
        "board_name": "zyxel,nwa50ax",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r20094+29-9dc86d1962",
                "target": "ramips/mt7621",
                "description": "OpenWrt SNAPSHOT r20094+29-9dc86d1962"
        }
}

Network

root@nwa50ax-01:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fda3:bb7c:5935::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.10'
        option gateway '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'work'
        option device 'br-work'
        option proto 'none'

config device
        option type 'bridge'
        option name 'br-work'
        list ports 'lan.40'

Wireless

root@nwa50ax-01:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HT20'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'ssid0'
        option encryption 'psk2'
        option key 'password'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'ssid1'
        option encryption 'psk2'
        option key 'password'

config wifi-iface 'work_radio1'
        option device 'radio1'
        option network 'br-work'
        option mode 'ap'
        option ssid 'ssid1-1'
        option encryption 'psk2'
        option key 'password'

DHCP

root@nwa50ax-01:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option ignore '1'
        option dhcpv6 'disabled'
        option ra 'disabled'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

Firewall

root@nwa50ax-01:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1
        option flow_offloading '1'

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

n1md4 · June 5, 2023, 7:57am

Applied the changes as suggested, unfortunately I still am unable to connect. At this point it could be a pfSense issue. I hope now though the OpenWRT configuration is in order.

n1md4 · June 5, 2023, 8:23am

The AP appears in the client WiFi list, but selecting it and entering a password does not provide a connection / IP address. The DHCP service is configured on pfSense.

n1md4 · June 5, 2023, 12:31pm

Got it working. Here was the final configuration:

config interface 'work'
        option device 'br-work'
        option ifname 'lan.40'
        option proto 'none'

and

config wifi-iface 'work_radio1'
        option device 'radio1'
        option network 'work'
        option mode 'ap'
        option ssid 'ssid1-1'
        option encryption 'psk2'
        option key 'password'

n1md4 · June 5, 2023, 2:31pm

Not capable to or not configured to?

psherman · June 5, 2023, 2:55pm

Doesn't need it. DSA is "Distributed Switch Architecture" and is not necessary for the vast majority of devices with only a single ethernet port, since there is almost always no hardware switch inside (there are some examples of devices that actually have a built-in switch but only one ethernet port, but those are relatively rare).

n1md4 · June 5, 2023, 3:09pm

Marked unresolved. It was working, but now is not. Too much tinkering broke it!

psherman · June 5, 2023, 3:10pm

Change the network here to just work

n1md4:

config wifi-iface 'work_radio1'
        option device 'radio1'
        option network 'br-work'
        option mode 'ap'
        option ssid 'ssid1-1'
        option encryption 'psk2'
        option key 'password'

n1md4 · June 6, 2023, 9:10am

I've install luci and had it write the configuration files; I was getting lost.

This feels close. Does this look right?

Here is the new configuration for network and wireless:

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '10'
        option name 'eth0.10'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '20'
        option name 'eth0.20'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '30'
        option name 'eth0.30'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '40'
        option name 'eth0.40'

config interface 'lan10'
        option device 'eth0.10'
        option proto 'none'
        option type 'bridge'

config interface 'lan20'
        option device 'eth0.20'
        option proto 'none'
        option type 'bridge'

config interface 'lan30'
        option device 'eth0.30'
        option proto 'none'
        option type 'bridge'

config interface 'lan40'
        option device 'eth0.40'
        option proto 'none'
        option type 'bridge'

and

config wifi-iface 'ssid10_radio0'    
        option device 'radio0'  
        option mode 'ap'             
        option ssid 'ssid10'
        option encryption 'psk2' 
        option key 'password'
        option network 'lan10'       
                                 
config wifi-iface 'ssid20_radio0'
        option device 'radio0'          
        option mode 'ap'         
        option ssid 'ssid20'
        option encryption 'psk2'        
        option key 'password'
        option network 'lan20'
...

config wifi-iface 'ssid30_radio1'
        option device 'radio1'        
        option mode 'ap'             
        option ssid 'ssid30'
        option encryption 'psk2'      
        option key 'password'
        option network 'lan30'       
                                      
config wifi-iface 'ssid40_radio1'       
        option device 'radio1'       
        option mode 'ap'             
        option ssid 'ssid40'
        option encryption 'psk2'           
        option key 'password'
        option network 'lan40'

psherman · June 6, 2023, 2:31pm

Nope.

Remove all of the 802.1q device statements.

Create bridges for each vlan like this:

config device
        option name 'br-vlan10'
        option type 'bridge'
        list ports 'lan.10'

And then use the bridge device in the network interface config (do not include the bridge type within this stanza:

config interface 'lan10'
        option device 'br-vlan10'
        option proto 'none'

Repeat for all of the VLANs.

mk24 · June 6, 2023, 6:46pm

This device is a MT7621 SoC with only one of the 5 switch ports pinned out to a physical connector. But there is no way to bypass the switch inside the MT7621, so there is still very much DSA under the hood.

It would be most likely to work to use a full DSA paradigm with bridge-vlans instead of separate bridges. Applying the dot notation directly to a DSA port seems to work only when a single VLAN is required on that port, e.g. to tag packets on WAN for a DSL modem.

psherman · June 6, 2023, 8:49pm

So, if this is the case, I provided incorrect guidance above...
The following would thus be invalid:

and it should, instead, look like this:

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan:t'

Then repeat this for all of the VLANs.

n1md4 · June 6, 2023, 9:27pm

Thanks for the update. And what of the interface stanzas?

psherman · June 6, 2023, 9:29pm

It will look like this:

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan:t'

config interface 'lan10'
    option device 'br-lan.10'
    option proto 'none'

mk24 · June 6, 2023, 9:31pm

With all that set up, finally you'd use option network lan10 in the AP wifi-iface configuration (in /etc/config/wireless) to attach an AP SSID to the VLAN. This will be a dumb AP where all wireless users are assigned IPs and routed by the pfSense router.

n1md4 · June 6, 2023, 10:06pm

Everything is in place as yous have advised, but when I reload network service I lose connectivity to the AP. Connecting a serial cable I can see the service is still running, but the AP is no longer able to ping the router. Furthermore, connection attempts on the new SSIDs all fail.

I'll post the entire content of both network and wireless again. If nothing else it can be confirmed as correct.

root@nwa50ax-01:~# cat /etc/config/network.dsa 
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'fda3:bb7c:5935::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.10'
        option gateway '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan:t'

config interface 'lan10'
        option device 'br-lan.10'
        option proto 'none'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan:t'

config interface 'lan20'
        option device 'br-lan.20'
        option proto 'none'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan:t'

config interface 'lan30'
        option device 'br-lan.30
        option proto 'none'

config bridge-vlan
        option device 'br-lan'
        option vlan '40'
        list ports 'lan:t'

config interface 'lan40'
        option device 'br-lan.40'
        option proto 'none'

and wireless:

root@nwa50ax-01:~# cat /etc/config/wireless 

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'ssid1'
        option encryption 'psk2'
        option key 'password'

config wifi-iface 'iot_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ssid10'
        option encryption 'psk2'
        option key 'password'
        option network 'lan10'

config wifi-iface 'entertainment_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ssid20'
        option encryption 'psk2'
        option key 'password'
        option network 'lan20'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
        option channel '36'
        option band '5g'
        option htmode 'HE80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'ssid2'
        option encryption 'psk2'
        option key 'password'

config wifi-iface 'workstation_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'ssid30'
        option encryption 'psk2'
        option key 'password'
        option network 'lan30'

config wifi-iface 'work_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'ssid40'
        option encryption 'psk2'
        option key 'password'
        option network 'lan40'

psherman · June 6, 2023, 10:08pm

Try editing your lan as follows;

Add this:

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan:u*'

then set the lan to use br-lan.1 as shown below:

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.1.10'
        option gateway '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

n1md4 · June 6, 2023, 10:18pm

Same thing happens; can't connect to the new SSIDs, it attempts to but hangs "Setting network address" (KDE Plasma). Just double checking the '*' was intentional?

Otherwise all configs looks good?

I'm getting to the point where it might be time to start posting on the pfSense forums.

... hmm what should be in the firewall file?