And it's working.. VLAN tagging wasn't quite as tricky as it seemed last time I tried (hints about what I maybe got stuck on last time around below).
So now my AP is plugged directly into the router (via a very long cable) and is running two SSIDs, one (the "home" wifi) is tagged as VLAN 1 , the default VLAN, and the other (the "guest" wifi) is tagged as VLAN 4.
On the router, VLAN1 is fine if tagged... untagged packets are assumed to be VLAN1 when read from a port so the home wifi works just fine.
But VLAN4 needs configuring to tell the router what to do ... namely
- tell the router that not only can all the physical ports carry the default VLAN1 (tagged or untagged - VLAN1 doesn't mind), but that all the physical ports are also allowed to carry VLAN 4 if tagged appropriately
- create VLAN4
- bring VLAN4 up (I put this on it's own subnet but that's not strictly needed I think)
- iptables rules to allow VLAN4 packets out on the WAN
- configure dnsmasq to handle DHCP requests on VLAN4
So the last one first, is just the user config file described above
/jffs/configs/dnsmasq.conf.add
# Add DHCP custom range for VLAN 4 being a private network
#
interface=vlan4
dhcp-range=vlan4,192.168.4.10,192.168.4.200,255.255.255.0,86400s
dhcp-option=vlan4,3,192.168.4.1
dhcp-option=vlan4,6,192.168.4.1,0.0.0.0
The rest can be done with an nat-start script
/jffs/scripts/nat-start
#!/bin/sh
#
/usr/bin/logger "================== NAT START ==================="
robocfg show | grep -i vlan4 > /dev/null 2>&1 || \
(
/usr/bin/logger "========= ROBOCFG"
# lan ports 1-4 assigned to vlan1 when untagged, port 8 is the CPU
robocfg vlan 1 ports "1 2 3 4 8t"
# or all the ports can carry vlan4 if tagged as such
robocfg vlan 4 ports "1t 2t 3t 4t 8t"
/usr/bin/logger "====== VCONFIG"
# Create VLAN4
vconfig add eth0 4 || /usr/bin/logger "VLAN 4 already exists"
/usr/bin/logger "====== IFCONFIG"
# Bring VLAN4 up (note that dnsmasq has already been configured for this address)
ifconfig vlan4 192.168.4.1 netmask 255.255.255.0 up
/usr/bin/logger "======= IPTABLES"
# And set iptables rules for VLAN4 to access the WAN only
# Seems a slight delay here is handy....
sleep 5
iptables -I FORWARD -i vlan4 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o br0 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o vlan4 -m state --state NEW -j DROP
iptables -I INPUT -i vlan4 -j ACCEPT
)
/usr/bin/logger "=================== NAT DONE ==================="
The "logger" lines write messages to the system log and help when you're trying to spot stuff.
Now the only gotcha I found is that without the pause before the iptables commands, VLAN4 didn't work... DHCP requests went unanswered and static IPs didn't work either.
I think, and again I'm making wild guesses only, that while we've brought up VLAN4, it takes a while to settle/initialise, and without the sleep, then the iptables rules are ignored and so VLAN4 packets are dropped as there are no rules for what to do with them.
DHCP seemed to be an issue last time I tried, so perhaps just this "sleep" is all that was needed then.
Anyway, my AP now broadcasts 2 SSIDs, one of which has full access to the internal network, and the other of which hands out a different IP subnet and can only access the WAN, and this AP can now be connected via a cable to service far parts of property.
Hope it helps someone trying to do the same... the forums do seem to have a number of questions about VLANs but not too many success stories.
Now... wonder what else I can use this small managed switch for....
--
Tim
