I've managed to figure out enough to be vaguely dangerous when it comes to VLANs for my personal needs, and making it work with Merlin's ASUS builds, and thought I'd post a note in case anyone's interested, or can see a better way, or suggest improvements of where I've done something stupid (ie more "show and tell" than "authoritative tutorial").
Background: Requirement
So I have an RT-N66U which does me fine for the most part, running both normal and guest wifi SSIDs, but in my new house, I also have a garden studio that the wife uses for teaching classes. The wifi doesn't reach that far, but there's power and a single CAT5 running out there already.
She wants normal wifi out there so she can print and stream in-house music etc but the kids in the classes also want wifi, and I don't want to give them access to the home network, so I want to run both normal and guest wifi out there too.
So I tried a wifi repeater, but it doesn't seem to work too well and drops out, and I dislike the idea of losing half the bandwidth. I run the "home" network on the single CAT5 for the wife into a little AP, but I'd like that AP to broadcast multiple SSIDs and then to split the traffic when it gets back into the house... sounds pretty much like VLANs.
Analysis
The cheap little AP I'm using (TP-LINK TL-WA801ND) does support multiple SSIDs, and can apply a VLAN tag to what it sends back for each SSID. So while my "home" network has no VLAN tags (at the moment) I can have a "home" SSID (with VLAN ID 2) and a "guest" SSID (with VLAN ID 5) as long as I can get the ASUS to handle DHCP etc for both and only allow VLAN 5 to access the internet, whereas VLAN 2 can access the internal network too.
The ASUS UI doesn't offer help with VLANs but there are commands available at the command line to do what I need, if only I could figure it out. This basically will involve
So falling back on the great software maxim of "introduce another layer" and "re-use what someone else already has working", I've come up with this
My solution
So TP-LINK also do a nice little 5-port managed switch for very cheap (TL-SG105E). I figure if I run the network cable from the studio (running VLANs to split trafffic) into one port of the managed switch, I can then configure this to effectively split the VLANs out to two separate physical ports, which will NOT be VLAN tagged.
I can then plug the "home" output into the RT-N66U, and the "guest" output either directly into my ISP VDSL modem that sits upstream from my RT-N66U, or even better, I can use existing known-to-work scripts to configure physical port 4 of the ASUS to be a "guest network" (implemented with VLANs entirely within the ASUS router).
So lifted from http://www.snbforums.com/threads/use-lan-port-4-as-private-network.14983/ I have the following script to create an internal VLAN 4 of the traffic on physical port 4
/jffs/scripts/nat-start
#!/bin/sh
# Set up VLAN4 on physical port 4
#
robocfg show | grep -i vlan14 > /dev/null 2>&1 || \
(
# lan ports 1-3 assigned to vlan1
robocfg vlan 1 ports "1 2 3 8t"
# port 4 to vlan4
robocfg vlan 4 ports "4 8t"
#
vconfig add eth0 4
#brctl addif br0 vlan4
#
ifconfig vlan4 192.168.4.1 netmask 255.255.255.0 up
#
iptables -I FORWARD -i vlan4 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o br0 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o vlan4 -m state --state NEW -j DROP
iptables -I INPUT -i vlan4 -j ACCEPT
)
And then this to tell dnsmasq to hand out 192.168.4.* addresses on that port (as opposed to my normal 192.168.1.* addresses)
/jffs/configs/dnsmasq.conf.add
#
# Add DHCP custom range for VLAN 4 being the private network on physical port 4
#
interface=vlan4
dhcp-range=vlan4,192.168.4.100,192.168.4.200,255.255.255.0,86400s
dhcp-option=vlan4,3,192.168.4.1
dhcp-option=vlan4,6,192.168.4.1,0.0.0.0
And then the managed switch, well, the setup is done via the TP-LINK GUI, but basically the port that comes in from the studio is tagged for both VLANs, and each VLAN only has one other member port being untagged and being therefore the physical out port.
Summary
I have an AP that runs two SSIDs and tags traffic from each with a VLAN tag.
I feed that AP into a managed switch which strips the VLAN tag IDs, but physically splits the VLANs out to separate LAN ports.
I then feed the "home" port from that switch into the ASUS router as per normal, and feed the "guest" port from the switch into physical port 4 of the ASUS, which is then configured to internally keep traffic on that port separate (via another VLAN) and only allow it out onto the WAN, but where dnsmasq knows how to handle DHCP requests from that "guest" network too.
If anyone can spot any issues with the above, or suggest how to do it without the managed switch hack, I'm all ears. If the ASUS implemented its guest wifi uses VLANs in the first place (rather than bridge controls) then it might be easier, but while some routers use this technique internally, the ASUS doesn't.
And if anyone has any questions, fire away...
--
Tim
Background: Requirement
So I have an RT-N66U which does me fine for the most part, running both normal and guest wifi SSIDs, but in my new house, I also have a garden studio that the wife uses for teaching classes. The wifi doesn't reach that far, but there's power and a single CAT5 running out there already.
She wants normal wifi out there so she can print and stream in-house music etc but the kids in the classes also want wifi, and I don't want to give them access to the home network, so I want to run both normal and guest wifi out there too.
So I tried a wifi repeater, but it doesn't seem to work too well and drops out, and I dislike the idea of losing half the bandwidth. I run the "home" network on the single CAT5 for the wife into a little AP, but I'd like that AP to broadcast multiple SSIDs and then to split the traffic when it gets back into the house... sounds pretty much like VLANs.
Analysis
The cheap little AP I'm using (TP-LINK TL-WA801ND) does support multiple SSIDs, and can apply a VLAN tag to what it sends back for each SSID. So while my "home" network has no VLAN tags (at the moment) I can have a "home" SSID (with VLAN ID 2) and a "guest" SSID (with VLAN ID 5) as long as I can get the ASUS to handle DHCP etc for both and only allow VLAN 5 to access the internet, whereas VLAN 2 can access the internal network too.
The ASUS UI doesn't offer help with VLANs but there are commands available at the command line to do what I need, if only I could figure it out. This basically will involve
- vconfig to create a new VLAN
- robocfg to configure which physical ports are members of which VLAN, and for each member whether that port should be tagged or untagged with the VLAN ID
- ifconfig to bring the VLAN up
- dnsmasq config to handle DHCP for the VLANs
- iptables to limit the "guest" VLAN to access the internet only
So falling back on the great software maxim of "introduce another layer" and "re-use what someone else already has working", I've come up with this
My solution
So TP-LINK also do a nice little 5-port managed switch for very cheap (TL-SG105E). I figure if I run the network cable from the studio (running VLANs to split trafffic) into one port of the managed switch, I can then configure this to effectively split the VLANs out to two separate physical ports, which will NOT be VLAN tagged.
I can then plug the "home" output into the RT-N66U, and the "guest" output either directly into my ISP VDSL modem that sits upstream from my RT-N66U, or even better, I can use existing known-to-work scripts to configure physical port 4 of the ASUS to be a "guest network" (implemented with VLANs entirely within the ASUS router).
So lifted from http://www.snbforums.com/threads/use-lan-port-4-as-private-network.14983/ I have the following script to create an internal VLAN 4 of the traffic on physical port 4
/jffs/scripts/nat-start
#!/bin/sh
# Set up VLAN4 on physical port 4
#
robocfg show | grep -i vlan14 > /dev/null 2>&1 || \
(
# lan ports 1-3 assigned to vlan1
robocfg vlan 1 ports "1 2 3 8t"
# port 4 to vlan4
robocfg vlan 4 ports "4 8t"
#
vconfig add eth0 4
#brctl addif br0 vlan4
#
ifconfig vlan4 192.168.4.1 netmask 255.255.255.0 up
#
iptables -I FORWARD -i vlan4 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o br0 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o vlan4 -m state --state NEW -j DROP
iptables -I INPUT -i vlan4 -j ACCEPT
)
And then this to tell dnsmasq to hand out 192.168.4.* addresses on that port (as opposed to my normal 192.168.1.* addresses)
/jffs/configs/dnsmasq.conf.add
#
# Add DHCP custom range for VLAN 4 being the private network on physical port 4
#
interface=vlan4
dhcp-range=vlan4,192.168.4.100,192.168.4.200,255.255.255.0,86400s
dhcp-option=vlan4,3,192.168.4.1
dhcp-option=vlan4,6,192.168.4.1,0.0.0.0
And then the managed switch, well, the setup is done via the TP-LINK GUI, but basically the port that comes in from the studio is tagged for both VLANs, and each VLAN only has one other member port being untagged and being therefore the physical out port.
Summary
I have an AP that runs two SSIDs and tags traffic from each with a VLAN tag.
I feed that AP into a managed switch which strips the VLAN tag IDs, but physically splits the VLANs out to separate LAN ports.
I then feed the "home" port from that switch into the ASUS router as per normal, and feed the "guest" port from the switch into physical port 4 of the ASUS, which is then configured to internally keep traffic on that port separate (via another VLAN) and only allow it out onto the WAN, but where dnsmasq knows how to handle DHCP requests from that "guest" network too.
If anyone can spot any issues with the above, or suggest how to do it without the managed switch hack, I'm all ears. If the ASUS implemented its guest wifi uses VLANs in the first place (rather than bridge controls) then it might be easier, but while some routers use this technique internally, the ASUS doesn't.
And if anyone has any questions, fire away...
--
Tim
