VLAN with DHCP in the same Subnet

Hi,

I did configurate the following:

2x VLAN (20 and 22)

VLan20 : DHCP 40 adresses at 192.25.25.100 Static 192.25.25.20 Subnetz 255.255.255.0
VLan22 : DHCP 40 adresses at 192.25.25.200 Static 192.25.25.22 Subnetz 255.255.255.0
I Know normaly You use different Subnet for different VLan but I don't see the advantages...

In DHCP I added a static IP for my NAS 192.25.25.15

The NAS is in VLan20 defined by the PORT ( IP 192.25.25.15)
My Laptop is in VLan22 defined by the PORT( IP 192.25.25.239)
As the NAS was non-Static Everything was fine, but now with static IP I cannot reach it.

Can you help me(?) where is the mistake???

Please post

cat /etc/config/network

and explain where tagging occurs at the network level....

you're seeing the disadvantages :slight_smile:

3 Likes

Your issue is that both VLANs are numbered identically. Since you've done so, the router doesn't know to forward traffic between VLANs when the destination IP is seen.

Renumber one of your LANs.

2 Likes

Do you want VLANs or not? Or do you want them except that you don't? Because that's what you practically did.

You answered it yourself.

1 Like

It might be easier to help you with networking if you share the general desired outcome...
Network Diagram will help a lot to understand what are you trying to achieve :slight_smile:

4 Likes

I just want 2 Zones 1 with internet and one Without. But the two Zones should see each-other. I Think the only Way is to use different IP-Ranges. I don't exactly Know why the Router don't route between the vlan, but i THinks its because it think same subnet nothing to route...

Assuming you leave LAN as default:

  • Make a new interface and VLAN (usually eth0.3 would be the next available on most devices)
  • Make a new firewall zone for the second network
  • Browse to Network > Firewall on the web GUI
  • On that Page, edit the new zone, and permit forwarding to and from the first zone
  • By default, you have not permitted this zone to go to WAN, so you're OK
  • Done!

:man_facepalming:

I told you that above. You also told yourself.

3 Likes

If you don't need to control the connectivity between the two, then you don't need VLANs.

Of course, not segregating the two onto VLANs or physical LAN segments makes access to the Internet or not more of a "suggestion" as any host can pick its own IP address (and, for that matter MAC address) and do whatever it wants.

The router will route between two attached network segments with non-overlapping address ranges by default. This is what routers do. However, the firewall rules, by default, will generally deny such routing. You would need to explicitly allow cross-network routing if you want to permit it.

1 Like

The keywords are see each other.
If (1) you need L2 Ethernet, Switching between two zones (this includes IP connectivity, IPX/SPX and many other network protocols riding the Ethernet layer), than you should set the internet-enabled IP bindings in the firewall and it will disable internet access for everything else.
Not sure how to do it in LuCI.
Edit: I believe you can create a captive portal for internet access but it makes simple things complicated.

If (2) you need L3 IP, Routing between two zones (IP connectivity and anything over IP), than your best bet is following lleachii's post and create a separate IP segment for your non-internet environment.

Edit2: If you insist on doing things your way and keep addressing intact - you can divide it so it will not be:

by setting different than /24 subnet masks, with respective gateways for both address spaces, define routing between the two, define additional dhcp server for another segment and point DNS to nowhere or where it is not allowed to go but it is still making simple things complicated and can be overridden with manual settings on the clients as Jeff mentioned earlier.

It's not just that your OpenWRT isn't routing between the VLANs. The bigger problem is that the subnet mask means that nodes on the network think they can reach other nodes on the network directly, which isn't true when you've put them on different VLANs like this.

I mean, when 192.25.25.15 wants to contact 192.25.25.239, the subnet mask says it can contact it directly. It doesn't try to send via the router.

There is nothing you can do that will make that work. You must have different IP subnets if you have different layer 2 subnets.

1 Like