I've taken my trusty WNDR3700 and installed Chaos Clamer.
I've set up the router to allow remote luci connections to 192.168.1.1 via the wan IP address, 192.168.4.5 by forwarding tcp ports 22 and 443 traffic to 192.168.1.1.
I've created vlan100 (192.168.100.0/24).
I can hit the gateway 192.168.100.1 from my server and from inside my router. I can't figure out how to forward traffic from my home network (192.168.4.0/24) to vlan100 (192.168.100.0/24).
If appears OpenWrt comes with 192.168.1.1 assigned to a vlan eth0.1. I've read a few older posts, and they all address the switch directly. Am I missing something?
I'm using Ports 0 and 3, tagged for vlan100 only, with CPU tagged on both VLANs. I'm not trying to use vlan eth0.1's subnet.
Here are my configuration files. Any help will be greatly appreciated!
/etc/config/network:
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd69:9417:4099::/48'
config interface 'lan'
option ifname 'eth0.1'
option force_link '1'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option ifname 'eth1'
option proto 'dhcp'
config interface 'wan6'
option ifname 'eth1'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
option blinkrate '2'
option enable_vlan4k '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5t'
config switch_port
option device 'switch0'
option port '1'
option led '6'
config switch_port
option device 'switch0'
option port '2'
option led '9'
config switch_port
option device 'switch0'
option port '5'
option led '2'
config switch_vlan
option device 'switch0'
option ports '0t 3t 5t'
option vlan '100'
config interface 'vlan100'
option proto 'static'
option ifname 'eth0.100'
option ipaddr '192.168.100.1'
option netmask '255.255.255.0'
config route
option interface 'wan'
option target '192.168.100.0'
option netmask '255.255.255.0'
option ports '0t 3t 5t'
option vlan '100'
config interface 'vlan100'
option proto 'static'
option ifname 'eth0.100'
option ipaddr '192.168.100.1'
option netmask '255.255.255.0'
config route
option interface 'wan'
option target '192.168.100.0'
option netmask '255.255.255.0'
option gateway '192.168.100.1'
config route
option interface 'vlan100'
option target '192.168.4.0'
option netmask '255.255.255.0'
option gateway '192.168.4.1'
/etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option input 'ACCEPT'
option network 'wan wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option target 'ACCEPT'
option src 'wan'
option dest 'lan'
option name 'luci via wan'
option dest_port '443'
option dest_ip '192.168.1.1'
config rule
option target 'ACCEPT'
option src 'wan'
option dest 'lan'
option name 'ssh via wan'
option dest_ip '192.168.1.1'
option dest_port '22'
config zone
option name 'vlan100'
option input 'ACCEPT'
option output 'ACCEPT'
option network 'vlan100'
option forward 'ACCEPT'
config forwarding
option dest 'wan'
option src 'vlan100'
option output 'ACCEPT'
option network 'vlan100'
option forward 'ACCEPT'
config forwarding
option dest 'wan'
option src 'vlan100'
config rule
option target 'ACCEPT'
option src 'wan'
option name 'wan to vlan100'
option dest 'vlan100'
config rule
option enabled '1'
option target 'ACCEPT'
option src 'vlan100'
option dest 'wan'
option name 'vlan100 to wan'