openwrt vlan configuration for home networks

Configuring VLANs on OpenWRT for home networks is a great way to improve network organization and security.

To start, you'll need to access the LuCI web interface on your OpenWRT router. This can usually be done by navigating to the router's IP address in your web browser.

A VLAN is essentially a virtual network, allowing you to segment your network into separate sub-networks. This is useful for isolating devices or networks from each other.

For example, you could create a VLAN for your IoT devices, keeping them separate from your main network.

Consider reading: Openwrt Travel Router

You'll want to change the LAN interface to use an untagged VLAN device instead of the default 'br-lan' device.

The first step is to change the LAN interface over from using 'br-lan' to an untagged VLAN device, 'br-lan.99'. This involves selecting the Software VLAN: br-lan.99 from the Device selection pulldown and pressing "Save" on the dialog.

Mark all boxes "Egress tagged" for columns: lan1, lan3, and lan4. This ensures that any traffic going out of these interfaces will be tagged with VLAN 99.

Recommended read: Openwrt Interface

After making these changes, you'll see three new VLAN 802.1q devices: br-lan.3, br-lan.4, and br-lan.99 in the Devices tab. The LAN interface is now backed by 'br-lan.99', which is a result of the system configuration changes.

To confirm, check the Interfaces tab, where the LAN interface is now backed by 'br-lan.99'. This is reflected in the OS level interfaces, which now show an extra interface 'br-lan.99@br-lan' with the IP address owned by 'br-lan' initially.

Here's a summary of the changes to the network configuration:

These changes will take effect after pressing "Save & Apply" to commit the batch of changes.

To configure bridge and filtering on your OpenWRT device, you'll need to enable bridge VLAN filtering on the device 'br-lan'. This is done by pressing "Configure.." on the 'br-lan' device and checking the box "Enable VLAN filtering" in the "Bridge VLAN filtering" tab.

The next step is to create VLAN IDs. You'll need to press the "Add' button three times to create VLAN ID: 3, 4, and 99. For the lan2 column, leave the rows vlan 3 and 4 empty, but mark the vlan 99 cell as both "Egress untagged" and "Primary VLAN ID".

Readers also liked: Openwrt Bridge Mode

This makes VLAN 99 the default VLAN (PVID), and any untagged packets will be assigned to VLAN 99. It's crucial to note that if you're using wired ethernet to connect to this router, be sure you're now plugged into the second physical ethernet port on the back of the router (lan2).

The second port is the only one that will provide a management connection to your device after applying these changes. Don't press "Save & Apply" on the main page yet, we still need to change the LAN device to use the new VLAN.

To do this, press "Edit" on the LAN interface and select 'br-lan' as the backing device.

Take a look at this: Wake on Lan Openwrt

To add network interfaces in OpenWrt, you can create VLAN interfaces for specific purposes like IOT and Guest networks. This is done by adding new interfaces with specific names, devices, and IP addresses.

For example, to add an IOT VLAN interface, you go to the "Interfaces" tab, press "Add new interface", and set the name to "IOT", device to "br-lan.3", and IPv4 address to "192.168.3.1" with a netmask of "255.255.255.0".

The same process is used to add a Guest VLAN interface, but with the device set to "br-lan.4" and IPv4 address set to "192.168.4.1".

After creating these interfaces, they will appear in the "Interfaces" tab, showing their respective devices and IP addresses.

Here's a list of the new interfaces created:

Note that these new interfaces have not been assigned a firewall zone, which will be done in the next step.

To control communication between networks, we need to configure zones and firewall rules. We want to create three zones: LAN, GuestZone, and IOTZone.

We'll configure the firewall rules to block all connections from the clients, except for DHCP and DNS requests. This will allow clients to be handed an IP address via DHCP and do their DNS resolutions against the OpenWrt router.

The firewall rules will also include ICMP for troubleshooting network connectivity. We'll create two exceptions: one for GuestZone and one for IOTZone.

Intriguing read: Openwrt One

Here are the specific settings for each exception:

We'll also configure the Input=reject setting for both GuestZone and IOTZone. This blocks all traffic back to the router, but we can still allow forward to the wan zone for public internet access.

To configure a guest network, you'll need to add interfaces for IOT and Guest VLAN. This involves creating new VLAN interfaces, setting their IP addresses, and verifying their functionality.

First, create a new interface for the IOT VLAN by adding a new interface with name=IOT, protocol=Static address, and Device=br-lan.3. Then, set its IPv4 address to 192.168.3.1 and netmask to 255.255.255.0.

Next, create a new interface for the Guest VLAN by adding a new interface with name=GUEST, protocol=Static address, and Device=br-lan.4. Set its IPv4 address to 192.168.4.1 and netmask to 255.255.255.0.

After creating these interfaces, you should see them listed in the "Interfaces" section with IPv4 addresses 192.168.3.1/24 and 192.168.4.1/24, respectively.

To test the guest network, connect to the wireless network "OpenWrtGuest" and verify that you receive an IP address in the 192.168.4.0/24 range via DHCP. You should also be able to perform an nslookup to google.com and reach public internet sites.

However, you should not be able to pull up Luci on the router or the upstream router, and devices on the LAN network should not be able to ping or call services in the Guest network.

Here's a summary of the steps to verify the guest network:

To configure IoT and wireless on your OpenWrt router, you'll want to isolate your Ethernet port for VLAN use. This can be done by editing the br-lan device and unchecking your Ethernet port in the Bridge ports dropdown.

For wireless, you can add your VLAN interface to the Wireless access settings, selecting it from the Network dropdown list to create a guest network.

Adding WiFi to your VLAN is a straightforward process, allowing for Internet isolation or a guest network.

Discover more: Add a Vlan Nad to Openshift

To configure additional interfaces in OpenWRT, you'll need to create VLAN interfaces for IOT and Guest networks. This involves adding new interfaces for IOT=3 and GUEST=4, which will be backed by VLAN devices br-lan.3 and br-lan.4 respectively.

In OpenWRT, you can add new interfaces by going to the "Interfaces" tab and clicking on "Add new interface". From there, you can set the name, protocol, and device for each interface. For the IOT VLAN interface, use name=IOT, protocol=Static address, and Device=br-lan.3.

Similarly, for the GUEST VLAN interface, use name=GUEST, protocol=Static address, and Device=br-lan.4. After creating the interfaces, you'll need to set their IPv4 addresses and netmasks. For the IOT interface, set IPv4 address=192.168.3.1 and IPv4 netmask=255.255.255.0, while for the GUEST interface, set IPv4 address=192.168.4.1 and IPv4 netmask=255.255.255.0.

Here's a summary of the new interfaces:

After creating the interfaces, you'll notice that their boxes are light gray, indicating that they haven't been assigned a firewall zone yet. We'll cover assigning firewall zones in the next section.

You can create VLANs on OpenWRT by using the LuCI web interface or by editing the configuration file directly.

To create a VLAN using LuCI, navigate to the Network > VLAN page, select the interface you want to use, and enter the VLAN ID.

The VLAN ID should be between 1 and 4095, as specified in the VLAN Configuration section.

You can also configure VLANs by editing the configuration file directly, which is useful for more complex setups.

In the configuration file, you can use the "vlan" command to create a new VLAN interface, such as "vlan1" or "vlan2".

The "vlan" command requires the VLAN ID and the parent interface, as shown in the example in the VLAN Configuration section.

You can also set the VLAN mode to "tagged" or "untagged" using the "vlan" command.

Tagged VLANs are used for trunking, while untagged VLANs are used for access ports.

In the VLAN Configuration section, it's mentioned that you can use the "vlan" command to set the VLAN priority.

Consider reading: Setup Openwrt Luci Https through Command Line

The VLAN priority is used to determine the order in which packets are transmitted on the network.

You can also use the "vlan" command to set the VLAN name, which is useful for identifying the VLAN on the network.

In the VLAN Configuration section, it's shown how to set the VLAN name using the "set" command.

To apply the changes, you need to restart the network service, as mentioned in the VLAN Configuration section.

This will ensure that the new VLAN configuration is applied to the network.

For your interest: Upgrade Openwrt from Command Line

The router now has lan3 port tagged for all 3 VLANs. This means it's ready to receive tagged VLAN traffic from the switch.

To configure the WAN, you'll need to set up the interfaces as needed and place them in the "wan" firewall zone. This will ensure that WAN traffic is properly routed through the router.

Add a DHCP server to the router, and consider defining public DNS on the new VLAN 10 and 20 based interfaces temporarily. For example, you can add DHCP server to the lan interface, IoT interface, and Guest interface.

You can now technically click Apply changes, but wait until switch configuration is complete. This will ensure that all changes are properly applied and the network is stable.

Here's an example of how to configure the VLAN-aware switch:

Save changes and return to OpenWrt to apply changes. This will ensure that the switch is properly configured to receive tagged VLAN traffic from the router.

To connect and configure devices on your OpenWRT setup, start by accessing the switch configuration. Click on Network, then Switch, and set Port 2 through to Port 5 as tagged for VLAN 2.

For untagged VLAN traffic, plug into port 4 or 5 on the switch, and you should have access to LUCI within 90 seconds. This is a crucial step to save changes and prevent lockout.

DHCP should now work for all VLANs, but there's more to do. Configure APs to receive tagged VLANs, set specific SSIDs to specific VLANs, and configure firewall rules.

To ensure a smooth setup, keep in mind that one ethernet port should be tagged for all VLANs, while others can remain untagged on the main VLAN.

Additional reading: Openwrt Build System Setup