VLANs for R7800 and WRT1900ACS v2

Ontarier · June 30, 2025, 3:09pm

Would someone take a look at this config, please? I had an issue with my previous config in that my lan interface was still using br-lan despite the addition of bridge-vlans. psherman had me add another VLAN without assigning any ports, and edit the lan interface to use the new br-lan.x. Success!

I wasn't able to attach the wifi to a VLAN using Luci, so decided to start from scratch. This time the VLAN config seems to work without an extra bridge. Just want to be sure I've done it right.

By the way, never having tried to config wireless via CLI, I added the wifi networks to the lan using luci, then used Putty to edit them to use the VLANs rather than the lan in /etc/config/wireless, before pasting the VLAN config to /etc/config/wireless.

Thanks in advance!

OpenWrt 24.10.1, r28597-0425664679

root@OpenWrt:~# ubus call system board
{
"kernel": "6.6.86",
"hostname": "OpenWrt",
"system": "ARMv7 Processor rev 0 (v7l)",
"model": "Netgear Nighthawk X4S R7800",
"board_name": "netgear,r7800",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.1",
"revision": "r28597-0425664679",
"target": "ipq806x/generic",
"description": "OpenWrt 24.10.1 r28597-0425664679",
"builddate": "1744562312"
}
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd72:a008:2cb2::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'
option device 'wan'
option proto 'dhcp'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'

config bridge-vlan
option device 'br-lan'
option vlan '3'
list ports 'lan3:u*'

config interface 'VLAN3'
option device 'br-lan.3'
option proto 'static'
option ipaddr '192.168.3.1'
option netmask '255.255.255.0'

config bridge-vlan
option device 'br-lan'
option vlan '4'
list ports 'lan4:u*'

config interface 'VLAN4'
option device 'br-lan.4'
option proto 'static'
option ipaddr '192.168.4.1'
option netmask '255.255.255.0'

config bridge-vlan
option device 'br-lan'
option vlan '5'
list ports 'lan1:u*'
list ports 'lan2:u*'

config interface 'VLAN5'
option device 'br-lan.5'
option proto 'static'
option ipaddr '192.168.5.1'
option netmask '255.255.255.0'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
option band '2g'
option channel '11'
option country '**'
option cell_density '0'
option htmode 'HT20'

config wifi-iface 'default_radio0'
option device 'radio0'
option network 'VLAN3'
option mode 'ap'
option ssid ''
option encryption 'psk2'
option isolate '1'
option key '****'

config wifi-device 'radio1'
option type 'mac80211'
option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
option band '5g'
option channel '149'
option htmode 'VHT80'
option country '**'
option cell_density '0'

config wifi-iface 'default_radio1'
option device 'radio1'
option network 'VLAN4'
option mode 'ap'
option ssid ''
option encryption 'sae'
option isolate '1'
option key '****'
option ocv '0'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
list server '127.0.0.1#5054'
list server '/mask.icloud.com/'
list server '/mask-h2.icloud.com/'
list server '/use-application-dns.net/'
list server '127.0.0.1#5053'
option doh_backup_noresolv '-1'
option noresolv '1'
list doh_backup_server '127.0.0.1#5054'
list doh_backup_server '/mask.icloud.com/'
list doh_backup_server '/mask-h2.icloud.com/'
list doh_backup_server '/use-application-dns.net/'
list doh_backup_server '127.0.0.1#5053'
list doh_server '127.0.0.1#5053'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

config dhcp 'VLAN5'
option interface 'VLAN5'
option start '100'
option limit '150'
option leasetime '12h'

config dhcp 'VLAN4'
option interface 'VLAN4'
option start '100'
option limit '150'
option leasetime '12h'

config dhcp 'VLAN3'
option interface 'VLAN3'
option start '100'
option limit '150'
option leasetime '12h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'VLAN5'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config zone
option name 'VLAN4'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'VLAN4'

config zone
option name 'VLAN3'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'VLAN3'

config forwarding
option src 'VLAN4'
option dest 'wan'

config forwarding
option src 'VLAN3'
option dest 'wan'

config rule
option src 'VLAN4'
option name 'VLAN4-DNS'
option dest_port '53'
option target 'ACCEPT'

config rule
option src 'VLAN3'
option name 'VLAN3-DNS'
option dest_port '53'
option target 'ACCEPT'

config rule
option src 'VLAN4'
option name 'VLAN4-DHCP'
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'

config rule
option src 'VLAN3'
option name 'VLAN3-DHCP'
list proto 'udp'
option dest_port '67'
option target 'ACCEPT'

brada4 · June 30, 2025, 5:30pm

you are missing zones for vlan-networks in firewall. See "guest wifi" guide. wifi not required, just the checklist on what to add to the

firewall

And use [</>] to format any future terminal outputs.

Ontarier · June 30, 2025, 6:53pm

Hi and thanks for looking things over. I have VLAN5 using the lan zone and VLANs 3&4 with their own zones. What do I need over and above the following...?


config zone
        option name 'VLAN4'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'VLAN4'

config zone
        option name 'VLAN3'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'VLAN3'

config forwarding
        option src 'VLAN4'
        option dest 'wan'

config forwarding
        option src 'VLAN3'
        option dest 'wan'

config rule
        option src 'VLAN4'
        option name 'VLAN4-DNS'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option src 'VLAN3'
        option name 'VLAN3-DNS'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option src 'VLAN4'
        option name 'VLAN4-DHCP'
        list proto 'udp'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option src 'VLAN3'
        option name 'VLAN3-DHCP'
        list proto 'udp'
        option dest_port '67'
        option target 'ACCEPT'

Thanks again and cheers!

PS...in case anyone else doesn't follow the preformatted text instructions, just paste your config in the message, select what you pasted, and then click the preformatted text icon.

brada4 · June 30, 2025, 7:26pm

You can limit dhcp with source port 68 and drop input. Maybe icmp echo-request is helpful for troubleshooting.

Ontarier · July 1, 2025, 1:49pm

Hi and thanks again. Does this look ok? (I'm reading up on icmp echo-request for troubleshooting.)

config rule
        option src 'VLAN3'
        option name 'VLAN3 DNS and DHCP'
        option dest_port '53 67'
        option target 'ACCEPT'

config rule
        option src 'VLAN4'
        option name 'VLAN4 DNS and DHCP'
        option dest_port '53 67'
        option target 'ACCEPT'

config rule
        option src 'VLAN3'
        option name 'VLAN3 DHCP port 68'
        list proto 'udp'
        option target 'DROP'
        option dest_port '68'

config rule
        option src 'VLAN4'
        option name 'VLAN4 DHCP port 68'
        list proto 'udp'
        option target 'DROP'
        option dest_port '68'