Posted: Mon Jul 05, 2021 17:58 Post subject: Creating a subnet for IoT devices across two VAPs/vlans
I am wanting to seperate my home WAPs into two VAPs for my IoT devices, across two seperate routers. Because I also have several wired IoT devices (mostly Raspberry Pis and a few cameras) I need this VAP extended to two vlans as well, one per router.
The two routers are a Netgear R6250 and a Linksys EA8500.
The R6250 has port 4 assigned to vlan10 and appears to be working on IP 10.1.0.4. The R6250 also has the VAP on wl0.2 with IP 10.1.0.3. Both SSIDs on each router are the same (IoT_Devices)
The EA8500 will has a VAP on wl0.1 with IP 10.1.0.2 w/dhcp server. I need to have it's vlan10 to also be on port 4 with IP 10.1.0.1. This has so far been problematic and out of the scope of this discussion. The EA8500 secondary dhcp server on 10.1.0.x needs to handle dhcp assignments on both VAPs and vlans. Is these even possible?
My coverage area is why I need to have two VAPs, and also the ability to move devices from one side of the house to the other, while still connecting to the same SSID (on different routers) and receiving the same IP address as it had previously before the move.
I have attached a diagram of how I think it should work. I might even be really over thinking this and perhaps there is a much easier way to do it. Because my house is sided with aluminum siding, signals cannot get out, or into the house. The R6250 is wired and in the garage, on the other side of the house and will be used for about half of my IoT devices, including those which are outside. _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
Made some modifications. Here is how it is configured now:
Edit: Updated 2021-07-08 _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
Forum member #248
Last edited by lexridge on Thu Jul 08, 2021 11:03; edited 1 time in total
As per a suggestion in another thread, I have tagged these two vlan10s, one per router. Before tagging them, I was able to ping both sides of the routers on 10.1.0.1 and 10.1.0.5 respectively. Now that they are tagged, plugging them into the switch causes a devastating network loop.
My diagrams above only shows 1 network switch for simplicity. The R6250 actually runs thru 2 other switches before getting to that master switch, which both ports of the EA8500 are plugged into. To my knowledge, this should not matter, but perhaps there is something funny going on because of the switch hops?
Here is my vlan setup for the EA8500
Code:
swconfig dev eth0 vlan 1 set ports "0t 1 2 3"
swconfig dev eth0 vlan 10 set ports "0t 4t"
swconfig dev eth0 set enable_vlan 10
swconfig dev eth0 set apply
vconfig add eth0 10
ifconfig vlan10 up
#brctl addif br1 vlan10 < -- commented out since apparently not needed.
and the bottom of the output from #swconfig dev switch0 show
Port 0 corresponds to LAN port 4, apparently. I was able to prove this by tagging physical LAN port 3 and it showed up as "1t", so 0=P4, 1=P3, 2=P2, 3=P1, near as I can tell. _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
Joined: 15 Aug 2016 Posts: 223 Location: Melbourne, Australia
Posted: Wed Jul 07, 2021 22:09 Post subject:
lexridge wrote:
... Now that they are tagged, plugging them into the switch causes a devastating network loop.
...
For a clearer picture of your network, I'd make the following suggestions:
Firstly, the Constraints:
1. As your R6250 (R2) runs its own NAT and DHCP, devices behind it should not share same networks as those behind EA8500 (R1). Simply put, it's kinda having two traffic cops directingsametraffic at the same time, independently. Traffic on the network will become chaos. To avoid this nightmare, R2's IP needs to be either:
i) configured on a separate wired VLAN on R1, or
ii) placed in the DMZ of R1.
Either way, devices behind R2 will have different networks than those behind R1.
2. With a switch in between two routers, more complexities come into play. Whether it's a managed/smart or a dumb switch, more options or constraints are added to R2 configurations. The simple approach would be a direct cable connection b/w R1 and R2.
Secondly,
A. For IoT devices behind R1, suggest setting up:
i) 1 x separate VLAN for wired connection, and
ii) 1 x unbridged VLAN for 2.4GHz bandwidth (vAP)
iii) Put the above wired and wireless VLANS on a bridge
The above settings are likely to cover most, if not all, various IoT device needs, down the track.
B. Similar arrangements are repeated on R2. Assumption: IoT devices behind R2 do not need to be linked up to those behind R1.
C. For IoT devices that need to be in same network however (e.g. parts of an integrated setup spreading across your property), you will have to run a cable from the switch, if they can not reach 2.4Ghz signal from R1.
Thirdly, put a static route, on R1, for each network behind R2.
And finally, I'd put guests on an unbridged 5GHz vAP (with AP isolation). On each R1 and R2. Separately, again.
Good luck.
End of my unsolicited advice and free time.
P.S. There may be other ways to setup your network but I am confident of the above setup's working without hiccup.
For a clearer picture of your network, I'd make the following suggestions:
Firstly, the Constraints:
1. As your R6250 (R2) runs its own NAT and DHCP, devices behind it should not share same networks as those behind EA8500 (R1). Simply put, it's kinda having two traffic cops directingsametraffic at the same time, independently. Traffic on the network will become chaos. To avoid this nightmare, R2's IP needs to be either:
i) configured on a separate wired VLAN on R1, or
ii) placed in the DMZ of R1.
Either way, devices behind R2 will have different networks than those behind R1.
The R6250 (R2) only runs a dhcp server on the unbridged Guest VAP on 192.168.5.1. While it is also running a WAP on both bands, it is getting its dhcp from the EA8500 (R1). R1 also has a static route to R2's 192.168.5.1 network. Working well.
DWCruiser wrote:
2. With a switch in between two routers, more complexities come into play. Whether it's a managed/smart or a dumb switch, more options or constraints are added to R2 configurations. The simple approach would be a direct cable connection b/w R1 and R2.
I agree, and this is much easier said than done, but I am researching this presently. There are actually 2 other Netgear switches between R1 and R2 and were not in the diagram. I kept them out for simplicity sake. I have since redrawn that to better illustrate my network layout. But the other switches were required to get to the garage (R2) router because of the distance. Both these switches do have multiple devices plugged into them as well, but should not affect what I am trying to do. See updated diagram above.
DWCruiser wrote:
Secondly,
A. For IoT devices behind R1, suggest setting up:
i) 1 x separate VLAN for wired connection, and
ii) 1 x unbridged VLAN for 2.4GHz bandwidth (vAP)
iii) Put the above wired and wireless VLANS on a bridge
ii) I do not think I can add an "unbridged" VLAN to a bridge.
DWCruiser wrote:
The above settings are likely to cover most, if not all, various IoT device needs, down the track.
B. Similar arrangements are repeated on R2. Assumption: IoT devices behind R2 do not need to be linked up to those behind R1.
C. For IoT devices that need to be in same network however (e.g. parts of an integrated setup spreading across your property), you will have to run a cable from the switch, if they can not reach 2.4Ghz signal from R1.
Well, this the mostly the problem. They DO need to see each other. I have a RPi4 running Home Assistant which needs access to all of them and I was wanting to move it to to 10.1.0.x as well, with a static IP. It connects to the R2 2.4ghz wifi presently (not the Guest), but I plan on hard wiring it soon.
DWCruiser wrote:
Thirdly, put a static route, on R1, for each network behind R2.
And finally, I'd put guests on an unbridged 5GHz vAP (with AP isolation). On each R1 and R2. Separately, again.
I assumed a static route would be required for this at some point, since I am also using one for the 192.168.5.1 Guest network.I have no need for a Guest network on R1 presently.
DWCruiser wrote:
Good luck.
End of my unsolicited advice and free time.
P.S. There may be other ways to setup your network but I am confident of the above setup's working without hiccup.
Thank you for your input. Much appreciated and a lot to take in here. _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
Joined: 15 Aug 2016 Posts: 223 Location: Melbourne, Australia
Posted: Fri Jul 09, 2021 10:45 Post subject:
lexridge wrote:
The R6250 (R2) only runs a dhcp server on the unbridged Guest VAP on 192.168.5.1. While it is also running a WAP on both bands, it is getting its dhcp from the EA8500 (R1). R1 also has a static route to R2's 192.168.5.1 network. Working well.
Sorry, I missed a crucial point: R2 is connected via its LAN port to R1.
lexridge wrote:
...There are actually 2 other Netgear switches between R1 and R2 and were not in the diagram. I kept them out for simplicity sake. ... But the other switches were required to get to the garage (R2) router because of the distance. ...
I'd suggest (at least) smart switches in your case for more granular and better controls.
As far as R2 goes, your switches (in between) simply extend the physical distance to reach it in the garage, if it were me, I would replace them with a pair of MikroTik wireless wire.
Simply point the boxes at each other (in a straight line of sight), power on. And voila, you have an effective 1gbps connection. No configuration needed.
lexridge wrote:
I do not think I can add an "unbridged" VLAN to a bridge.
I added point iii (i.e. the bridge) later on, making the included 'Unbridge' selection redundant in this case. However, it should still work out. Any interface on a bridge will share the bridge's same network. Even though it may carry an IP address from a different network, prior to being placed on the bridge.
lexridge wrote:
...They DO need to see each other. I have a RPi4 running Home Assistant which needs access to all of them and I was wanting to move it to to 10.1.0.x as well, with a static IP. It connects to the R2 2.4ghz wifi presently (not the Guest), but I plan on hard wiring it soon.
I'd suggest (at least) smart switches in your case for more granular and better controls.
As far as R2 goes, your switches (in between) simply extend the physical distance to reach it in the garage, if it were me, I would replace them with a pair of MikroTik wireless wire.
--->see: https://mikrotik.com/product/wireless_wire.
Simply point the boxes at each other (in a straight line of sight), power on. And voila, you have an effective 1gbps connection. No configuration needed.
The Wireless Wire looks like an amazing product and reasonably priced as well. Unfortunately those won't work in my case. Line-of-sight would be impossible.
I have been looking at three TPLink switches to replace what I have. Would these do the trick?
https://www.tp-link.com/us/business-networking/easy-smart-switch/tl-sg108e/ _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
Joined: 15 Aug 2016 Posts: 223 Location: Melbourne, Australia
Posted: Sat Jul 10, 2021 9:47 Post subject:
TP-Link is outside my preferred range of network gears. So I can't answer your question from specific experience.
One thing I want to mention here though.
While the daisy chain, as is, extends your ethernet cable run from R1 to R2 as a convenient and quick fix, it is something a network professional would avoid for optimum network performance and ease of on-going maintenance later.
Firstly, each device, as a link in the daisy chain, represents a potential failure point; Secondly, this makes diagnosis of performance issues or sorting out network problems, more time consuming and harder. And more grey hair. Especially when one starts misbehaving, under stress, in a random fashion.
TP-Link is outside my preferred range of network gears. So I can't answer your question from specific experience.
I never would have considered TP-Link either, but I accidentally ran across them and the reviews were 96% positive, the prices were pretty unbeatable at $26 per 8 port unit and $19 for 5 port units. I ended up ordering three of the eight port switches and two of the 5 port switches. If I hate them, I have 45 days to return them.
DWCruiser wrote:
One thing I want to mention here though.
While the daisy chain, as is, extends your ethernet cable run from R1 to R2 as a convenient and quick fix, it is something a network professional would avoid for optimum network performance and ease of on-going maintenance later.
Firstly, each device, as a link in the daisy chain, represents a potential failure point; Secondly, this makes diagnosis of performance issues or sorting out network problems, more time consuming and harder. And more grey hair. Especially when one starts misbehaving, under stress, in a random fashion.
It will cost you more, down the track. Trust me.
(This is my last post for a while. Cheers).
I 100% agree. This is not standard business practices. But it is a home network after all. One that has been in place for many years already, with dumb switches, and only a few minor issues here and there over the years (minor, but never fun!).
I actually have even more switches than the diagram shows. I didn't even mention the entertainment rack switches, in both the house and the garage. Also both dumb and very old. They could remain without issues I am sure, but I ordered replacements anyway.
With that said, I do happen to have about 300 feet of CAT6 cable from a short lived digital microwave install at the TV station I work for. This is very heavy duty outdoor cable and was on a 250' television tower for about 3 mos. I may end up running it around the garage and to the house to bypass the upstairs switch, when time permits. I would probably need to bury it however, as it is 1.2cm thick black cable that would surely stand out and not hide easily. It also has a ground wire attached to it within it own sheathing, which would not be needed, but easily removed I think. _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
So far I have replaced all three switches with managed switches. I bought two TP-Link TL-SG108E switches and a TP-Link TL-SG105E as well. These support 802.1Q and looping prevention. I created a new diagram as well. Hopefully it is easy enough to understand. So I set up the vlans on the switches as shown in the diagram. I have the routers untagged at the moment because whenever I turn tagging on vlan(s) port 4, it freezes up the switches and I can no longer access the routers unless unplugging both port 4s from the routers. So much for "loop prevention". I find this unlikely to be a ddwrt bug.
Not having any experience with tagging vlans, especially on managed switches, it is most likely user error, for all I know. Anyway, I did NOT tag the vlans on the switches. Not sure if I need too, except on maybe the end points. This should not be this difficult. Something is just not clicking in my head apparently.
EDIT: Updated Network Layout image as of 2021-08-02 _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
Forum member #248
Last edited by lexridge on Mon Aug 02, 2021 13:01; edited 3 times in total
By setting up a tagged trunk, you only need one wire between two units that carry all vlans.
I have three total units/switches to complete the signal path. I have tried passing the routers tags through by making their switch ports members of the vlan (10), turning off the routers tags and creating the tags on the switch ports itself. Also, any time I turn on tagging on R2 port 4 and plug it in, I lose all connections to the router. I have spent hours upon hours trying to make this work to no avail. I am really starting to think what I am trying to do is simply not possible.
I had slightly better progress before purchasing managed switches. At least I could ping the routers port 4 from both ends. I just was not able to make the dhcp pass thru from R1 to R2. Since buying managed switches, I have not even been able to make ping work. No connection whatsoever. Ugh! So frustrating. My last resort is to replace the R6250 (R2) with a Netgear R7800 which I picked up about a month ago. Maybe that will help. I dunno at this point. Vlans on DDWRT are starting to feel like rocket science to me. _________________ Linksys EA8500 (Internet Gateway, AP/VAP) - DD-WRT r53562
Features in use: WDS-AP, Multiple VLANs, Samba, WireGuard, Entware: mqtt, mlocate
Wireless 5ghz only
Netgear R7800 (WDS-AP, WAP, VAP) - DD-WRT r55779
Features in use: multiple VLANs over single trunk port
Linksys EA8500 WDS Station x2 - DD-WRT r55799
Netgear R6400v2 WAP, VAP 2.4ghz only w/VLANs over single trunk port. DD-WRT r55779
OSes: Fedora 38, 9 RPis (2,3,4,5), 20 ESP8266s: Straight from Amiga to Linux in '94, never having owned a Windows PC.
