Turris Omnia - VLAN on TOS 4.x/5.x

So, nobody with some basic example of working vlan on TOS 4.x/5.x? :confused:

Did you search in this forum for „dsa“? I myself posted mupliple replies on this topic here, so there should be plenty of information…

Even though some kind of documentation would be much appreciated as this topic comes up way too often… :slight_smile:

Well maybe I have not understand it. What I want, is some simple example, how should new network, dhcp and firewall config files look like. There is no such example (at least I have not found it) in this forum.

I am just asking how to edit config switch , config switch_vlan and other parts of files (which were working in TOS3.x) to get working simple vlan (in TOS4.x/5.x), but nobody could answer this (maybe simple) question yet. So, if you know how to do it, please, write here some tutorial.

Thanks

There is no Config Switch anymore. Furthermore, in your TOS3 example I don’t see any VLAN used on user side [beside of the default split ports 0 - 3 and port 4].

In my case, I use tagged VLAN2 on lan0 port, and separate network on lan1 port [no need to create VLAN since TOS4]. You can remove IPv6 related stuff if not using it.

network file:

config interface 'lan'
	option type 'bridge'
	option bridge_empty '1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ifname 'lan0 lan2 lan3 lan4'

config interface 'dev'
	option proto 'static'
	option ipaddr '192.168.222.222'
	option netmask '255.255.255.248'
	option ifname 'lan1'
	option ip6assign '64'
	option ip6hint '88'

config interface 'virt'
	option proto 'static'
	option ipaddr '10.1.1.1'
	option netmask '255.255.255.0'
	option ifname 'lan0.2'
	option ip6assign '64'
	option ip6hint 'ff'

dhcp file:

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '100'
	option leasetime '1d'
	list dhcp_option '6,1.1.1.1,8.8.8.8'

config dhcp 'probe'
	option interface 'dev'
	option start '1'
	option limit '2'
	option leasetime '1d'
	list dhcp_option '6,1.1.1.1,8.8.8.8'

config dhcp 'virt'
	option interface 'virt'
	option start '100'
	option limit '100'
	option leasetime '1d'
	list dhcp_option '6,1.1.1.1,8.8.8.8'
	option ra 'server'
	option dhcpv6 'server'
	option ra_management '2'
	list dns '2606:4700:4700::1111'
	list dns '2001:4860:4860::8888'

firewall file:

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan virt dev'

Thank you!

I have edited/added these into my config files according to yours:

network

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option bridge_empty '1'
	list ifname 'lan0'
	list ifname 'lan1'
	list ifname 'lan2'
	list ifname 'lan4'

config interface 'vlan'
	option proto 'static'
	option ipaddr '192.168.4.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list ifname 'lan3'
	option type 'bridge'

dhcp

config dhcp 'vlan'
	option interface 'vlan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	list dhcp_option '6,192.168.4.1'

firewall

config zone
	option name 'vlan'
	list network 'vlan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

But device connected to separated network (vlan) cannot reach internet. It obtains IP from correct range, but I think, I have bad firewall rule or there is missing something…

firewall - add

config forwarding
	option src 'vlan'
	option dest 'wan'

or place VLAN to the same zone as LAN (like I have)

if you do not use IPv6, remove following:

option ip6assign '60'
option dhcpv6 'server'
option ra 'server'
config globals 'globals'
	option ula_prefix 'fde4:1bc5:f8d1::/48'
config interface 'wan6'
	option ifname '@wan'
	option proto 'dhcpv6'
	option noserverunicast '1'

Hi!
I have been reading the entire message to try to understand how to reconfigure the turris omnia router in TOS 4.x / 5.x versions. unable to use swconfig.
I have seen that the Vlan are now controlled with the DSA switch, but I do not see enough information about it to understand it. How can I transfer this configuration to Dsa Switch?
This is my configuration for Turris Omnia that I have been using for 2-3 years Turris OS version 3.xx with 15.05 (Chaos Calmer), with Lan eth0.1, Iptv eth1.2 (incoming tv traffic), Voip eth1.3, Tvlan eth0.4 (isolated tv so it doesn’t flood traffic with mcproxy), wan eth1.6:

config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fda7: 8045: b9e8 :: / 48'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option vid '1'
option ports '1 2 3 5t 6'

config switch_vlan
option device 'switch0'
option vlan '2'
option vid '2'
option ports '4t'

config switch_vlan
option device 'switch0'
option vlan '3'
option vid '3'
option ports '4t'

config switch_vlan
option device 'switch0'
option vlan '4'
option vid '4'
option ports '0 5t'

config switch_vlan
option device 'switch0'
option vlan '6'
option vid '6'
option ports '4t'

config interface 'lan'
option ifname 'eth0.1'
option type 'bridge'
option proto 'static'
option ip6assign '60'
option igmp_snooping '1'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'

config interface 'iptv'
option ifname 'eth1.2'
option proto 'static'
option ipaddr '10 .133.155.92 '
option netmask '255.128.0.0'
option gateway '10 .128.0.1 '
option defaultroute '0'
option peerdns '0'

config interface 'tvlan'
option proto 'static'
option ifname 'eth0.4'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'

config route
option interface 'iptv'
option target '172.16.0.0'
option gateway '10 .128.0.1 '
option netmask '255.240.0.0'

config route
option interface 'voip'
option target '10 .31.255.128 '
option gateway '10 .22.64.1 '
option netmask '255.255.255.224'

config interface 'voip'
option ifname 'eth1.3'
option proto 'dhcp'
option defaultroute '0'
option peerdns '0'

config interface 'wan'
option ifname 'eth1.6'
option proto 'pppoe'
option username 'adslppp @ telefonicanetpa'
option password 'adslppp'
option ipv6 '1'
option mtu '1492'

config interface 'wan6'
option ifname 'wan'
option proto 'dhcpv6'
option noserverunicast '1'

config interface 'vpn_turris'
option ifname 'tun_turris'
option proto 'none'
option auto '1'
option enabled '1'

Thanks

I´d like to have networks separated.

Tomorrow I will try to add forward rule and let know if it works. Thank you.

Well, it goes bit beyond my knowledge. I can say, you will create VLAN only by assigning a physical network interface with .x, such as lan0.1. Therefore if you set it is lan0 it goes out untagged, when lan0.1 then it goes out tagged as VLAN1

How does this work? Is you TV set able to work with VLAN tagged packets?

This VLAN config works. There are a lot of interface in differt VLANS. Now you can set the client to use a particular VLAN and it get an IP and works just fine.

Where I am stuck is how can I say VLAN3 interface lan10.3 is tagged and hands hands dhacp instead of LAN10. On interface LAN10 I always get dhcp from VLAN0. How can I change that ?

config interface ‘loopback’
option ifname ‘lo’
option proto ‘static’
option ipaddr ‘127.0.0.1’
option netmask ‘255.0.0.0’

config globals ‘globals’
option ula_prefix ‘fd11:2a2f:dc25::/48’

config interface ‘wan’
option ifname ‘eth0’
option proto ‘dhcp’
option ipv6 ‘1’

config interface ‘lan’
option type ‘bridge’
option proto ‘static’
option ipaddr ‘192.168.1.1’
option netmask ‘255.255.255.0’
option _turris_mode ‘managed’
option ip6assign ‘60’
option bridge_empty ‘1’
option ifname ‘lan1 lan10 lan11 lan12 lan13 lan14 lan15 lan16 lan2 lan3 lan4 lan5 lan6 lan7 lan8 lan9’

config interface ‘guest_turris’
option enabled ‘1’
option type ‘bridge’
option proto ‘static’
option ipaddr ‘10.111.222.1’
option netmask ‘255.255.255.0’
option bridge_empty ‘1’

config interface ‘wan6’
option ifname ‘@wan
option proto ‘dhcpv6’

config interface ‘LAN3’
option proto ‘static’
option ipaddr ‘192.168.3.1’
option netmask ‘255.255.255.0’
option type ‘bridge’
option dns ‘192.168.3.1’
option ifname ‘lan1.3 lan10.3 lan11.3 lan12.3 lan13.3 lan14.3 lan15.3 lan16.3 lan2.3 lan3.3 lan4.3 lan5.3 lan6.3 lan7.3 lan8.3 lan9.3’

config interface ‘LAN8_DMZ’
option type ‘bridge’
option proto ‘static’
option ipaddr ‘192.168.8.1’
option netmask ‘255.255.255.0’
option ifname ‘lan1.8 lan10.8 lan11.8 lan12.8 lan2.8 lan3.8 lan4.8 lan5.8 lan6.8 lan7.8 lan8.8 lan9.8’

config interface ‘LAN2_IOT’
option type ‘bridge’
option proto ‘static’
option ifname ‘lan1.2 lan2.2 lan3.2 lan4.2’
option ipaddr ‘192.168.2.1’
option netmask ‘255.255.255.0’

The DHCP Service needs to get an idea of the networks structure. The OpenWrt DHCP Service enables for the definition of multiple subnets AND to bind them to a specific network interface.

See “DHCP pools” within DNS and DHCP configuration

And have a look at the samples here: OpenWrt DNS and DHCP conf. samples

Taking this and your configuration details, your /etc/config/dhcp should roughly contain something like

config dhcp ‘LAN3’
option interface ‘LAN3’ # the interface

option start ‘100’ # address pool start inclusive
option limit ‘150’ # address pool end inclusive
list dhcp_option ‘6,192.168.3.1’ # the default router

config dhcp ‘LAN8_DMZ’
option interface ‘LAN8_DMZ’ # the interface

option start ‘100’ # address pool start inclusive
option limit ‘150’ # address pool end inclusive
list dhcp_option ‘6,192.168.8.1’ # the default router

config dhcp ‘LAN2_IOT’
option interface ‘LAN2_IOT’ # the interface

option start ‘100’ # address pool start inclusive
option limit ‘150’ # address pool end inclusive
list dhcp_option ‘6,192.168.2.1’ # the default router

best regards
N.

Thank you ,

DHCP is working if you set the client to the desired vlan, client side tagging.

All interfaces default to VLAN1 (tagged) all the other VLANS are not tagged. What I like to do is to move the interface tag from lan1 to lan1.8 for example.

That is your default or you mean that being the default by the OS? For the latter all DSA ports are in untag state, check with bridge v, e.g. prints

port    vlan ids
lan0     1 PVID Egress Untagged

  • untag state (one VID per each port only)
    bridge v a dev lan1 vid 8 pvid untagged
  • tag state
    bridge v a dev lan1 vid 8 tagged, or
    bridge v a dev lan1 vid 8 pvid tagged

similar operation for a bridge port exchange the device name, e.g. dev lan1 with dev br-LAN2_IOT.

So, I have added this rule and it seems that internet is working finally. :slight_smile: Sorry for that, " my tomorrow " lasted for 27 days… Thank you again!

So, the right way for very simple vlan configuration in my case is (all with unused ipv6):

network

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option bridge_empty '1'
	list ifname 'lan0'
	list ifname 'lan1'
	list ifname 'lan2'
	list ifname 'lan4'

config interface 'vlan'
	option proto 'static'
	option ipaddr '192.168.4.1'
	option netmask '255.255.255.0'
	option ip6assign '60'
	list ifname 'lan3'
	option type 'bridge'
	list dns '192.168.4.1'

dhcp

config dhcp 'vlan'
	option interface 'vlan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	list dhcp_option '6,192.168.4.1'
	option ra_management '1'

firewall

config zone
	option name 'vlan'
	list network 'vlan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config forwarding
	option src 'vlan'
	option dest 'wan'

Hi There,

its driving me mad I am still getting a DHCP address from vlan1 not vlan3 even after setting the pvid to 3 on lan15 and lan15.3

root@turris:/etc/config# bridge v show dev lan15
port vlan ids
lan15 1 Egress Untagged
3 PVID Egress Untagged

root@turris:/etc/config# bridge v show dev lan15.3
port vlan ids
lan15.3 1 PVID Egress Untagged

Any idea how to make this work?

What about these setings?

Interfaces > your_VLAN > Edit > DHCP Server and check that field which I have marked on screenshot (if there is another DHCP on your network, sometimes, it helps).

@michalko58 thank you, did not work.

What I did noticed on a MacOs laptop that the main adaptor got an ip on vlan1 and it also create a vlan adapter which recieved an IP on Vlan 3.

On a linux box I only get a VLAN1 address. I want to lock down the interface to be only on VLAN3.

Is this perhaps a MOX and not a TO since the latter has only 5 LAN ports but not 15?

Secondly, virtual interfaces are not the way for VLAN tag management of DSA ports (switch’s downstream ports).
Any/all VLAN tag management should be undertaken with the bridge v command only. Suggest you remove any all/any of those virtual interfaces on the DSA ports and reboot and then start from there (step by step) with the VLAN tag management.

1 Like