VLAN tagging for "one-armed router" - No IP address on WAN

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi folks.

I am setting up a very simple "one-armed router" (aka "router on a stick") configuration like this: modem-switch-router, trunking both LAN and WAN traffic between the router and switch. ISP is Cox with an Arris SB6190 modem, switch is a TP-Link TL-SG108E, and the router is a Netgear R7800. I'm currently running hnyman's OpenWrt 22.03-SNAPSHOT r19805, although I have also tried the offical final builds of version 19 and 21 during my troubleshooting.

Everything works fine with one exception: I cannot get an IP address from my ISP when the traffic is routed over the VLAN trunk. However, if I use OpenWRT on this router in the default out-of-the-box configuration, with the cable modem directly connected to the WAN port, then I get an IP address without any problem.

This is a very simple configuration:
TL-SG108E switch: Physical port 1 connected to cable modem, physical port 2 is trunk to R7800

  • VLAN 1: VID 10, "lan", port 2 tagged, ports 3-8 untagged
  • VLAN 2: VID 20, "wan", port 1 untagged, port 2 tagged
  • Port 1, PVID 20
  • Ports 2-8, PVID 10

R7800 router: Physical port LAN1 is trunk to TL-SG108E

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option device 'br-lan'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth0.20'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '10'
	option description 'lan'
	option ports '0 6t 4t 3 2 1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option description 'wan'
	option vid '20'
	option ports '0t 6 4t'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1.10'

Looking at the logs, I see the DHCP discover requests going out, and I can watch the in/out packet counts increasing on both the switch and the router on the trunked ports, but I just never get that IP address from Cox.

I'm happy to post screenshots and config files if needed, but I thought I'd first ask if I am missing something glaringly obvious here.

Thanks.

2

This device is your problem. The TL-SG1xxE series has a very poor implementation as a smart switch in that it will obtain the first DHCP lease that is offered to it, and it doesn't have any way to set the management VLAN. As a result, it will actually take the DHCP lease from your cable modem and prevent a lease from being provided to your router. Even if it isn't obtaining a DHCP lease, it could still plausibly present as the 'first device' that your modem sees and the MAC binding could be set to the switch instead of the router.

There is a short-term and a long term solution:

  • short term: set the IP address of that switch with a static IP address in your management/LAN subnet so that the switch does not attempt to obtain an address via DHCP.
  • long term: replace this switch with a better device. IIRC, Netgear's entry level smart switches have the same problem, so avoid any of the entry level devices. You'll need to spend a bit more, but you'll get a much better switch.

I highly recommend eliminating that switch from your network entirely, as it has other issues around security, but at least get it out from the connection to your wan. I own one of those switches and it is one of the purchases I sincerely regret (fortunately, it was only $30 or so).

3

Thanks psherman.

  • short term: set the IP address of that switch with a static IP address in your management/LAN subnet so that the switch does not attempt to obtain an address via DHCP.
  • long term: replace this switch with a better device. IIRC, Netgear's entry level smart switches have the same problem, so avoid any of the entry level devices. You'll need to spend a bit more, but you'll get a much better switch.

Unfortunately, the short term solution won't work for me, as I already set that switch to a static IP. As to the longer term solution, any reasonable cost recommendations? I'm still within my Amazon return window for the switch :slight_smile:

4

Look at the business line switches. For example, the TL-SG2008

5

Look into the OpenWrt supported realtek switches, even it you don't want to flash them with OpenWrt, that at least gives you options. The ZyXEL gs1900 series would be an easy pick - and their OEM firmware is among the better ones as well (and seeing regular updates). With a little luck you might find rather cheap 8-24 port specimens on the used markets.

1 Like