VLAN setup using the GUI

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Mon Apr 04, 2016 17:23    Post subject: VLAN setup using the GUI Reply with quote
I am trying to find information on setting up and separating VLans using build 29218 in a RT-AC66U. For one I am trying to find some kind of help menu for what all the setting fields under the VLANs tab and the NETWORK tab mean. Currently the help menu for both those tabs is blank. Perhaps if knew some detail on each item might make all the difference.

If not that how to create a Vlans, that are separated and bride them to Wans or Wlans using the GUI. Currently if I create them they can all talk to each other. I don't know how to break this connection. Anything I try crashes the router and I cannot log back pull up the webpage without resetting the router to factory defaults.
I found some older how to's on this but they all involve scripts and using Telnet. From what I understand after build 26000 something you don't want to do that no more and only use the GUI to do this.

Lastly if no other knowledge is available if anyone knows a page elsewhere on the web they know about that might give me an idea on how to set up Vlans would be great.

Thanks,
Sponsor
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5921
Location: Romerike, Norway

PostPosted: Mon Apr 04, 2016 19:37    Post subject: Reply with quote
http://www.vspecialist.co.uk/creating-vlans-in-dd-wrt-part-1/

http://www.coertvonk.com/technology/networking/dd-wrt-leading-two-seperate-networks-5829
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Wed Apr 06, 2016 1:02    Post subject: Reply with quote
Thank you Per Yngve Berg, this looks like what I need. Wish I could read it all right now.
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Wed Apr 06, 2016 5:32    Post subject: Reply with quote
I have done and tried the www.coertvonk.com walkthrough but I am still having problems.

Can someone please help walk me through this using the GUI only. I have been instructed NOT to use telnet commands with my build of 29218 and that is true for any build after 26000 and something. I follow many of these walkthroughs and they explain it in a script "nvram set something something" but then follow it with "this can also be done in the GUI" but no one that I have seen as screen caps showing what the GUI should look like so I can follow it as the GUI has more settings then are described in the instructions that I think are causing me problems.

Anyway after completing the walkthrough from the www.coertvonk.com link my nvram show looks like this...

nvram show | grep vlan.*ports | sort
vlan1ports=3 4 8*
vlan2ports=0 8
vlan3ports=1 2 8*


nvram show | grep vlan.*vlan | sort
port0vlans=2 18 19 21
port1vlans=3 18 19
port2vlans=3 18 19
port3vlans=1 18 19
port4vlans=1 18 19
port5vlans=1 2 16


nvram show | grep vlan.*hwname | sort
vlan1hwname=et0
vlan2hwname=et0
vlan3hwname=et0

I had also created the wl0.1 interface, created br1 with a DHCP as described. And my firewall script is as follows..

iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

I can connect to ports 3 or 4 and I get internet, and IP and can ping the router at 192.168.1.1. If I connect to ports 1 or 2 I do not get a DHCP assignment. If I set the IP manually, I cannot ping the router, and of course this means I have no internet.

Can someone please help.
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Wed Apr 06, 2016 5:37    Post subject: Reply with quote
The problem has gotten worse, as I could not get the vlans to work I used the GUI interface to reset to factory defaults then rebooted. I no longer have ports 1 or 2 as you can see from the Telnet log.


nvram show | grep vlan.*ports | sort
vlan1ports=3 4 8
vlan2ports=0 8u

how do I get ports 1 and 2 back now? How can I reset everything back to square one so I don't have something lingering in the router that might mess with me later?

Thanks,
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5921
Location: Romerike, Norway

PostPosted: Wed Apr 06, 2016 10:03    Post subject: Reply with quote
Did you assign vlan3 to br1?

Nvram set vlan1ports="1 2 3 4 8"
Nvram commit
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Wed Apr 06, 2016 13:26    Post subject: Reply with quote
Yes I had Vlan3 and wl0.1 assigned to br1. It showed up on the line below that way as well.

Is there a way to clr the nvram settings all back to default from the GUI, I am not able to clear nvram from putty.
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5921
Location: Romerike, Norway

PostPosted: Wed Apr 06, 2016 16:08    Post subject: Reply with quote
Administration->Factory Defaults.

This is the only reset you should use on this router.
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Wed Apr 06, 2016 19:24    Post subject: Reply with quote
The factory reset did not reset my vlan ports so this has me concerned that it might not reset my DHCP assignments, or any other configuration I mistakingly typed in. If I get my self locked out to bad such as turned off all the ports the factory reset would no longer let me in. I am thinking if this was all done in the GUI it would reset with a restore to defaults.
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5921
Location: Romerike, Norway

PostPosted: Wed Apr 06, 2016 20:27    Post subject: Reply with quote
What is the ip addresses you have assigned to vlan1 and vlan3?

You should have tested the vlans before blocking anything off with iptables.
MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Thu Apr 07, 2016 4:30    Post subject: Reply with quote
Well i am somewhat closer to my goal. I apologies as this will be long but I want to give you all the information available.

What I am trying to do is create 3 different LANs
Main LAN = main network with security cameras, nas, computer, ECT
Shared LAN = shared devices i.e. printers, and media devices
Guest Lan = network for guest and visitors

The goal is to allow both the main and guest network talk to the shared network
All three networks to access the internet
Block all comms from guest getting to main LAN

Was planning on vlan 1 = main LAN
Vlan 3 = shared LAN
Vlan 6 = guest LAN

If i makes sense to switch shared LAN to 1 and main LAN to 3 let because of reasons let me know please

Using the GUI
In Setup/VLANs I have Port W on Vlan 2
I have port 1 on vlan 6
I have port 2 on vlan 3
I have port 3 on vlan 1
I have port 4 on vlan 1

Assigned to Bridge i have Vlan 1 assigned to LAN the rest to none


In Setup/Networking i currently have br0 assigned to vlan1 eth1 eth2 (this was default)

WAN Port Assignment = vlan 2

Network Configuration eth0 = default
eth1 = default
eth2 = default
vlan1 = default
vlan3 = unbridged IP= 192.168.3.1 mask= 255.255.255.0
vlan6 = unbridged Ip= 192.168.6.1 mask= 255.255.255.0

DHCPD Configuration
DHCP 0= vlan6 start 100 max 50 lease 3600
DHCP 1= vlan3 start 100 max 50 lease 3600


In Setup/Basic Setup

Router IP Address= 192.168.1.1
Subnet Mask= 255.255.255.0


Network Address Server Settings
DHCP Server
Enable
Start Address= 192.168.1.100
Maximum= 50
Lease= 3600


If i plug into ports 1, 2 i get an ip of 192.168.1.x and internet access
If i plug into port 3 i get an ip of 192.168.3.x and internet access
If i plug into port 4 i get an ip of 192.168.6.x and internet access

However from any network i can successfully ping a device on any other network.

In Administration/Commands/Firewall i have tried both

"iptables -I FORWARD -i vlan+ -o vlan+ -j DROP
iptables -I FORWARD -i vlan+ -o vlan1 -j ACCEPT
iptables -I FORWARD -i vlan1 -o vlan+ -j ACCEPT"

and

"iptables -I FORWARD -i vlan1 -o vlan6 -j DROP
iptables -I FORWARD -i vlan6 -o vlan1 -j DROP"

At some point I also want wl0 and wl1 on vlan 1 with wl0.1 on vlan 3 and wl0.2 on vlan 6

Can someone please help me with my bridge setups and firewall tables to achieve what I said i was trying for in the beginning?
Maybe once I see what the settings are supposed to be it will all make sense and I won’t ask questions no more.

Lastly can someone explain why I have eth0 eth1 and eth2 instead of just eth0 like all the examples I see.


Thanks in advance.
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5921
Location: Romerike, Norway

PostPosted: Thu Apr 07, 2016 5:11    Post subject: Reply with quote
It's the three interfaces cabled, 2.4Ghz and 5Ghz.


Create two new bridges br3 and br6
Create vap wl0.1, wl1.1 etc.

Bridge vlan3 and vlan6 and assign the ip addresses to the bridges. Assign the vlan and the vap to each bridge
JAMESMTL
DD-WRT Guru


Joined: 13 Mar 2014
Posts: 856
Location: Montreal, QC

PostPosted: Thu Apr 07, 2016 5:49    Post subject: Reply with quote
Here's a copy of my bridge setups to give you an idea. To keep things consistant lets assume you create two bridges for your shared and guest network

br0 : LAN
br1 : Shared
br2 : Guest

Code:

iptables -I FORWARD 2 -i br+ -o br+ -j DROP
iptables -I FORWARD 2 -i br2 -o br1 -j ACCEPT
iptables -I FORWARD 2 -i br0 -o br1 -j ACCEPT


Where 2 represents the rule # after established, related. new connections from br0 & br1 are permitted and subsequent packets + replies fall under established, related. otherwise replies from shared will be dropped.

Additionally you would want to limit br1/2 connectivity to router. Accept dhcp/dns drop the rest

Code:

iptables -I INPUT -i br2 -j DROP
iptables -I INPUT -i br1 -j DROP
iptables -I INPUT -i br2 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT


I would also place the input rules after the established, related rule.

Permit Internet access of bridges
Code:

iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -o vlan2 -j SNAT --to-source $(nvram get wan_ipaddr)
iptables -t nat -A POSTROUTING -s 192.168.6.0/24 -o vlan2 -j SNAT --to-source $(nvram get wan_ipaddr)


In the bridge example you can just use default mac address. I had a specific reason for custom macs

*** edit don't put vlan 2 as part of br0. My example is from an AP not gateway

This also assumes you used GUI to set port vlans.

that should do it.

eth0 : physical switch
eth1 : physical radio 1
eth2 : physical radio 2

vlan1 : logical native LAN
vlan2 : logical WAN

see https://www.dd-wrt.com/wiki/index.php/Default_Configuration_Overview to get the idea



multi vlans.PNG
 Description:
 Filesize:  145.58 KB
 Viewed:  23301 Time(s)

multi vlans.PNG



_________________
IPv6 Ready - HE IPv6 Tunnel
http://test-ipv6.com (10/10)
http://ipv6-test.com (20/20)
http://test-ipv6.netiter.dk (20/20)

MelectroK
DD-WRT Novice


Joined: 22 Jul 2015
Posts: 27

PostPosted: Sat Apr 09, 2016 3:16    Post subject: Reply with quote
I followed both your advices and looked like I was making progress. But as soon as I assign br1 to vlan3 and br2 to vlan6 I loose the ability to obtain a IP address from DHCP. If I remove one or the other or both assinments I get that ability back. Hopefully you can look at it an see what I missed. If I set a static ip on the network manual with 8.8.8.8 as my dns I am able to then get internet from that vlan, however I cannot ping 192.168.1.1 or 192.168.3.1 or 192.168.6.1. If I set back to DHCP and plug into vlan 1 I do get a address, internet and the ability to ping all three. To simply things I did not create wl0.1 or wl0.2 yet, only used the wired ports to test the VLans. I have attached some screen shots below so you can see my settings.









I have tried it both with and without these scripts. Along with varients script wise and GUI wise with no avalile.

JAMESMTL
DD-WRT Guru


Joined: 13 Mar 2014
Posts: 856
Location: Montreal, QC

PostPosted: Sat Apr 09, 2016 4:12    Post subject: Reply with quote
dhcp on br1&2 not vlans

show fw rules


iptables -vnL

_________________
IPv6 Ready - HE IPv6 Tunnel
http://test-ipv6.com (10/10)
http://ipv6-test.com (20/20)
http://test-ipv6.netiter.dk (20/20)

Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum