hardtotell
Regular Contributor
I have found that it's necessary to check for the existence of my custom VLAN before creating it because the firmware sometimes does not clear out the Ethernet bridge tables before calling firewall-start.
EXAMPLE:
/jffs/scripts/firewall-start
EXAMPLE:
/jffs/scripts/firewall-start
Code:
# RT-AC68U: create vlan14 only if it does not exist
robocfg show | grep -i vlan14 > /dev/null 2>&1 || \
(
# force LAN port 4 to use the Internet-only Guest Network
# AND allow wired Ethernet Smart TVs on the Guest Network to access the media server
robocfg vlan 1 ports "1 2 3 5t"
robocfg vlan 14 ports "4 5t"
vconfig add eth0 14
ifconfig vlan14 up
brctl addif br0 vlan14
ebtables -t broute -I BROUTING -p IPv4 -i vlan14 --ip-dst 192.168.1.0/24 --ip-proto tcp -j DROP
ebtables -t broute -I BROUTING -p IPv4 -i vlan14 --src aa:bb:cc:dd:ee:ff --ip-dst 192.168.1.1 --ip-proto tcp --ip-dport 8200 -j ACCEPT
ebtables -t broute -I BROUTING -p IPv4 -i vlan14 --src aa:bb:cc:dd:ee:fe --ip-dst 192.168.1.1 --ip-proto tcp --ip-dport 8200 -j ACCEPT
ebtables -t filter -I FORWARD -i vlan14 -o ! eth0 -j DROP
ebtables -t filter -I FORWARD -i ! eth0 -o vlan14 -j DROP
)