[khalfdan]

first off, thank you!!! THIS is what I was looking for. Have been turning inside of my skull wrinkled trying to get this to work based on snippets from 10^6 different guides.

Second: Q: I am failing to entirely grasp the IP tables rules for Force DNS redirect under example 2:

[ho1Aetoo]

These are rules for VAPs (virtual access points / guests WLAN)
if you use a Pi-Hole and configure everything according to example 2 and additionally have configured VAP's.

The rules redirect all port 53 DNS requests to the IP address of the VAP.

On the IP address of the VAP listens dnsmasq
and dnsmasq forwards the requests to the Pi-Hole

Since the VAPs are isolated (network isolation), the clients cannot connect directly to the Pi Hole.


However, the interfaces may have different names depending on the router, firmware version and configuration.

With a current firmware the first VAPs on the mostly routers are called wlan0.1 + wlan1.1 further VAPs are then called wlan0.2 + wlan1.2 and so on.

In former times the WLAN interfaces were called ath0 ath0.1 ath1 ath1.1 etc..

On Broadcom routers the WLAN interfaces are called wl0 wl0.1 wl1 wl1.1 ethx or whatever.

[khalfdan]

alright thanks for that, very helpful!
I have a followup question, which may be due to me not understanding the way ddwrt uses terms bridged and unbridged:

In my setup (I have a netgear r7000 running 50500) I have the "default" setup with 1wan and 3 lan ports + wl0 and wl1 all bridged to br0.

I further have a single LAN port tagged to vlan3 and two virtual (guest) wifi wl0.1 and wl1.1 bridged to br1 and a separate dhcp instance with separate subnet. The VAPs wl0.1 and wl1.1 both have "AP isolation" enabled.

My pihole+unbound is located on the main (br0) network.

My question is: I initially used the setup from example two in the sticky since my VAPs are isolated. However I am struggling to get the vlan3 (isolated lan port) to route DNS queries correctly. Should I be using one of the examples for bridged networks instead despite br1 not including the WAN port?

Sorry if this is a noobie question....

Oh and PS looking at this and this
https://wiki.dd-wrt.com/wiki/index.php/VLAN_Detached_Networks_%28Separate_Networks_With_Internet%29
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322349&highlight=unbridged
makes me think maybe I am simply going a bridge too far (pardon the pun) in trying to include a lan port in the setup and should maybe just stick to VAPs?



thanks a lot


[edit]typos[/edit]

[ho1Aetoo]

But sure this works without problems if you configure it correctly

Startup (should look different for you because you have a different router with a different switch configuration)

[khalfdan]

thank you that's really nice of you to take the time to test that out.
Thing is - I don't understand that first codebox - I assume that has to do with the startup commands section? But how do I figure out the layout of my router (comparative to yours) and is it necessary to do codes or can I just do it via the GUI?
thanks

[ho1Aetoo]

after a factory reset, execute the following command via telnet or ssh

[khalfdan]

ah ok I am understanding a little more of that swconfig thing now here is the output (there are only 1 physical wan and 4 physical lan ports, are the rest virtual or ...?)

[ho1Aetoo]

[khalfdan]

ok here are the results of that (apologies about forgetting the networking tab - didn't give you optimal conditions). It kinda worked. However, it seems to have isolated lan ports 1-3 (I had to plug my pc into lan port 4 to access the router after the changes) so kind of the inverse of the intent?

I have added swconfig output and the network and switch tabs

[edit] Note that the network tab picture is after I removed all br1 references to see if that changed anything; didn't make it better. So I have left it for now.[/edit]

[ho1Aetoo]

mhm actually not.

According to the screenshots port 1 is isolated and 2+3+4 are together.
If 4 works, 2 and 3 should also work.

i also missed in your posts which port exactly to isolate so i just took port1

[khalfdan]

just tested - you're right. Port 1 is unable to access internet 2-4 are together and working

[ho1Aetoo]

which port do you want to isolate?

edit:

or the far more important question, does it work now when everything is fully configured?

if no please post screenshots of the "command tab" and "networking tab"

and what exactly is not working?
do devices connected to port 1 get DHCP addresses in the configured range (e.g. 192.168.3.x) ?

[khalfdan]

ok so status:
the device (TV) on port 1 (prev. port 4) is not getting a dhcp address. Which makes sense, because I haven't created a DHCP instance yet. Previously when setting up a separate DHCP I would do it on interface br1 (having assigned wl0.1 and wl1.1 to it) via the GUI.
From reading the codes, it seems they should have created br1 (brctl xxxx) but I don't see br1 as an option when I attempt to create a new DHCP instance (GUI).

[edit] I do however see eth0 as an option which I don't recall having seen before [/edit]

So essentially, I am almost at the point I was at before (using the GUI I got to the point where I had the two vaps and the lan port all on br1 and receiving dhcp addresses in the same subnet but I was not getting through to pihole or internet and was unsure whether they were properly isolated).

Using the codes I am unsure at which point I can go back to GUI I should say.

[khalfdan]

final part of networking tab

[ho1Aetoo]

Check out the screenshots I posted.
............

you have to create a new bridge via GUI (networking tab) (br1)
to the bridge you have to add the VAPs wl0.1 wl1.1 and the VLAN eth0.3.

For the bridge br1 you have to assign an IP address and enable network isolation and finally add a new DHCP server.

and your firewall rules are also wrong.
you don't need to isolate the bridge if you use the latest firmware (it's enough to enable network isolation in the GUI).
also you need to filter br1 if you use bridged VAP's and not wl0.1 and wl1.1


screenshots and the correct rule for bridged VAPs >>

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1273897#1273897