[cbmAlt]

I wanted to document this on the forum because it took me so long to figure out.

I have a Netgear R7000. I can saturate my internet (500Mbps down, 20Mbps up) with dd-wrt, so it's the firmware for me

But I wanted a couple of VLANs and I had to figure out how to do it.

What I wanted:
Main network: 192.168.5.0/24 [ports 1 & 2 on the LAN]
Media VLAN: 192.168.50.0/24 [port 3 on the LAN]
IoT VLAN: 192.168.107.0/24 (107 = IoT) [port 4 on the LAN]

I didn't want the IoT network to be able to access anything on the main network or the media network.

I wanted the media network and the main network to talk to each other freely.

I wanted the media network to use different DNS servers than everything else (uses expressvpn DNS so I can overcome georestrictions)

Here's what I did:

1) Set up the main network to 192.168.5.0/24:
Setup > Basic Setup
Changed Local IP Address to 192.168.5.1, subnet 255.255.255.0

Hit "Apply Settings"

2) Designate the different LAN ports for the VLANs:
Setup > Switch Config

This UI was confusing to me.

Turns out that the columns represent each port on my device (w = WAN, 1-4 are the 4 LAN ports).

The rows are the vlans.

The column on the far left lists the different VLANs. By default, this router came set up with:
vlan0 = nothing checked off, assigned to bridge 'none'
vlan1 = LAN ports 1-4, assigned to bridge "LAN"
vlan2 = WAN port, assigned to bridge "LAN"

I don't know what the "Assigned to bridge" column is for, but what I did was the following:
Port 3, I unchecked from vlan1, and checked onto vlan3, left 'assigned to bridge = None'
Port 4, Unchecked from vlan1, and checked onto vlan4, left 'assigned to bridge = None'
I clicked "Apply Settings".

To summarize, after doing this, the vlans were set up as follows:
vlan0 = no ports selected
vlan1 = LAN ports 1 & 2
vlan2 = WAN port
vlan3 = LAN port 3
vlan4 = LAN port 4

So after doing this, I now know that I want:
vlan1 = ports 1 & 2 = subnet 192.168.5.0/24 (regular network)
vlan2 = internet
vlan3 = port 3 = subnet 192.168.50.0/24 (media)
vlan4 = port 4 = subnet 192.168.107.0/24 (IoT)

3) Assign the VLANs to Bridges
Next I needed to actually make this happen:
Setup > Networking
From here, I noticed that under Bridging was a default bridge named 'br0'
I created 2 new ones: br1 & br2, then clicked "Save"

Then I went to the "Assign to Bridge" section and added 2 assignments:
br1 I assigned to Interface vlan3
br2 I assigned to Interface vlan4

I clicked "Apply Settings"

Now I have:
ports 1 & 2 => br0 => vlan1
port 3 => br1 => vlan3
port 4 => br2 => vlan4

Next I scrolled down to "Port Setup" and found the "Network configuration br1" and "Network configuration br2" sections:

For br1:
Label: media
IP Address: 192.168.50.1
Subnet mask: 255.255.255.0

For br2:
Label: IoT
IP Address: 192.168.107.1
Subnet mask: 255.255.255.0

Clicked "Apply Settings"

Finally, at the bottom of this screen, I went to the DHCPD section
Here I added 3 DHCP servers:
DHCP 0 -> br0
DHCP 1 -> br1
DHCP 2 -> br3

Hit "Apply Settings"

At his point, I have my 3 vlans. Phew!

I tested by plugging a laptop into each port. Ports 1 & 2 assigned an ip in the 192.168.5.x subnet; Port 3 assigned to 192.168.50.x, Port 4 assigned to 192.168.107.x


4) Change the Media subnet to use different DNS servers
Services > Services
Additional Dnsmasq Options:

interface=br1
dhcp-option=br1,6,85.203.37.1,85.203.37.2

(these are the exppressvpn DNS servers, and they will be used by the br1 bridge, which is the vlan3 network)

Applied settings (maybe rebooted router?)

Validated by plugging laptop into Port 3, and I ran from the laptop (in linux):

nmcli dev show | grep DNS

5) Firewall rules so the main & media subnets can communicate and the IoT subnet can only get to the internet:

Administration > Commands

Entered:

iptables -I FORWARD -s 192.168.5.0/24 -d 192.168.50.0/24 -j ACCEPT
iptables -I FORWARD -s 192.168.50.0/24 -d 192.168.5.0/24 -j ACCEPT
iptables -I FORWARD -s 192.168.5.0/24 -d 192.168.107.0/24 -j ACCEPT
iptables -I FORWARD -s 192.168.107.0/24 -d 192.168.5.0/24 -j DROP
iptables -I FORWARD -s 192.168.107.0/24 -d 192.168.50.0/24 -j DROP

Clicked 'Save Firewall"

I don't know iptables that well. As far as I can tell, what I am doing is I'm explicitly telling it to accept traffic from:
192.168.5.0/24 -> 192.168.50.0/24
192.168.50.0/24 -> 192.168.5.0/24
192.168.5.0/24 -> 192.168.107.0/24

And to block traffic from:
192.168.107.0/24 -> 192.168.5.0/24
192.168.107.0/24 -> 192.168.50.0/24


This seems to mostly work. I can ping devices from the '5' to '50' subnet and vice-versa

From '107', I can get to the internet but nowhere else.

The only thing that doesn't work is the '5' network can't ping anything in 107. I figure this is because I don't know iptables well.


So, that's it. I wanted to document because I couldn't find a comprehensive guide anywhere. I'm not an expert in networking and I learned a lot doing this. I hope this helps someone.

[eibgrad]

Thanks for the information.

In general, I don't recommend blocking access based on IP addresses because it's at least theoretically possible for a client to *manually* reconfigure themselves on a different IP network, and *perhaps* get around your restrictions. Since you're using bridges anyway, better to use those network interfaces in your rules. Note, "br+" is a wildcard (it matches any bridge).

[cbmAlt]

Excellent suggestions.

I re-did the iptables commands using the bridge numbers instead as you suggested and all works as intended.

I'll need to look deeper into device discovery, but for the time being, you have me up and running.

Thanks again!

[tomron]

[eibgrad]

[tomron]

[egc]

iptables rules are executed from top to bottom.

Often we use -I to insert the rule at the top instead of -A to append the rule.

Have a look at the iptables wiki:
https://wiki.dd-wrt.com/wiki/index.php/Iptables_command