VAPs + VLANs

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Author Message
eleanor
DD-WRT Novice


Joined: 17 Mar 2018
Posts: 5

PostPosted: Sat Mar 17, 2018 21:58    Post subject: VAPs + VLANs Reply with quote
Hi,

I've configured my DDWRT by setting the WAN interface to disabled and I've also disabled the DHCP server, so all ports on the router get their IP addresses from external DHCP server. Also the WAN port has been set as LAN port, which makes this router a managed switch (essentially). This works fine for both wired and wireless networks.

However, now I would like to segment the router's network as follows:

- VLAN 2: All the LAN ports + "mywifi" ESSID (wireless aP)
- VLAN 3: Only "mywifi-guest" ESSID (wireless AP)

This would essentially tag every packet sent by clients connected to "mywifi-guest" AP with VLAN 3, while all the other packets are tagged with VLAN 2. This is already configured by the external devices, but I'm having issues with DD-WRT.

So far I've done the following. Note that the LAN PORT 1 is the one that is connected to the VLAN-enabled upstream switch, which provides DHCP and is already configured to support VLAN 2/3 tags.

Code:

# nvram unset vlan0ports
# nvram unset vlan1ports
# nvram set vlan3ports="1t 4 5"
# nvram set vlan2ports="0 1t 2 3 5*"
# nvram show | grep vlan.*ports
vlan3ports=1t 4 5
vlan2ports=0 1t 2 3 5*

root@wifirouter:~# nvram set port0vlans="2 18 19 21"
root@wifirouter:~# nvram set port1vlans="2 3 18 19 21"
root@wifirouter:~# nvram set port2vlans="2 18 19 21"
root@wifirouter:~# nvram set port3vlans="2 18 19 21"
root@wifirouter:~# nvram set port4vlans="3 18 19 21"
root@wifirouter:~# nvram show | grep port.*vlans                                                                                                                                                                                                                                                                                               
port5vlans=0 1 16                                                                                                                                                                                                                                                                                                             
port4vlans=3 18 19 21                                                                                                                                                                                                                                                                                                         
port3vlans=2 18 19 21                                                                                                                                                                                                                                                                                                         
port2vlans=2 18 19 21                                                                                                                                                                                                                                                                                                         
port1vlans=2 3 18 19 21                                                                                                                                                                                                                                                                                                       
port0vlans=2 18 19 21

root@wifirouter:~# nvram commit
root@wifirouter:~# reboot


The problem is that I don't know what to do next in order to be able to tag all packets coming from "mywifi-guest" as VLAN 3 - this also goes for DHCP packets. DHCP packets are forwarded to the upstream network device, which returns different IP addresses based on whether the packets are tagged with VLAN 2 or VLAN 3.

Does anybody know how can I configure the VAPs that work together with VLANs, so that appropriate VLAN is added to packets based on which AP they're connected?
Sponsor
eleanor
DD-WRT Novice


Joined: 17 Mar 2018
Posts: 5

PostPosted: Sun Mar 18, 2018 9:13    Post subject: Reply with quote
Hi,

I've basically set the following:

- br0: eth0 eth1 ath0 ath1 vlan2
- br1: ath0.1 ath1.1 vlan3

The br0 contains the LAN ports and the "mywifi" wireless interfaces (ath0 ath1), while the br1 contains the "mywifi-guest" wireless interfaces (ath0.1 ath1.1). There are two of each for 2.4/5 Ghz.

However, when logging into the router via SSH and issueing the tcpdump command to view the DHCP requests on the mywifi-guest interface, I can see that only DHCP requests are sent, but there are no responses.


Quote:

# tcpdump -i ath0.1 port 67 or port 68 -e -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ath0.1, link-type EN10MB (Ethernet), capture size 262144 bytes

10:17:00.180489 e0:94:67:ec:58:6a > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from e0:94:67:ec:58:6a, length 300
10:17:03.678033 e0:94:67:ec:58:6a > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from e0:94:67:ec:58:6a, length 300
10:17:08.176400 e0:94:67:ec:58:6a > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from e0:94:67:ec:58:6a, length 300


The problem is that the ath0.1 is added to the br1 bridge, which doesn't contain the eth1 interface - this is the interface that is connected to the outside world to obtain the DHCP responses (based on VLAN tags).

Quote:

# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.1491822a67c8 no eth0
eth1
ath0
ath1
vlan2
br1 8000.1491822a67c8 no ath0.1
ath1.1
vlan3


However, the problem goes further, because the DHCP packets are not even VLAN-tagged.

Quote:

# tcpdump -i ath0.1 port 67 or port 68 -e -n -vv
tcpdump: listening on ath0.1, link-type EN10MB (Ethernet), capture size 262144 bytes
10:18:49.141201 e0:94:67:ec:58:6a > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 128, id 15948, offset 0, flags [none], proto UDP (17), length 328)
0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from e0:94:67:ec:58:6a, length 300, xid 0x4f308724, secs 768, Flags [none] (0x0000)
Client-Ethernet-Address e0:94:67:ec:58:6a
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether e0:94:67:ec:58:6a
Hostname Option 12, length 9: "monika-PC"
Vendor-Class Option 60, length 8: "MSFT 5.0"
Parameter-Request Option 55, length 13:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
Router-Discovery, Static-Route, Vendor-Option, Netbios-Name-Server
Netbios-Node, Netbios-Scope, Classless-Static-Route, Classless-Static-Route-Microsoft
Option 252


Therefore, my questions are:

1. How can I get the packets from APs to be VLAN tagged. The "mywifi-guest" should have a VLAN ID 3, while the "mywifi" should have VLAN ID 2. The vlan2 in br0 nad vlan3 in br1 do not VLAN tag the packages that are seen in that bridge.

2. How can I assign the eth1 (external) interface to the br1 bridge. The GUI interface doesn't support assigning eth1 to the br1 also, but I need eth1 in both bridges - since the eth1 must be in the broadcast domain to obtain the DHCP responses (from outside DHCP server).

3. Do I even need multiple bridges: can I just have br0 bridges and assign all interfaces to that bridge - that would essentially solve number 2. above, but not sure how the packets would be VLAN tagged.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12834
Location: Netherlands

PostPosted: Sun Mar 18, 2018 10:16    Post subject: Reply with quote
I must admit I have not studied your post in detail, but if I am correct you are setting up a Virtual Acces Point on a Wireless Access Point ( a simplification of your setup)

For that you always need a source natting rule, something like:
Code:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6856
Location: Romerike, Norway

PostPosted: Sun Mar 18, 2018 11:03    Post subject: Reply with quote
VLAN setup on the switch is very chip-set dependant. Not knowing what chip-set is used, there is no way of guiding you.

You have to post in the hardware dependant forum for your router model i.e Atheros, Marwell or Broadcom.
eleanor
DD-WRT Novice


Joined: 17 Mar 2018
Posts: 5

PostPosted: Sun Mar 18, 2018 11:03    Post subject: Reply with quote
egc wrote:
I must admit I have not studied your post in detail, but if I am correct you are setting up a Virtual Acces Point on a Wireless Access Point ( a simplification of your setup)

For that you always need a source natting rule, something like:
Code:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


Hi, this is not the whole story. This are my current iptables rules:

Quote:

# iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 SNAT 0 -- anywhere anywhere to:192.168.1.6


The following are DHCP packets on "mywifi" ESSID, which is capable of obtaining the IP:

Quote:

# tcpdump -i any -n port 67 or port 68
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
11:56:27.550651 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:27.551516 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:27.552380 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:27.554235 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:27.555297 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:27.556161 IP 192.168.1.1.67 > 192.168.1.71.68: BOOTP/DHCP, Reply, length 300


The following are DHCP packets on "mywifi-guest" ESSID, which does NOT obtain an IP:

Quote:

11:56:41.430691 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:41.431556 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:41.432421 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304
11:56:41.433285 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ec:1f:72:c9:45:90, length 304


Any thoughts?
eleanor
DD-WRT Novice


Joined: 17 Mar 2018
Posts: 5

PostPosted: Sun Mar 18, 2018 11:11    Post subject: Reply with quote
Per Yngve Berg wrote:
VLAN setup on the switch is very chip-set dependant. Not knowing what chip-set is used, there is no way of guiding you.

You have to post in the hardware dependant forum for your router model i.e Atheros, Marwell or Broadcom.


The following chipset is used, namely the model WRT1900acv2: http://downloads.linksys.com/downloads/userguide/1224700993654/MAN_LGS308_LGS318_LGS326_LGS308P_LGS318P_LGS326P_8820-01844_RevB01_EN.pdf
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6856
Location: Romerike, Norway

PostPosted: Sun Mar 18, 2018 11:41    Post subject: Reply with quote
I don't know much about Marvell.

The tagging options in the GUI do work. Otherwise I have not heard of anyone with a successful VLAN set-up on Marvell.

The SWCONFIG utility is present dough.
eleanor
DD-WRT Novice


Joined: 17 Mar 2018
Posts: 5

PostPosted: Sun Mar 18, 2018 12:34    Post subject: Reply with quote
Per Yngve Berg wrote:
I don't know much about Marvell.

The tagging options in the GUI do work. Otherwise I have not heard of anyone with a successful VLAN set-up on Marvell.

The SWCONFIG utility is present dough.


If anyone knows, I would be glad to hear how I can set everything up using GUI (or CLI for that matter). I think - as I've posted above - that VLAN tagging is not even enabled at the current state (I've run tcpdump and there is no indication of VLANs even being used).

As such, I'm interested in whether I should enable "VLAN tagging" in the GUI and what this option even does. There is no clear documentation about what this option is used for.

What can swconfig be used for. I found https://wiki.openwrt.org/doc/techref/swconfig, but not sure how to set VLANs for different ESSIDS with it.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum