Multi-VLAN DHCP stuffed up

paprika27 · August 24, 2020, 10:33am

Hello world,

I have this

root@turris:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd0:5769:6ab9::/48'

config interface 'wan'
        option proto 'pppoe'
        option username '*'
        option password '*'
        option ipv6 'auto'
        option mtu '1492'
        option _orig_ifname 'eth1'
        option _orig_bridge 'false'
        option ifname 'eth1.7'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '5t 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '0 5t'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '1 5t'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option vid '4'
        option ports '2 3 5t'

config interface 'LANoben'
        option proto 'static'
        option ifname 'eth0.2'
        option ipaddr '10.10.10.1'
        option netmask '255.0.0.0'

config interface 'Cam'
        option proto 'static'
        option ifname 'eth0.3'
        option ipaddr '192.168.111.1'
        option netmask '255.255.0.0'

config interface 'DMZ'
        option proto 'static'
        option ifname 'eth0.4'
        option ipaddr '10.111.222.1'
        option netmask '255.255.255.0'

As you can tell, I would like separate zones for seperate vlan on separate ports. Each zone should get an own ip and subnet range and be strongly isolated from each other, the dmz even from among each other. So I wrote this:

root@turris:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option port '0'
        option localservice '1'
        option nonwildcard '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'server'
        option ra 'server'
        list dhcp_option '6,192.168.1.1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'LANoben'
        option leasetime '12h'
        option limit '150'
        option interface 'LANoben'
        option start '10'
        list dhcp_option '6,10.10.10.1'
        option ra 'server'
        option dhcpv6 'server'
        option ra_management '1'
        option force '1'

config dhcp 'Cam'
        option start '100'
        option leasetime '12h'
        option interface 'Cam'
        option limit '2'
        list dhcp_option '6,192.168.111.1'

config dhcp 'DMZ'
        option start '100'
        option limit '150'
        option interface 'DMZ'
        option leasetime '1h'
        list dhcp_option '6,10.111.222.1'
        option force '1'

and this

root@turris:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option network 'lan LANoben'
        option forward 'REJECT'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6 wan2'
        option input 'DROP'
        option forward 'DROP'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config include
        option path '/usr/share/firewall/turris'
        option reload '1'

config include
        option path '/etc/firewall.d/with_reload/firewall.include.sh'
        option reload '1'

config include
        option path '/etc/firewall.d/without_reload/firewall.include.sh'
        option reload '0'

config rule
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config rule 'turris_wan_6in4_rule'
        option enabled '0'

config zone 'dmz'
        option output 'ACCEPT'
        option enabled '1'
        option name 'dmz'
        option input 'REJECT'
        option forward 'REJECT'
        option network 'DMZ'

config forwarding 'guest_turris_forward_wan'
        option name 'dmz to wan forward'
        option dest 'wan'
        option enabled '1'
        option src 'dmz'

config rule 'guest_turris_dns_rule'
        option name 'dmz dns rule'
        option proto 'tcpudp'
        option dest_port '53'
        option target 'ACCEPT'
        option enabled '1'
        option src 'dmz'

config rule 'guest_turris_dhcp_rule'
        option name 'dmz dhcp rule'
        option proto 'udp'
        option src_port '67-68'
        option dest_port '67-68'
        option target 'ACCEPT'
        option enabled '1'
        option src 'dmz'

config redirect 'adblock_dns'
        option name 'Adblock DNS'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option target 'DNAT'

config zone
        option name 'cam'
        option input 'ACCEPT'
        option forward 'REJECT'
        option output 'ACCEPT'
        option network 'Cam'

config forwarding
        option dest 'lan'
        option src 'cam'

config forwarding
        option dest 'wan'
        option src 'cam'

config forwarding
        option dest 'cam'
        option src 'lan'

config forwarding
        option dest 'dmz'
        option src 'lan'

config redirect
        option enabled '1'
        option target 'DNAT'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option name 'Adblock Guest'
        option src 'dmz'

The behaviour I expect is that, depending on the zone a host connects to, they dynamically get a configuration to use the internet. The behaviour I see instead is

a host known from one zone (and therefore with a dhcp lease) gets the same configuration in a different zone disabling wan access.
an unknown host connecting to the dmz zone gets a configuration from the lan range and is unable to connect to wan until I manually change it.

Could you point out what I’ve misconfigured or could try reinitializing? Many thanks,
P

paprika27 · September 9, 2020, 9:01am

I was hoping for at least one idea.

Maxmilian_Picmaus · September 10, 2020, 9:15pm

I am not so skilled to to provide any hints. ...

But i will try … maybe option type 'bridge' is missing in inteface blocks? I thing that port 6 does not need to be tagged(maybe only if there will be eth2.1 eth2.2 and so on at use)… Also port6 is connected to eth2 on chip (same as eth0 is port5, and wan is eth1, that is kind of fixed) and i do not see eth2 in your configs. And i do not see port4 at use. Maybe it is on purpose (so you are not using eth2/port6 and port4/lan4) …

check that oldish guide …especially that hw schema and notes around it.
https://doc.turris.cz/doc/en/howto/vlan_settings_omnia

paprika27 · September 12, 2020, 8:16am

thanks for your thoughts! I have untagged 6 and bridged all interfaces to no avail. Yes, neither am I using port 4, nor the fibre port 6 at eth2. The .7 vlan tag on wan is required by my isp and not the issue.
anyway, thanks!

paprika27 · October 14, 2020, 10:08pm

It seems I might have misconfigured the adress ranges:

I now have only /24 subnets (netmask 255.255.255.0 for each interface) and was able to connect a new device to dmz and dynamically obtain a working host configuration.

There seems to be an issue left with devices changing interface / VLAN during dhcp lease. While they get a second configuration, they don’t get online. It’s a less critical issue.