PaulA
New Around Here
As a newby I have been trying to configure my RT-AX88U-Pro router to isolate a camera system connected to LAN poort 2 from the rest on the LAN, so basically to setup a guestnet which only has access to internet.
Funny enough with Asus stock firmware I can setup a VLAN and configure LAN poort 2 as Access port (untagged), then configure the guestnet with DHCP, etc... but I had to flash my router with Merlin (RT-AX88U_PRO_3004_388.6_2) to be able to configure routed IPTV. After following the manual (https://gathering.tweakers.net/forum/list_messages/1772709/0) this all works nicely, but now I need to use cli (jffs scripts) to setup port isolation myself, this is ok for me but lack of knowledge on this topic (and lack of manuals) got me stuck on this point...
Setup:
- RT-AX88U-Pro running Merlin 3004_388.6_2
- My ISP (KPN) requires 3 VLAN's to be tagged (trunk port); 4=IPTV, 6=Internet, 7=VOIP.
- For now I want to isolate using a seperate bridge; later by adding a VLAN.
So far I have setup a new bridge, attach the eth2 port to it, configure dhcp and enable traffic (iptables), but I think the traffic isn't on VLAN6 so the server gives no response (webpages are not loading properly).
Questions that I have:
1) The IPTV manual requires to set Internet VID to 6 under LAN - IPTV; I believe this is the default VLAN. But where can I see / configure this using cli? Is this per network interface?
2) My router doesn't have robocfg, only ip tool which I can use to link a VLAN, but I believe this is trunk configuration only? How do I configure physical eth ports to become trunk and/or access ports on the cli?
3) More complicated; how can I terminate a VLAN in the router and forward to another VLAN (6)? I.e. without another switch or using 2 physical eth ports? I believe this is possible since Asus guestnet does something similar (501)?
Many thanks for hints/tips in the right direction.
Paul
Funny enough with Asus stock firmware I can setup a VLAN and configure LAN poort 2 as Access port (untagged), then configure the guestnet with DHCP, etc... but I had to flash my router with Merlin (RT-AX88U_PRO_3004_388.6_2) to be able to configure routed IPTV. After following the manual (https://gathering.tweakers.net/forum/list_messages/1772709/0) this all works nicely, but now I need to use cli (jffs scripts) to setup port isolation myself, this is ok for me but lack of knowledge on this topic (and lack of manuals) got me stuck on this point...
Setup:
- RT-AX88U-Pro running Merlin 3004_388.6_2
- My ISP (KPN) requires 3 VLAN's to be tagged (trunk port); 4=IPTV, 6=Internet, 7=VOIP.
- For now I want to isolate using a seperate bridge; later by adding a VLAN.
So far I have setup a new bridge, attach the eth2 port to it, configure dhcp and enable traffic (iptables), but I think the traffic isn't on VLAN6 so the server gives no response (webpages are not loading properly).
Code:
brctl show
bridge name bridge id STP enabled interfaces
br0 8000.c87f54e4f218 no eth1
eth2
eth3
eth4
eth5
eth6
eth7
brctl delif br0 eth2
brctl addbr br77
brctl stp br77 on
brctl stp br0 on
brctl addif br77 eth2
# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.c87f54e4f218 yes eth1
eth3
eth4
eth5
eth6
eth7
br77 8000.c87f54e4f218 yes eth2
# Set up the IPv4 address for the bridge and bring it up
ifconfig br77 192.168.77.1 netmask 255.255.255.240
ifconfig br77 allmulti up
# dnsmasq
interface=br77
dhcp-range=br77,192.168.77.2,192.168.77.14,255.255.255.240,86400s
dhcp-option=br77,3,192.168.77.1
dhcp-option=br77,28,192.168.77.15
service restart_dnsmasq
# iptables
iptables -I INPUT -i br77 -p udp -m udp --dport 53 -j ACCEPT
iptables -I INPUT -i br77 -p udp -m udp --dport 67 -j ACCEPT
iptables -I INPUT -i br77 -p udp -m udp --dport 68 -j ACCEPT
iptables -I FORWARD -i br77 -o vlan6 -j ACCEPT
iptables -I FORWARD -i br77 -o ppp0 -j ACCEPT
Questions that I have:
1) The IPTV manual requires to set Internet VID to 6 under LAN - IPTV; I believe this is the default VLAN. But where can I see / configure this using cli? Is this per network interface?
2) My router doesn't have robocfg, only ip tool which I can use to link a VLAN, but I believe this is trunk configuration only? How do I configure physical eth ports to become trunk and/or access ports on the cli?
3) More complicated; how can I terminate a VLAN in the router and forward to another VLAN (6)? I.e. without another switch or using 2 physical eth ports? I believe this is possible since Asus guestnet does something similar (501)?
Many thanks for hints/tips in the right direction.
Paul