networking topology recommendations?

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
oakertood
DD-WRT Novice


Joined: 02 Dec 2019
Posts: 4

PostPosted: Mon Dec 02, 2019 21:43    Post subject: networking topology recommendations? Reply with quote
I have an (overly?) complex design right now:
5 switches for, effectively, 4 vlans:
Core: XX.XX.10.0 -- connected to cable modem
IoT: XX.XX.20.0 -- IoT devices, e.g. thermometer, garage, etc.
guest: XX.XX.30.0 -- public, low security
Local: XX.XX.40.0 -- internal, MacPro file server and all family devices

All but the core have an SSID associated with them.

All switches are running DD-WRT and are various platforms (TP-LINK, Motorola, etc.)

I would like 2 things:
1) add OpenVPN to the architecture so I can VPN to my internal LAN, probably the Core, so can manage all three VLANs, but that may be more of a security risk....

2) simplified physical structure: I would like to have all three SSIDs sent from the same router/switch, a TP-Link Archer C9 device.

I get DD-WRT enough to use the UI and to apply commands via SSH, but I just don't know how best to do so (what commands, etc.).

Let me know if I left any gaps in my explanation... and...

THANK YOU!
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5914
Location: Netherlands

PostPosted: Tue Dec 03, 2019 6:43    Post subject: Reply with quote
Are you using VLAN's or just unbridged VAP's/Radio's?
How are the routers connected and setup, e.g. LAN<>LAN like a WAP or LAN<>WAN?

We need more information to give any sound advice, a drawing would help Smile

Below some pointers which might help to get the best out of DDWRT and out of the forum:
1. Research your router, start with the supported devices wiki:
https://wiki.dd-wrt.com/wiki/index.php/Supported_Devices .
2. In the supported devices wiki you can see if your router is supported and what architecture your router has and if you are lucky also an install guide/wiki.
3. Post in the right forum, from the former step you can see if your router is Broadcom, Qualcomm/Atheros, Marvell or other, use that forum to post router specific questions, for networking questions post in the Advanced Networking forum and for other things in the General Questions forum.
4. When posting always state router model, build number and when applicable the Kernel version.
Describe your problem and how you think it can be solved.
Give as much detail as you can also provide your network setup if applicable.
For your Network setup, state what wiki you have used: https://wiki.dd-wrt.com/wiki/index.php/Linking_Routers
5. When posting pictures make sure the maximum width is not more than 600 pixels.
6. Do not hijack a thread, meaning do not post your own problem in someone else's thread. Just start your own thread.
7. If your post is answered and your problem solved, mark your thread with [SOLVED] (the header of your first post).
8. Do NOT use the router database, builds can be found at:
https://dd-wrt.com/support/other-downloads/?path=betas%2F2019%2F
All builds are beta including those from the router database.
9. Before uploading a new build to your router, research the build by looking in the build threads.
This is an example of a build thread for build 41328 for Broadcom routers:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321699&highlight=41328
Search build threads with the search function and search on build number.
10. Use the build threads from the former step to report success or problems.
11. For older Broadcom routers (Linksys WRT54 and E series) read the peacock thread although some of it is outdated: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=51486
Builds can be found in the Broadcom directory for Linux kernel 2.4, in Broadcom_K26 for Linux K2.6 and in Broadcom_K3X for Linux K3.X.
12. If you are sure you have discovered a bug, after asking and querying the forum, you can report a real bug in the bug tracker: https://svn.dd-wrt.com/
This is also the place where the commits/changes to the source are administrated.
13. Recommended reading:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=54845
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=54959
14. If you are happy with DDWRT and want it to live on then donate:
https://dd-wrt.com/donations/

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
oakertood
DD-WRT Novice


Joined: 02 Dec 2019
Posts: 4

PostPosted: Wed Dec 04, 2019 2:47    Post subject: Add'l info Reply with quote
All good points and well taken. I assumed far more than I thought.

NOTES:
1 & 2) All devices are supported w/in DD-WRT and have been running for several years. (they just need updated for consistency)

3) I don't _think_ this is router specific, hence this forum, but I am happy to re-post if you all think otherwise.

4) After re-thinking my original request, I am initially looking for topology recommendations, not specific command recommendations. They may come later in device-specific fora. --> No device specifics in this post.

ASKS:
1) where in the network should I place the OpenVPN "server"?
--a) On one of the routers/switches?
--b) On the file server (MacOS 10.x)
--c) On an additional/separate router/switch running DD-WRT

2) Is it _feasible_ to run this on one router, assuming it has the resources/power and ability to run multiple VLANs? The router I am thinking of using is:
Router Model -- TP-Link Archer C9
Firmware Version -- DD-WRT v3.0-r40559 std (08/06/19)
Kernel Version -- Linux 4.4.187 #652 SMP PREEMPT Tue Aug 6 11:52:33 +04 2019 armv7l
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5914
Location: Netherlands

PostPosted: Wed Dec 04, 2019 8:32    Post subject: Reply with quote
Build 40559 is probably from the router database, it is not the best build (see my pointers)

OpenVPN is not running very fast on lower end ARM CPU's, your C9 is equivalent to my R6400v2 and that will give you about 35 - 40 Mb/s VPN speed, if you are satisfied with this then that is fine, I am running my VPN server on the R6400v2 without problems.
If you want faster, you can run it on your file server which should easily get you hundreds of Mb/s.

A faster router can also help, my R7800 does about 90 Mb/s

An alternative is Wireguard, a new VPN protocol which is almost 3 times faster, but it is new and immature but I am using it at the moment without problems.

It does not matter where you place the VPN server in your Network as long as it is reachable through port forward and you can reach the rest of your network from the VPN server.

Regarding your network setup I attach some personal notes for linking multiple subnets, maybe they are helpful.

You might also look into using a WAP for linking routers see: https://wiki.dd-wrt.com/wiki/index.php/Wireless_access_point

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
oakertood
DD-WRT Novice


Joined: 02 Dec 2019
Posts: 4

PostPosted: Fri Apr 03, 2020 23:34    Post subject: Revisiting -- networking topology recommendations Reply with quote
I want three (3) VLANs w/ their own subnets:
1) Secure VLAN: home devices, e.g. PCs, phones, file server
2) Guest VLAN: friends and family
3) IoT devices, e.g. ecobee thermostat, cameras, etc.
4) Media: TV's, Smart speakers.

I want 2 and 3 to have no access to 1, but 1 should be able to access all devices on 2 & 3 (unless this is not recommended for security reasons). Ideally, any devices on 1 or 2 should be able to see and communicate with devices on 4.

All physical ports can be on VLAN 1 (assuming I can change down the road if I need to, via the Setup >> Switch Config page).

Each VLAN would have it's own SSIDs (w/ a 2.4 Ghz and 5Ghz variant)

I want all of this on a single DD-WRT router (happens to be a TP-Link Archer C9)

I found this article (https://blog.flashrouters.com/2015/04/06/what-is-a-vlan-how-to-setup-vlan-ddwrt/) that talks about setting the phys. ports and setting up the DHCP scopes, but what do I need to do to make sure the SSID's are associated correctly?

In the attached image,
* Green arrows are REQUIRED
* Yellow arrows are 1st priority
* Red arrows are questionable based on security recommendations.


I *think* this is more generic to DD-WRT than specific to my router, but if I really need to move this to the Broadcom thread or a model-specific thread, I can...

Thanks in advance!
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum