DHCP for VLAN in WAP only configuration

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
tkohhh
DD-WRT Novice


Joined: 02 Aug 2019
Posts: 4

PostPosted: Fri Aug 02, 2019 21:09    Post subject: DHCP for VLAN in WAP only configuration Reply with quote
Hi all,

I have a Netgear R7000 with v3.0-r33675M kongac (11/03/17).

I am using the R7000 as a wireless access point connected to a pfSense router. DNS and DHCP are turned off in dd-wrt, and the Setup>Basic Setup>Network Setup points to the pfSense router for DNS and Gateway. This works perfectly for my primary SSID.

I am trying to setup a VLAN for my IoT devices. The VLAN is set up in pfSense, as well as in dd-wrt. The setup in dd-wrt is as follows:

Code:
    root@DD-WRT:\~# nvram show | grep vlan.\*ports | sort 
    size: 51571 bytes (13965 left) 
    vlan10ports=0t 
    vlan1ports=1 2 3 4 5\* 
    vlan2ports=0 5u 
    root@DD-WRT:\~# nvram show | grep port.\*vlans | sort 
    size: 51571 bytes (13965 left) 
    port0vlans=2 10 
    port1vlans=1 
    port2vlans=1 
    port3vlans=1 
    port4vlans=1 
    port5vlans=1 2 16 
    root@DD-WRT:\~# nvram show | grep vlan.\*hwname | sort 
    size: 51571 bytes (13965 left) 
    vlan10hwname=et0 
    vlan1hwname=et0 
    vlan2hwname=et0


Following the VLAN setup, I added a new SSID (wl0.1), created a bridge (br1), and then assigned vlan10 and wl0.1 to that bridge.

Finally, in the "Network Configuration br1" section, I entered the IP address and subnet for the VLAN. For now I did not enable Wireless Security on wl0.1.

When I connect to the SSID, I am able to connect, but the device does not receive an IP address or a gateway.

It seems like there should be a place to enter the gateway and DNS server for a VLAN, but I cannot seem to find how to do that. How can I get the VLAN in dd-wrt to use the pfSense box as the gateway/DNS/DHCP server?

Let me know if you need any additional information. Thanks for your help!
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 2248
Location: Texas, USA

PostPosted: Fri Aug 02, 2019 21:33    Post subject: Reply with quote
http://tips.desipro.de/2013/12/06/guest-wifi-setup-dd-wrt/ <-- good starting point, but your configuration adds a few things to the mix. You do need to add a dhcp server for the vlan in the services page and enable dnsmasq and configure it to point to your dns server and gateway.
tkohhh
DD-WRT Novice


Joined: 02 Aug 2019
Posts: 4

PostPosted: Fri Aug 02, 2019 21:46    Post subject: Reply with quote
Quote:
You do need to add a dhcp server for the vlan in the services page


Are you saying that I must use the DHCP Server in dd-wrt rather than the DHCP server on my pfSense?
tkohhh
DD-WRT Novice


Joined: 02 Aug 2019
Posts: 4

PostPosted: Fri Aug 02, 2019 22:31    Post subject: Reply with quote
I think I may have just found what I'm looking for on this wiki: https://wiki.dd-wrt.com/wiki/index.php/DNSMasq_as_DHCP_server#Assign_an_alternate_Gateway

Looks like I need to add
Code:
dhcp-option=br1,3,w.x.y.z

to dnsmasq to specify my pfSense as the router for that bridge. I'll try it tonight and report back if it works!
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 2248
Location: Texas, USA

PostPosted: Fri Aug 02, 2019 22:33    Post subject: Reply with quote
That is usually the normal way guest wi-fi / vap is set up. But it may be something with your port setup. I am presuming that you are setting vlan10 to the WAN port. So, you have a cable going to the WAN and one of the LAN ports, I am presuming. This setup may not work as intended unless the WAN port is assigned to the switch (basically disabling vlan2, if I am thinking correctly).

That was another thing I was thinking of, forgot to link that wiki page. It's either the port setup or assigning the gateway per the wiki that you found.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 4153
Location: Netherlands

PostPosted: Sat Aug 03, 2019 7:58    Post subject: Reply with quote
I am not the greatest VLAN expert but you have unbridged one ethernet port and set it together with a guest wifi on br1.

I am assuming you connect your WAP with ethernet just via one of the other ports so via br0.
If you want to connect the guest wifi via vlan10 wired to your pfsense than forget all what I have written below!

You have to use DNSMasq to assign DHCP for clients attached to br1.

So in the Setup/networking page under DHCPD (scroll down) set the DHCP server for br1.

As you have set the PF sens as Local DNS and Gateway on setup page that will be used, no need to set anything else (I am not 100%sure about this)

For broadcom routers unbridged VAP's need workarounds to function I will attach my notes with some workaorunds

Lastly but most important traffic coming out from your br1 has a different subnet then your local network (of course that is why you unbridged)

This can result in traffic not being NATted out to the internet if you run a DDWRT router, because DDWRT only NAT's traffic from its own subnet.
Depending on your PF sense box this might NAT traffic out but otherwis you need an extra NAT rule

The second problem is that your pfsens router does not know where to send return traffic ftom br1 to.
So you have not set a static route to route the subnet of br1 to the IP address of the WAP.

Now there is a trick to do all the above in one simple rule which you apply to the firewall of the DDWRT WAP:
Code:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to $(nvram get lan_ipaddr)
This will NAT all traffic coming from br1 to br0

See the attached document last setion VAP on a WAP

Hope this helps



DDWRT Virtual Access Point Public.doc
 Description:

Download
 Filename:  DDWRT Virtual Access Point Public.doc
 Filesize:  255 KB
 Downloaded:  38 Time(s)


_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5191
Location: Akershus, Norway

PostPosted: Sat Aug 03, 2019 8:27    Post subject: Reply with quote
You have an error in your VLAN setup.

"vlan10ports=0t"

VLAN10 is not connected to the processor of the router.

nvram set nvlan10ports="0t 5"

If you don't quote, the values after the space will not be added. I don't remember if you need 5 or 5t on a broadcom.
tkohhh
DD-WRT Novice


Joined: 02 Aug 2019
Posts: 4

PostPosted: Mon Aug 05, 2019 17:07    Post subject: Reply with quote
Per Yngve Berg wrote:
You have an error in your VLAN setup.


This, combined with the required DNSMasq entry (dhcp-option=br1,3,w.x.y.z) was the problem.

So, in the end, my VLAN setup looks like this:

Code:
root@DD-WRT:\~# nvram show | grep vlan.\*ports | sort
    size: 51571 bytes (13965 left)
    vlan10ports=0t 5
    vlan1ports=1 2 3 4 5\*
    vlan2ports=0 5u
    root@DD-WRT:\~# nvram show | grep port.\*vlans | sort
    size: 51571 bytes (13965 left)
    port0vlans=2 10
    port1vlans=1
    port2vlans=1
    port3vlans=1
    port4vlans=1
    port5vlans=1 2 10 16
    root@DD-WRT:\~# nvram show | grep vlan.\*hwname | sort
    size: 51571 bytes (13965 left)
    vlan10hwname=et0
    vlan1hwname=et0
    vlan2hwname=et0


My logic in not connecting vlan10 to the CPU port was that I was using the dd-wrt as a switch only, and therefore the router portion would not figure into the equation. This, of course, was faulty logic. Bottom line is this: always connect your vlans to the CPU port.

Thanks for your help everyone!
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum