openwrt 配置多个lan的详细指南

首先，我们需要了解OpenWRT的基本配置。根据OpenWRT的官方文档，OpenWRT支持多个LAN接口的配置。具体来说，OpenWRT可以配置多个LAN接口，每个接口都可以独立配置IP地址和子网掩码。

OpenWRT的LAN配置是基于网络接口的命名系统的。每个LAN接口都需要一个唯一的名称，例如“eth0”或“eth1”。根据OpenWRT的文档，LAN接口的名称必须以“eth”或“lan”开头。

在OpenWRT的配置文件中，我们可以使用“uci”命令来配置LAN接口。具体来说，我们可以使用“uci set network.eth0.ipaddr=192.168.1.1”命令来设置LAN接口的IP地址。

Expand your knowledge: Dropbox Lan Sync

首先，我们需要准备一个支持 OpenWrt 的路由器。通常，OpenWrt 支持大多数 Broadcom、Atheros 和 Realtek 的路由器。

下载 OpenWrt 的固件。您可以从 OpenWrt 官方网站下载最新的固件。

使用路由器的恢复模式来安装 OpenWrt。具体步骤可能会根据路由器的型号而有所不同。

使用 LuCI 网页界面来配置 OpenWrt。LuCI 是 OpenWrt 的默认网页界面，可以帮助您快速配置路由器。

在 OpenWrt 中，LAN 子网可以通过配置 `lan` 选项来设置。例如，在 `network` 选项中可以设置 LAN 子网的 IP 地址范围。

Discover more: Setup Openwrt Luci Https through Command Line

要配置WAN口和LAN口的信息，我们需要编辑网络配置文件。例如，我们可以将ipaddr改为10.10.1.1，然后将eth0和eth1的定位调换一下，即eth0作为WAN口，eth1作为LAN口。

重启网络后，eth0正常获取到了光明DHCP分配的192的IP了，同时我们设置的LAN为10.10.1.1/24也生效了。这个配置方法可以让我们轻松地配置WAN口和LAN口的信息。

要了解当前的IP情况，我们需要手动回车进入shell控制台。然后我们可以使用以下命令来查看当前的IP情况：

通过这个表格，我们可以清晰地看到当前的网络情况。

下方的包括以下接口，请选择刚才新建到的端口。上面 LAN 口可以变成 WAN 口，或者扩展 WAN 的做法中都有说明，VLAN2 就是 eth0.2，VLAN3 就是 eth0.3，以此类推。

新接口的协议，按照宽带类型选即可，PPPoE 或者 DHCP 之类的。所有接口都添加完之后，测试一下是否能登陆。

在 OpenWrt 中，有几种类型的虚拟网络接口（Virtual Network Interfaces），包括 aliases、VLANs、Stacked VLANs、bridgeds、tunnel interfaces 和 special purpose 等。

具体来说，aliases 是一个过时的方式，用于管理多个 IP 地址/掩码 per 接口，新工具如 iproute2 支持多个地址/前缀 per 接口，但 aliases 仍然支持 backwards compatibility。VLANs 是创建一个单层 2 网络中的多个虚拟网络的方法，需要所有参与的网络卡都支持 IEEE 802.1Q 和正确配置。Stacked VLANs 是一种创建多层 VLAN 的方法，需要 Linux 内核支持 IEEE 802.1ad。

在 OpenWrt 中，可以通过编辑 /etc/config/network 来创建一个新接口，并为其设置一个 IP 地址。这个 IP 地址必须是未使用的，位于主路由器网络子网中。也可以将 option proto static 更改为 option proto dhcp，让主路由器决定 AP 的地址，但从此之后，Access Point 需要一个 DHCP 服务器。

在设备 (Device) 中建立一个网桥，添加 ETH1，非常简单。然后，在接口 (Interface) 中建立 lan2 接口，设置成静态 IP。建立完记得设置 IP 地址、网络段、那些东西，然后不要忘记要加入 DHCP，这样 LAN 插上去才能配发 IP，自然就有网络。

要添加一个新接口，在 OpenWrt 中需要选择一个协议，例如 PPPoE 或 DHCP。新接口的名称可以自己设置，记得住就行。下方的包括以下接口，请选择刚才新建到的端口。上面 LAN 口可以变成 WAN 口，或者扩展 WAN 的做法中都有说明，VLAN2 就是 eth0.2，VLAN3 就是 eth0.3，以此类推。

在 OpenWrt 中，可以通过 VLAN 来隔离不同的网络。通过对数据包中添加 VLAN 的标识来划分不同的网络。tagged（关联）代表这个接口属于这个 VLAN，且发向这个端口的数据包带有 VLAN 标识。untagged（非关联）代表这个口属于这个 VLAN，但发向这个端口的数据包不带 VLAN 标识。关代表这个口不属于这个 VLAN。CPU 同时属于多个 VLAN，都要设置成 tagged（关联），否则 CPU 就无法区分数据包属于哪个 VLAN。连接用户设备的那端就设置成 untagged（非关联）。一个接口只能设置一个 untagged，所以其他 VLAN 上要设置成关。

如果想要将其中一个 LAN 口变成 WAN 口，需要在 VLAN 1 中设置成关，在 VLAN 3 中设置成 untagged（非关联），VLAN 3 的 CPU 那一项设置成 tagged（关联）即可。

A unique perspective: Samsung Galaxy S Duos 3

OpenWrt allows you to implement network isolation through its built-in firewall policy. To do this, navigate to the OpenWrt Web control panel and select "Network" > "Firewall" > "Traffic Rules".

You can add a new rule by scrolling to the bottom and clicking on the "+" button. The rule details specify that when the 10.10.1.0/24 network segment tries to access the 192.168.1.0/24 network segment, OpenWrt should drop the packet.

Save and apply the firewall policy configuration changes.

High availability is crucial for a reliable network setup.

To achieve high availability, you can create another OpenWrt virtual machine.

By duplicating the image and modifying the name, image name, and VNC port, you can create a redundant setup.

After logging in to the second OpenWrt, you can modify its IP address to 10.240.4.225.

Adding a default route to both OpenWrt instances is also essential.

Modifying the DNS settings ensures that both machines are aware of each other's presence.

For another approach, see: Openwrt Build System Setup

Installing keepalived on both OpenWrt instances allows for seamless failover.

Configuring keepalived involves modifying the /etc/config/keepalived and /etc/keepalived/keepalived.conf files.

After configuring keepalived, you can verify that the virtual IP address is available by pinging it from a computer.

The main router's IP address is 10.240.4.224/24, while the backup router's IP address is 10.240.4.225/24.

If you stop the keepalived service on the main router, the virtual IP address will be lost, but the backup router will automatically take over.

However, if you restart the keepalived service on the main router, the virtual IP address will be re-established, and the backup router will lose its virtual IP address.

You can test the high availability setup by disconnecting either router and verifying that the virtual IP address remains reachable.

Take a look at this: Openwrt Travel Router

OpenWrt's firewall is a powerful tool that allows you to control incoming and outgoing traffic on your network.

The firewall is implemented using the netfilter kernel module and the iptables management tool, which is similar to the Linux firewall.

To enable the firewall, you need to restart it by running the command: /etc/init.d/firewall restart.

The firewall configuration file is located at /etc/config/firewall, and it controls NAT, DMZ, and firewall rules.

To view the current iptables rules, use the command: iptables -n -L.

The firewall configuration file has several sections, including a default parameter section that sets the default behavior for incoming and outgoing traffic.

The default parameter section includes options such as syn_flood, which enables or disables the prevention of SYN flood attacks, and disable_ipv6, which disables IPv6 firewall rules.

The config section defines a zone, which is a group of interfaces that can be used as the source or destination for forwarding, rules, and redirects.

A zone can be set up to allow or block traffic to specific ports or hosts, and it can be used to implement NAT and MSS Clamping.

The rule section defines a specific rule for allowing or blocking traffic, and it includes options such as name, target, src, dest, proto, and family.

A unique perspective: Upgrade Openwrt from Command Line

The redirect section is used to set up port forwarding, which allows external traffic to be redirected to a specific internal host.

The DMZ (demilitarized zone) is a separate network area that can be used to host public-facing servers, such as web servers and FTP servers.

To set up a DMZ, you can create a redirect rule that forwards all incoming traffic from the WAN to a specific internal host.

For example, you can create a redirect rule that forwards all incoming traffic from the WAN to 192.168.1.2.

The iptables command can be used to modify the firewall rules, and it includes options such as DNAT (destination NAT) and SNAT (source NAT).

However, be aware that modifying the firewall rules using iptables will take effect immediately, while modifying the firewall configuration file using uci requires a reload of the firewall.

You can enable bonding on OpenWRT by installing necessary packages.

To create a bond interface, add the following configuration to your automatic start-up script, modifying the network interface names as needed (e.g. eth0 and eth1 for the two interfaces you want to aggregate).

You can also configure bonding through the LUCI interface under Network -> Interfaces -> Add new interface -> New interface protocol -> Bonding (Channel Bonding).

To configure the IP and routing for the bonded interface, you'll need to modify the WAN or LAN interface accordingly.

See what others are reading: Openwrt Interface

Configuring VLANs on OpenWrt allows you to create multiple virtual LANs on a single physical interface.

To create a VLAN, navigate to the "接口" page and switch to the "设备" tab, then click the "添加设备配置" button to add a new "网桥设备".

You can also edit the existing "br-lan" device by clicking the "配置" button next to it.

In the "常规设备选项" section, change the "网桥端口" to eth0, which will make all eth0 ports go through this bridge.

Enabling VLAN filtering and adding VLANs 101 and 1000 on the "网桥VLAN过滤" tab will allow you to send data with these VLAN IDs from eth0 with a VLAN tag.

Two software VLAN devices, br-lan.1000 and br-lan.101, will be automatically created and visible on the "设备" page.

Intriguing read: Wake on Lan Openwrt

So you want to know the summary of configuring multiple LANs on OpenWRT? Let's break it down.

The loopback device is usually configured as lo, which points to 127.0.0.1.

You can have multiple physical network cards, like eth0, eth0.1, or eth0.2, which are essentially virtual devices created from the first one.

The br-lan device is a virtual one that acts as a bridge for LAN ports, allowing multiple physical or virtual network interfaces to appear as one. This is commonly used on routers to bridge wired LAN ports and wireless interfaces.

If your router has two physical network cards, eth1 is usually used as the WAN port.

WLAN0 and WLAN1 are typically used for 2.4G and 5G WIFI connections respectively, which are grouped into VLANs.

The br-lan configuration can be checked using the command `brctl show`, which will show you the devices that are being bridged together.

Here's a summary of the devices we've covered: