Okay, I tried two configurations. After the last update the my initial configuration with having vlan filtering enabled on a device and then using the device with and without vlan didn’t apply anymore (not that it worked in the first place).
The default configuration doesn’t have the iot
network and works fine for all devices connected to br-lan and W1-W3.
config interface 'loopback'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
option device 'lo'
config globals 'globals'
option ula_prefix 'xxx::/48'
config interface 'lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '172.22.1.254'
option delegate '0'
option device 'br-lan'
config interface 'wan'
option proto 'dhcp'
option ipv6 '0'
option device 'eth2'
config interface 'wan6'
option noserverunicast '1'
option proto 'none'
option device '@wan'
config interface 'guest_turris'
option enabled '0'
option proto 'static'
option ipaddr '10.111.222.1'
option netmask '255.255.255.0'
option device 'br-guest_turris'
config device 'br_lan'
option name 'br-lan'
list ports 'lan0'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
option type 'bridge'
config device 'br_guest_turris'
option name 'br-guest_turris'
option bridge_empty '1'
list ports 'guest_turris_0'
list ports 'guest_turris_1'
option type 'bridge'
config wifi-device 'radio0'
option type 'mac80211'
option country 'DE'
option txpower '14'
option macaddr 'xxx'
option channel 'auto'
option hwmode '11a'
option htmode 'VHT80'
option cell_density '0'
config wifi-device 'radio1'
option type 'mac80211'
option hwmode '11g'
option htmode 'HT40'
option txpower '19'
option country 'DE'
option macaddr 'xxx'
option channel '11'
option cell_density '0'
config wifi-iface 'wifinet0'
option device 'radio1'
option network 'lan'
option mode 'ap'
option disabled '0'
option ssid 'W1'
option key 'xxx'
option ieee80211w '1'
option encryption 'psk2+ccmp'
option hidden '0'
option wpa_group_rekey '86400'
config wifi-iface 'guest_iface_1'
option device 'radio1'
option ssid 'W3'
option encryption 'psk2'
option mode 'ap'
option network 'lan'
option key 'xxx'
config wifi-iface 'wifinet1'
option device 'radio0'
option mode 'ap'
option ssid 'W2'
option key 'xxx'
option encryption 'psk2+ccmp'
option wpa_group_rekey '86400'
option network 'lan'
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'W4'
option ieee80211w '1'
option key 'xxx'
option encryption 'psk2'
I then added the vlans with tag 1 and 9. 1 is the “default” one that should make the switch ports behave as if there was no vlan, therefore it’s untagged. 9 is the vlan that is supposed to connect the lan port 4 and wifi W4 with the iot
network:
config interface 'loopback'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
option device 'lo'
config globals 'globals'
option ula_prefix 'xxx::/48'
config interface 'lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '172.22.1.254'
option delegate '0'
option device 'br-lan.1'
config interface 'wan'
option proto 'dhcp'
option ipv6 '0'
option device 'eth2'
config interface 'wan6'
option noserverunicast '1'
option proto 'none'
option device '@wan'
config interface 'guest_turris'
option enabled '0'
option proto 'static'
option ipaddr '10.111.222.1'
option netmask '255.255.255.0'
option device 'br-guest_turris'
config device 'br_lan'
option name 'br-lan'
list ports 'lan0'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
option type 'bridge'
config device 'br_guest_turris'
option name 'br-guest_turris'
option bridge_empty '1'
list ports 'guest_turris_0'
list ports 'guest_turris_1'
option type 'bridge'
config interface 'iot'
option proto 'static'
option ipaddr '172.21.1.254'
option netmask '255.255.255.0'
option device 'br-lan.9'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan0:u*'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'
config bridge-vlan
option device 'br-lan'
option vlan '9'
list ports 'lan4:t'
config wifi-device 'radio0'
option type 'mac80211'
option country 'DE'
option txpower '14'
option macaddr 'xxx'
option channel 'auto'
option hwmode '11a'
option htmode 'VHT80'
option cell_density '0'
config wifi-device 'radio1'
option type 'mac80211'
option hwmode '11g'
option htmode 'HT40'
option txpower '19'
option country 'DE'
option macaddr 'xxx'
option channel '11'
option cell_density '0'
config wifi-iface 'wifinet0'
option device 'radio1'
option network 'lan'
option mode 'ap'
option disabled '0'
option ssid 'W1'
option key 'xxx'
option ieee80211w '1'
option encryption 'psk2+ccmp'
option hidden '0'
option wpa_group_rekey '86400'
config wifi-iface 'guest_iface_1'
option device 'radio1'
option ssid 'W3'
option encryption 'psk2'
option mode 'ap'
option network 'lan'
option key 'xxx'
config wifi-iface 'wifinet1'
option device 'radio0'
option mode 'ap'
option ssid 'W2'
option key 'xxx'
option encryption 'psk2+ccmp'
option wpa_group_rekey '86400'
option network 'lan'
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'W4'
option ieee80211w '1'
option key 'xxx'
option encryption 'psk2'
option network 'iot'
With this configuration devices from br-lan.9 can talk to devices in W4. But devices in br-lan.1 CANNOT talk to devices in W1-3 which has worked fine before.
All configurations are generated by luci. I did not change any firewall rules.
In one of my earlier posts I mentioned that br-lan.9
had the bridge
option set while br-lan.1
didn’t. Initially I thought this might be a reason that one works and the other doesn’t. However in this config neither has this option set and it still behaves in the same way.
I hope this clears things up a bit. If you need more information, please ask.