Zyxel Switch can't access internet itself

Evolutio · June 23, 2024, 9:56am

Im very new to this topic and I can't find anything on wiki/google/chatgpt what could help me.

I use a ZyXEL GS1900-24E with latest OpenWRT.

My setup is the following:
I've a mikrotik router with VLAN-filtering on ether2 (vlan: 100 & 200).

I connected the zyxel on "ether1" to the "ether2" from my mikrotik router.

When I add the required vlan ids to the networking device "switch" the device on "ether2 on zyxel" get's access to the internet and the right IP over the DHCP from my mikrotik router - that's for now what I want.

device switch vlans:

But the zyxel itself can't access the internet. I think that's because the vlan.
Did anyone has an idea, why the zyxel itself can't access the internet?

here is my network config:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd40:0d00:d936::/48'

config device 'switch'
        option name 'switch'
        option type 'bridge'
        option macaddr '5c:f4:ab:c5:9c:a3'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'
        list ports 'lan6'
        list ports 'lan7'
        list ports 'lan8'
        list ports 'lan9'
        list ports 'lan10'
        list ports 'lan11'
        list ports 'lan12'
        list ports 'lan13'
        list ports 'lan14'
        list ports 'lan15'
        list ports 'lan16'
        list ports 'lan17'
        list ports 'lan18'
        list ports 'lan19'
        list ports 'lan20'
        list ports 'lan21'
        list ports 'lan22'
        list ports 'lan23'
        list ports 'lan24'

config bridge-vlan 'lan_vlan'
        option device 'switch'
        option vlan '1'
        option ports 'lan1 lan2 lan3 lan4 lan5 lan6 lan7 lan8 lan9 lan10 lan11 lan12 lan13 lan14 lan15 lan16 lan17 lan18 lan19 lan20 lan21 lan22 lan23 lan24'

config device
        option name 'switch.1'
        option macaddr '5c:f4:ab:c5:9c:a3'

config interface 'lan'
        option device 'switch.1'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '10.40.90.90/24'

config bridge-vlan
        option device 'switch'
        option vlan '100'
        list ports 'lan1:t'
        list ports 'lan2'

config bridge-vlan
        option device 'switch'
        option vlan '200'
        list ports 'lan1:t'
        list ports 'lan2'

firewall:

config defaults
        option syn_flood        1
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

frollic · June 23, 2024, 9:58am

Static IP requires setting default gw and DNS IPs too.

Evolutio · June 23, 2024, 10:04am

Thanks for your reply. I tried already to add an dns (for example 1.1.1.1) to lan/switch.1 and the gateway 192.168.40.1,192.168.1.1, which should be the one from the mikrotik router - with no success.

flygarn12 · June 23, 2024, 10:04am

In your picture, you can’t have more than one untagged vlan per port on lan2.

And on lan1 I would not have an untagged vlan on a port with tagged vlan, it is leagal but if you want problem with home equipment then go ahead.

frollic · June 23, 2024, 10:05am

What kind of error are you getting, when doing ping for instance?

Evolutio · June 23, 2024, 10:06am

Bad address:

root@OpenWrt:~# ping google.de
ping: bad address 'google.de'

also I cant ping the gateway:

root@OpenWrt:~# ping 192.168.40.1
PING 192.168.40.1 (192.168.40.1): 56 data bytes
ping: sendto: Network unreachable
root@OpenWrt:~# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
ping: sendto: Network unreachable

flygarn12 · June 23, 2024, 10:13am

And on top of that we have the concept of switches in network.

They don’t have brain or connection to the internet. They only switch L2 packages controlled by the actual router that definitely isn’t the actual switch because you don’t have any computer power in the switch to run a firewall or route data.
The only logical thinking a switch have on L3 level (an interface) is its own admin servers, which means a Luci or SSH connection in this case.

Evolutio · June 23, 2024, 1:05pm

But why openwrt has the ability to run ping/traceroute & nslookup under network -> diagnostics.

And how I can update/install packages? With upload it's really annoying because it can't install the dependencies automatically.

Anyway I thought that the software has a connection to the internet through ether1.

slh · June 23, 2024, 3:14pm

You can, if you configure the static IP settings correctly (as mentioned, gateway, dns) or go the simpler routing and use dhcp(-client).

Evolutio · June 23, 2024, 7:59pm

I tried anything, but nothing works as expected:
My mikrotik exposes on ether2 the following ips:

vlan 100 -> 192.168.40.1/24, 192.168.50.1/24, 192.168.60.1/24
vlan 200 -> 192.168.200.1/24

but how I can tell it to use the vlan 100? I think there is my problem.
I tried the following:

and this:

without luck.

192.168.1.1/192.168.40.1/192.168.50.1/192.168.60.1 should be the reachable gateways. 192.168.50.5 is an adguardhome Server in the network.

andyboeh · June 23, 2024, 8:33pm

The only interface configuration I can spot in the configuration you posted (config interface 'lan') is on VLAN 1, not VLAN 100 or VLAN 200. You need to change switch.1 to switch.100 to have the interface on VLAN 100. Please be aware that you might lose access to the switch if you reconfigure this.

As an alternative, you can add another interface on switch.100 in addition to the existing one.

psherman · June 23, 2024, 8:38pm

You're already getting good advice in terms of the configuration, but one thing that hasn't been asked...

Why do you want the switch to have internet access? It doesn't need it for most situations. Is there something in particular that you plan to do (i.e. install additional packages, run some services, etc.?)

system · July 3, 2024, 8:39pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.