Multi SSID Multi Tagged VLAN WAP

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
sportsman87620
DD-WRT Novice


Joined: 21 Apr 2010
Posts: 7

PostPosted: Thu Apr 22, 2010 15:08    Post subject: Multi SSID Multi Tagged VLAN WAP Reply with quote
I have spent the last few days fighting with what I thought would be an easy configuration for a WAP. Tried multiple tutorials and google foo and just can't find what I needed. So I hope someone here can give me a hand.

Hardware
WRT54G2 Ver. 1

Configuration Details

I have three tagged VLAN's on a managed switch. VLAN's 8,9,& 10. VLAN 8 is meant for wireless network "Private". VLAN 9 is meant for wireless network "Public". VLAN 10 is a management VLAN.

I am hoping someone can explain to me how to configure ddwrt to broadcast two SSID's with different encryption that are on separate VLAN's. The ddwrt AP doesn't need to run DHCP, DNS, VLAN routing, or traffic policy because I have a separate, more powerful, router doing that already.

It would be nice if ddwrt did not have an IP address on VLAN 8&9 but has a management IP on VLAN 10. It would also be nice to use the WAN port as the trunk port. Neither of these are deal breakers though.


What I configured and where I'm stuck

I put a check in the checkbox to assign the WAN port to the switch. Disabled DHCP and DNS. I setup the "private" wireless network then added a virtual interface and setup the "public" wireless network. Then I configured the security settings for both networks. This is where things get confused for me. I tried configuring separate bridges and attaching the wireless networks to them. I couldn't get that working. I tried using the VLAN's and couldn't seem to get that working correctly either.


I think my biggest problem is I'm getting confused about the logical setup. Do I need to add two bridges? Do I even need to use bridges? Do I configure VLAN's and then put bridges in them or do I configure a bridge then put VLAN's in it? Do I use the VLAN tab to configure the VLAN's or should I be adding a VLAN in the network tab?

Any information that someone can give me will help. Even if it's a small piece it might help me understand the flow better.

Thanks,
Sportsman87620
Sponsor
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Thu Apr 22, 2010 16:07    Post subject: Reply with quote
You need to move at least one physical port into each VLAN you wish to use and then bridge each VLAN with a VAP. I'd start out trying to get the VLAN's to work before doing anything with the VAP's because VLAN's can be a PITA to get working because differing hardware has varying levels of support for VLAN's.

Do not use the "assign WAN port to switch" option because that adds it to the br0 bridge but you're going to be using it as a trunk, just make sure you have the WAN disabled in basic setup. Go to the VLAN page and check the "tagged" box for the WAN port and then check VLAN 8, 9 , and 10 for it. Then move 1 port into each of the VLAN's (leave 1 in VLAN 0 for now!), hit Apply, and then reboot the router for the VLAN's to take affect.

You should now be able to see them listed on the networking page and be able to click unbridged and assign them an IP address. I suggest doing so for all the VLAN's so that you can check that they're actually functioning. You can also temporarily give them DHCP pools using the multiple DHCP section, it'll make your testing a lot easier.

If your VLAN's aren't working at this point then you may need to adjust the nvram variables.
http://www.dd-wrt.com/wiki/index.php/Switched_Ports

If the VLAN's are working then follow this to configure the VAP's and bridge them with the VLAN's.
http://www.dd-wrt.com/wiki/index.php/Multiple_WLANs

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
zebfink
DD-WRT Novice


Joined: 22 Apr 2010
Posts: 3

PostPosted: Thu Apr 22, 2010 21:45    Post subject: Reply with quote
Sportsman....

I am VERY interested in your results because this is EXACTLY what I am also trying to do!

If you get it solved, can you please assist or send me your profile.


Thanks!!


Zeb
zebfink
DD-WRT Novice


Joined: 22 Apr 2010
Posts: 3

PostPosted: Fri Apr 23, 2010 6:09    Post subject: Reply with quote
Sportsman....

I think I found it!

This will more or less do the same thing.
And it should do what I want.

I think it covers what you are looking for too

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=214284&sid=569f4946dc099ed0cc812f913452ff71


Zeb
-------
sportsman87620
DD-WRT Novice


Joined: 21 Apr 2010
Posts: 7

PostPosted: Fri May 21, 2010 15:33    Post subject: Can't seem to get it working Reply with quote
Sorry it took so long for me to reply. I have had things that are much higher priority then this pop up.

So, I followed all of the instructions provided and had great success with most of it. I can get the VLAN's communicating great locally on the switch and they tag and go out to my managed switch flawlessly and everything is working great there. I create two bridges br1 & br2 then two wireless networks and assign wl0.1 to br1 and eth1 to br2. I can ping the bridge IP address when connected to correct wireless network and everything is happy. Unfortunately, it all falls apart past here. When I assign VLAN 8 to br1 and VLAN 9 to br2 the assignments enter fine, save fine, show up after a reboot fine, but never show up in the current bridging table. I for the life of me can't get the bridge to join the VLAN.

I followed all the instructions at http://www.dd-wrt.com/phpBB2/viewtopic.php?p=214284&sid=569f4946dc099ed0cc812f913452ff71 which didn't help. I also followed http://www.dd-wrt.com/wiki/index.php/Multiple_WLANs but couldn't get that working right either. If anyone can give me that last bit of information I know I can get this working.

Thanks,
Sportsman87620
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri May 21, 2010 21:22    Post subject: Reply with quote
Post screenshots of your VLAN and networking pages. What build are you using?
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
sportsman87620
DD-WRT Novice


Joined: 21 Apr 2010
Posts: 7

PostPosted: Thu Feb 16, 2012 20:19    Post subject: Giving it one more attempt Reply with quote
Sorry to bring back a really old post but I have finally decided to give this another attempt. I figure something might have changed. In my original configuration I was using vlan 8, 9, and 10. This has changed to vlan 8, 9, and 15. I noticed that when issuing commands for vlan15 in a telnet session that none of those commands would stick so I am just trying to get vlan 8 and 9 working for right now.

As before I am able to get the VLAN's working correctly using the GUI or telnet, but I am still unable to get a VAP onto the VLAN. I believe that the bridge is what is not working correctly for me.

I am now running build 14929. The screen shots of my configuration are below.

WRT54G2 V1
\u@\h:\w\$ nvram get wl0_corerev
13





When I use the GUI to configure my vlans everything appears to work as I would expect. I can connect to port 2 and get onto VLAN 8 and I can connect to port 3 or 4 and get onto VLAN 9. If I attach to the test9 wireless network I would expect to be on VLAN 9 but I am not.

I did notice that when using the GUI the nvram vlan*ports variables never change. I can see the nvram port*vlans variables get changed but from what I read in http://www.dd-wrt.com/wiki/index.php/Switched_Ports the port*vlans variables only reflect the GUI selections. Are the port*vlans variables the options that control the vlans? I also tried modifying the nvram variables over telnet. That seemed to work just as well as using the GUI to make changes.

Configuration done with GUI
nvram results
\u@\h:\w\$ nvram show|grep vlan.ports
vlan0ports=3 2 1 0 5*
vlan1ports=4 5

\u@\h:\w\$ nvram show|grep port.vlans
port5vlans=0 8 9 16
port3vlans=9 18 19
port1vlans=0 18 19
port4vlans=9 18 19
port2vlans=8 18 19
port0vlans=8 9 16 18 19

\u@\h:\w\$ nvram show|grep vlan.hwname
vlan1hwname=et0
vlan0hwname=et0

Commands given over Telnet
nvram set vlan8hwname=et0
nvram set vlan9hwname=et0

nvram set port0vlans="8 9"
nvram set port2vlans="8"
nvram set port3vlans="9"
nvram set port4vlans="9"
nvram set port5vlans="0 8 9 16"

nvram set vlan0ports="3 5*"
nvram set vlan8ports="2 4t 5"
nvram set vlan9ports="0 1 4t 5"

The other thing that I noticed is that I am having the same issue described here http://svn.dd-wrt.com/ticket/1853. To the best of my knowledge I am not running a k2.6 build. The bin file I downloaded is from ftp://dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/2010/08-12-10-r14929/broadcom/. I am using the micro generic build. Should I be using something different based on my hardware?

Any help that anyone could give me would be greatly appreciated. If anyone knows that there is a newer build that I should try I am willing to try it out.

Thanks again,
Sportsman87620
sportsman87620
DD-WRT Novice


Joined: 21 Apr 2010
Posts: 7

PostPosted: Mon Feb 20, 2012 14:12    Post subject: Reply with quote
If anyone could give me a suggestion on where to look next I really could use a hand getting this working. Even just a firmware recommendation would be helpful.

Thanks,
Sportsman87620
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 02, 2012 22:47    Post subject: Reply with quote
Try connection to the router with telnet/ssh and run this command to be sure that the VLAN interfaces really aren't being added to the bridges:

brctl show

Then try adding these commands to the startup script on the admin->commands page, reboot, and recheck if they're being added to the bridges:

brctl addif br8 vlan8
brctl addif br9 vlan9


If that doesn't work then try a more recent beta build but check the build thread for any particular build before using it to see if there were any major problems with it. The duplicate bridge settings bug was fixed a while ago, and many improvements have been made to VLAN support although mostly to add support for newer routers.

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
sportsman87620
DD-WRT Novice


Joined: 21 Apr 2010
Posts: 7

PostPosted: Fri Mar 30, 2012 20:11    Post subject: WOOHOOO!!! Reply with quote
That was it! Thanks for the help phuzi0n. Adding those two commands in got the vlans added to the bridges. everything else fell into place after that.

Thanks,
Sportsman87620
luv2chill
DD-WRT Novice


Joined: 06 Jul 2008
Posts: 7

PostPosted: Mon Apr 16, 2012 22:41    Post subject: Reply with quote
Pardon me for bumping an old thread, but phuzi0n's first post here is what I used to set up this same scenario on some linksys e3000s. After a few false starts (my fault) it's working great. Depending on which BSSID someone authenticates to, they go onto different VLANs.

A few things I'd appreciate phuzi0n or another knowledgable member to comment on:

1. Is there any way around the requirement to dedicate a wired port to every VLAN you want to assign wirelessly? In my case, one of the VLANs I am using I have set to require 802.1x authentication--including all of the wired ports on my switches. So unless I am understanding this wrong, I will need to assign one of the e3000's wired ports to this VLAN, which would then allow anyone to plug into that port and get on that VLAN without any authentication. While perhaps that's a bit paranoid of me, I would like to know if there's any way to mitigate it or if it's just something I have to accept.

2. When I create the bridge for each VLAN I set up the required IP for each one (each in a different subnet). So say for the example of my Guest VLAN 4 which is in the 192.168.4.0/24 subnet and the bridge IP is 192.168.4.253. When a computer joins the Guest network and receives an IP in that subnet, he is then able to use a web browser to go to 192.168.4.253 and sees the dd-wrt web interface. Is there any way to prevent that? I would prefer the dd-wrt not be configurable from my guest VLAN. Again, paranoid, but wondering if there's anything I can do about it.

3. Similarly, for that guest network, I want to isolate each client that associates from interacting with other clients. I assume I should turn on "AP Isolation" for that BSSID but before doing so I just want to make sure that will accomplish this goal in a VLAN setting or if I need firewall rules instead?

Many thanks for the help. I'm pretty new to all of this but have learned just enough to be dangerous! Smile
Bird333
DD-WRT Guru


Joined: 07 Jun 2006
Posts: 809

PostPosted: Tue Apr 17, 2012 0:54    Post subject: Reply with quote
luv2chill wrote:


2. When I create the bridge for each VLAN I set up the required IP for each one (each in a different subnet). So say for the example of my Guest VLAN 4 which is in the 192.168.4.0/24 subnet and the bridge IP is 192.168.4.253. When a computer joins the Guest network and receives an IP in that subnet, he is then able to use a web browser to go to 192.168.4.253 and sees the dd-wrt web interface. Is there any way to prevent that? I would prefer the dd-wrt not be configurable from my guest VLAN. Again, paranoid, but wondering if there's anything I can do about it.



This iptables command should work for number two
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset

These should cut off other access to the router

/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset

These assume that 'br1' is your guest bridge. I'm not sure about number 3. I don't know if AP isolation works for separate bridges. You might have to use ebtables to keep clients separate.

EDIT: Well apparently I was misinformed. This command should stop access to the gui.
Code:
/usr/sbin/iptables -I INPUT -i br1 -m state --state NEW -j DROP
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Wed Apr 25, 2012 21:59    Post subject: Reply with quote
luv2chill wrote:
1. Is there any way around the requirement to dedicate a wired port to every VLAN you want to assign wirelessly?

2. When a computer joins the Guest network and receives an IP in that subnet, he is then able to use a web browser to go to 192.168.4.253 and sees the dd-wrt web interface. Is there any way to prevent that?

3. Similarly, for that guest network, I want to isolate each client that associates from interacting with other clients. I assume I should turn on "AP Isolation" for that BSSID but before doing so I just want to make sure that will accomplish this goal in a VLAN setting or if I need firewall rules instead?

1 - I'm not entirely sure why I said that but I think it was just for testing purposes due to the sketchy nature of VLAN support at that time. It should work perfectly fine to just use one port as a trunk and have the rest in any VLAN or none at all. However, if people have physical access then they could always unplug the router from your LAN and connect a PC with VLAN tagging into your LAN.

2 - Just alter the commands at the end of the Multiple WLAN guide to block input on each bridge interface and allow access to any particular ports you need to.

3 - IIRC for Broadcom based hardware, AP isolation is actually a "global" setting for the radio despite the GUI options in the VAP sections. ie. you turn it on for the main interface and it affects all VAP's. AFAIK it will prevent access to all of the subnet but I've never checked. Test both behaviors yourself to be sure.

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
luv2chill
DD-WRT Novice


Joined: 06 Jul 2008
Posts: 7

PostPosted: Thu Apr 26, 2012 22:58    Post subject: Reply with quote
Thanks a lot for the replies phuzi0n and Bird333. I will certainly do some further testing regarding #3 and post back my findings.

I have a new question though--hopefully a quickie (and it may just be something I am misunderstanding).

On the Wireless->Basic Settings page where I define the SSID(s) there is a radio button for each one for Bridged/Unbridged. My understanding though is that where you tell dd-wrt what bridge you want to use is in the Setup->Networking tab.

OK so that's great for the BSSIDs I have set up (wl0.1, wl0.2, wl1.1, etc.) but what about just plain wl0 and wl1? The way I have these set up with VLANs is that br0 is bridged to my "management" VLAN, where I don't actually want any wifi clients dumped off. I had hoped I could set up four SSIDs per radio (the main SSID plus three BSSIDs which seems to be the max) for wifi clients to go into four different VLANs (none of which being the management VLAN).

But from what I can tell (at least through the GUI) there's no way to tell dd-wrt that wl0 and wl1 should use any bridge other than br0. Is that by design or a limitation of the hardware, or is it possible to change via CLI and just isn't in the GUI? Or maybe it is possible via the GUI and I've just overlooked it somewhere?

Thinking about it, I guess I could work around this by bridging my management VLAN with something other than br0 and then bridge br0 with one of the other VLANs I was hoping to use. But I guess my question still stands just in case there is some way to change the bridge wl0 and wl1 use.

Many thanks again for your patient answers!
luv2chill
DD-WRT Novice


Joined: 06 Jul 2008
Posts: 7

PostPosted: Thu Apr 26, 2012 23:24    Post subject: Reply with quote
Duhhhhh OK sorry about that I neglected to do enough research.

Apparently wl0 is otherwise known as eth1 and wl1 is otherwise known as eth2. Those are options in the "assign to bridge" section of the GUI so I should be able to move them out of br0/LAN as I had wanted.

If I'm off-base please someone correct me. But otherwise I will give this a shot tonight and see where I get.

Thanks.

Edit: Yup it works fine. I bridged eth1 and eth2 into a different bridge with VLAN4 and now wifi clients on wl0 and wl1 are getting IPs in the proper subnet. Woohoo!
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum