What Switch and AP running with latest OpenWrt would you recommend me for my new IoT network?

Hardware Questions and Recommendations
20

Configuration files for a basic all-in-one gateway WiFi router on swconfig (not DSA) with LAN on VLAN 1, WAN on VLAN 2, Internet of Things Network on VLAN 10 and Guest network on VLAN 20 follow.

Cautions and Notes:

  • The swconfig example is based on an EA8500. In this example, the WAN is tagged to CPU port 0 ("0t"), and the LAN, GST and IOT networks to CPU port 6 ("6t"). Pay attention to how this is set up on your C7 and adjust accordingly in your network file.
  • For completeness, a network file showing the setup for a device migrated to DSA is also provided. The dhcp, firewall and wireless files are from the EA8500 swconfig example, but these three files do not materially differ between swconfig and DSA.
  • The network files are configured to send only lan traffic (untagged) to physical ports 1 and 2, IOT traffic (untagged) to port 3 and GST traffic (untagged) to physical port 4. Obviously configure this however you like it is just an example.
  • Do not use these files as direct replacements! Use them as guides. For example MAC addresses in the network file have been over-written with xx:xx:xx:xx, etc. That won't work well :wink:
  • Notice configuring br-lan, br-GST and br-IOT bridges for these VLANs in the EA8500 swconfig network file is more complicated than in the DSA example, but these bridges are needed to connect up the WiFi SSID's for each VLAN.
/etc/config/network (this example is for a device still using swconfig) 
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'xxxx:xxxx:xxxx::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth1.1'

config device
	option name 'eth1.1'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'

config device
	option name 'eth0.2'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 6t'
    option description 'LAN'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '0t 5'
    option description 'WAN'

config switch_vlan
    option device 'switch0'
    option vlan '10'
    option ports '3 6t'
    option description 'IOT'

config switch_vlan
    option device 'switch0'
    option vlan '20'
    option ports '4 6t'
    option description 'GST'

config device
    option type 'bridge'
    option name 'br-IOT'
    list ports 'eth0.10'

config device
    option type 'bridge'
    option name 'br-GST'
    list ports 'eth0.20'

config interface 'IOT'
    option proto 'static'
    option ipaddr '192.168.10.1'
    option netmask '255.255.255.0'
    option device 'br-IOT'

config interface 'GST'
    option proto 'static'
    option ipaddr '192.168.20.1'
    option netmask '255.255.255.0'
    option device 'br-GST'
/etc/config/network (this example is for a device migrated to DSA) 
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'xxxx:xxxx:xxxx::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'lan1'
	list ports 'lan2'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan3'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'IOT'
	option proto 'static'
	option device 'br-lan.10'
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config interface 'GST'
	option proto 'static'
	option device 'br-lan.20'
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

Now we need DHCP servers for our new GST and IOT VLANS. Just the last two sections at the end for GST and IOT need to be added.

/etc/config/dhcp 
config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option confdir '/tmp/dnsmasq.d'
	list server '/use-application-dns.net/'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	option ra_slaac '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'IOT'
	option interface 'IOT'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list ra_flags 'none'

config dhcp 'GST'
	option interface 'GST'
	option start '100'
	option limit '150'
	option leasetime '12h'
	list ra_flags 'none'

Next we need to set up firewall zones and rules so that our GST and IOT networks can get DHCP and DNS service. The additions start with: config zone....option name 'iot'.

/etc/config/firewall 
config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option output 'ACCEPT'
	option masq '1'
	option mtu_fix '1'
	option input 'DROP'
	option forward 'DROP'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option family 'ipv4'
	list icmp_type 'echo-request'
	option target 'DROP'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
        option name 'iot'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'IOT'
        option input 'REJECT'

config zone
        option name 'gst'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'GST'
        option input 'REJECT'

config forwarding
        option src 'gst'
        option dest 'wan'

config forwarding
        option src 'iot'
        option dest 'wan'

config rule
        option name 'Allow-iot-DNS'
        option src 'iot'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'tcp'
        list proto 'udp'

config rule
        option name 'Allow-gst-DNS'
        option src 'gst'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'tcp'
        list proto 'udp'

config rule
        option name 'Allow-iot-DHCP'
        option target 'ACCEPT'
        list proto 'udp'
        option src 'iot'
        option dest_port '67-68'

config rule
        option name 'Allow-gst-DHCP'
        option src 'gst'
        option dest_port '67-68'
        option target 'ACCEPT'
        list proto 'udp'

Finally, let's attach some unique WiFi SSID's to our new Guest and Internet of Things VLANS.

/etc/config/wireless 
config wifi-device 'radio0'
	option type 'mac80211'
	option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option disabled '0'
    option country 'US'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt-2G'
    option encryption 'psk2+ccmp'
    option key 'TopSecret'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'VHT80'
	option disabled '0'
    option country 'US'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt-5G'
    option encryption 'psk2+ccmp'
    option key 'TopSecret'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option encryption 'psk2+ccmp'
        option key 'TopSecret'
        option network 'GST'
        option ssid 'OpenWrt-2G-Guest'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'OpenWrt-2G-IOT'
        option encryption 'psk2+ccmp'
        option key 'TopSecret'
        option network 'IOT'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt-5G-Guest'
        option encryption 'psk2+ccmp'
        option key 'TopSecret'
        option network 'GST'

config wifi-iface 'wifinet5'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt-5G-IOT'
        option encryption 'psk2+ccmp'
        option key 'TopSecret'
        option network 'IOT'
1 Like