Vlan traffic over WAN port (Guest vlan on dumb AP)

WRTuser · January 27, 2020, 5:46pm

Hey everyone,

First I would like to explain my situation.

I have connected my modem (static IP 192.168.1.254) to the WAN port of my openWRT router.
the modem does not have the DHCP enabled.

The lan interface (e.g. vlan 1) handles the DHCP server with static ip 192.168.1.253.
I have bridged the wan interface with the lan interface.
DHCP works fine and I get private addresses in the 192.168.1.0/24 range.
Can correctly access the internet.

Now I want to create another vlan, I called it vlan100.
This vlan100 bridges an wlan AP.
With its own dhcp server and it serves private addresses in the 192.168.100.0/24 correctly.

When I connect wirelessly to the SSID in the vlan100 I do get an ip in the 100 range.
I have forwarded the the vlan100 firewall to wan.
But I cannot ping anything on the internet e.g. 8.8.8.8

My question is why this won't work.

if I forward vlan100 -> lan and enable masquerading, everything works fine.

dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option leasetime '12h'
        option limit '50'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'vlan100'
        option start '100'
        option leasetime '12h'
        option interface 'vlan100'
        option limit '10'

firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'

config zone
        option network 'vlan100'
        option name 'vlan100'
        option output 'ACCEPT'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option target 'ACCEPT'
        option family 'ipv4'
        option dest_port '68'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'


config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config rule
        option dest_port '53'
        option src 'vlan100'
        option name 'Guest DNS'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option enabled '0'

config rule
        option dest_port '67-68'
        option src 'vlan100'
        option name 'Guest DHCP'
        option target 'ACCEPT'
        option proto 'udp'
        option enabled '0'

config forwarding
        option dest 'wan'
        option src 'vlan100'

network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd0:649b:b2d7::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option ip6assign '60'
        option gateway '192.168.1.254'
        list dns '192.168.1.254'
        option ifname 'eth0.1 eth0.2'
        list ipaddr '192.168.1.253/24'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'static'
        option ipaddr '192.168.1.252'

config device 'wan_eth0_2_dev'
        option name 'eth0.2'
        option macaddr 'xxxxxxxxxxxx'

config interface 'wan6'
        option proto 'dhcpv6'
        option ifname 'eth0.2'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '2t 1t 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '2 1 0t'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '100'
        option ports '2t 1t 0t'

config interface 'vlan100'
        option proto 'static'
        option ifname 'eth0.100'
        option type 'bridge'
        list dns '8.8.8.8'
        list ipaddr '192.168.100.1/24'
        option gateway '192.168.1.254'

trendy · January 28, 2020, 11:14am

Remove this from vlan100 interface.
list dns '8.8.8.8'
If you want the guests to use Google NS, then use the option 6 in dhcp
list dhcp_option '6,8.8.8.8,8.8.4.4'
Remove this as well from vlan100 interface.
option gateway '192.168.1.254'
Delete wan and wan6 interfaces, since you have bridged the eth0.2 to the lan.
Add a rule to allow forwarding from guest network only to 192.168.1.254, if you want to isolate the guest network.

WRTuser · January 28, 2020, 9:16pm

I started the setup from scratch and I am now able to reach the internet via WAN port.
Also connecting to the modem works fine now, what I had to do was to put the modem in a different subnet, in my case I put in in the 192.168.2.0/24 range.

dhcp


config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	option leasetime '12h'
	option limit '50'
	option start '100'

config dhcp 'wan'
	option interface 'wan'
	option start '100'
	option leasetime '12h'
	option limit '150'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'vlan10'
	option start '100'
	option leasetime '12h'
	option interface 'vlan10'
	option limit '50'

firewall


config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option output 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	option input 'ACCEPT'
	option forward 'ACCEPT'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option network 'vlan10'
	option name 'vlan10'
	option output 'ACCEPT'
	option input 'REJECT'
	option forward 'REJECT'

config forwarding
	option dest 'wan'
	option src 'vlan10'

config rule
	option src 'vlan10'
	option name 'Allow Guest DHCP'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '67-68'

config rule
	option dest_port '53'
	option src 'vlan10'
	option name 'Allow Guest DNS'
	option target 'ACCEPT'
	option proto 'tcp udp'

config forwarding
	option dest 'lan'
	option src 'wan'

network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	list dns '192.168.2.254'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'static'
	option netmask '255.255.255.0'
	option gateway '192.168.2.254'
	option ipaddr '192.168.2.253'
	list dns '192.168.2.254'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option vid '1'
	option ports '5 4 2 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 0t'
	option vid '2'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option vid '10'
	option ports '3 0t'

config interface 'vlan10'
	option proto 'static'
	option netmask '255.255.255.0'
	option ifname 'eth0.10'
	option ipaddr '192.168.10.1'
	option type 'bridge'
	list dns '192.168.2.254'

system · February 7, 2020, 9:25pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.