Dumb Q2: How to get DHCP IP's w/ bridged VLAN+VAP?

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
MrPete
DD-WRT User


Joined: 09 Jul 2013
Posts: 82

PostPosted: Thu Dec 12, 2019 19:50    Post subject: Dumb Q2: How to get DHCP IP's w/ bridged VLAN+VAP? Reply with quote
I have a question I don't see answered either in the forum or the wiki. Seems like a not-unusual case. Could easily be I am just thinking about this wrong...

I'm setting up DD-WRT with a bunch of (VAP)+(Tagged VLAN) bridges:

(external router+smart switch)
|||
||| Trunk
|||
(DDWRT ethernet port)
- Br9: Tagged VLAN 9 + WiFi VAP
- Br10: Tagged VLAN 10 + WiFi VAP
- Br11: Tagged VLAN 11 + WiFi VAP
- Br12: Tagged VLAN 12 + WiFi VAP
- Br15: Tagged VLAN 15 + WiFi VAP

I do NOT want DDWRT to send packets between any of these wifi vlan's. Traffic should all go upstream

QUESTIONS

a) When I create the bridge, it wants me to assign an IP. Doesn't that 'break' obtaining it via DHCP (and telling the upstream switch/router that I'm here?)

b) How do I ensure the rest of the world knows to come here?

Feeling dumb... insights most welcome!

THANKS!
Pete
Sponsor
Loophole
DD-WRT Novice


Joined: 02 Mar 2020
Posts: 8

PostPosted: Wed Feb 17, 2021 14:45    Post subject: Re: Dumb Q2: How to get DHCP IP's w/ bridged VLAN+VAP? Reply with quote
MrPete wrote:


QUESTIONS

a) When I create the bridge, it wants me to assign an IP. Doesn't that 'break' obtaining it via DHCP (and telling the upstream switch/router that I'm here?)

Pete


Please attach screenshots to get a better understanding of your setup.

Look here for DNSmasq and iptable configuration: https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=720863

Additionally, here is my iptable setup.



iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -I FORWARD -i br2 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP

iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`

iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

iptables -I INPUT -i br2 -m state --state NEW -j DROP
iptables -I INPUT -i br2 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p tcp --dport 53 -j ACCEPT

iptables -t mangle -A PREROUTING -s 192.168.1.6 -j TEE --gateway 192.168.1.7
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8719

PostPosted: Wed Feb 17, 2021 17:52    Post subject: Reply with quote
This is a classic case of not fully appreciating the intent of the router as seen by the developer.

YOU are trying to use the router as a layer-2 device (managed switch), whereas the intent (from the developers perspective) is to support a layer-3 device (i.e., routing). As such, the developer treats any new bridge as an IP addressable network interface on the router, w/ its own DHCP server, capable of being firewall'd from other networks, and routable over the WAN.

IOW, you and the developer are solving different problems, and that difference is reflected in what the GUI expects and demands for its proper configuration. Yes, sometimes you can sort of, kind of, w/ some difficulty, make it work as just a managed switch. But again, that's NOT the intent for most third-party firmwares. In some cases (e.g., Merlin), user-defined VLANs, VAPs, and bridges aren't supported at all. And when you do find it (dd-wrt, tomato, etc), it's still designed for the purposes of routing.

All that said, that's not to say you can't make it work as you want, at least sometimes. As you've configured it, the IP/network assigned to the bridge is superfluous. And presumably you have NOT created a DHCP server for it either (those requests will be forwarded upstream to the primary router). But don't be confused by what appear to be oddities (like having to define an IP and network for a given bridge) given what problem the router is intended to solve. Truth be told, a more appropriate device would be a wireless managed switch, and NOT a wireless router (which incidentally has a marginally manageable integrated switch). The former would be more consistent w/ your expectations given its intent is purely switching.

_________________
ddwrt-ovpn-split-basic.sh * ddwrt-ovpn-split-advanced.sh * ddwrt-ovpn-kill-switch.sh (new) * ddwrt-ovpn-watchdog.sh (new) * ddwrt-ovpn-remote-access.sh * ddwrt-ovpn-client-backup.sh * ddwrt-mount-usb-drives.sh
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum