Detached Networks using VLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 16:08, 30 April 2010 (edit)
Glenn (Talk | contribs)
(catchg)
← Previous diff
Revision as of 03:15, 18 March 2018 (edit) (undo)
Ian5142 (Talk | contribs)
(Formatting, added VLANs Category.)
Next diff →
Line 21: Line 21:
''Note: You don't have to separate all of the ports, remove the sections that don't apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don't want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: '''nvram set vlan0ports="1 2 5*"''', and just delete the sections that apply to '''vlan2'''.''<br> ''Note: You don't have to separate all of the ports, remove the sections that don't apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don't want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: '''nvram set vlan0ports="1 2 5*"''', and just delete the sections that apply to '''vlan2'''.''<br>
2. Text to copy:<br> 2. Text to copy:<br>
 +<pre>
 +nvram set vlan0ports="1 5*"
 +nvram set vlan2ports="2 5*"
 +nvram set vlan3ports="3 5*"
 +nvram set vlan4ports="4 5*"
-----+nvram set rc_startup='
 +#!/bin/ash
 +PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
-nvram set vlan0ports="1 5*"<br>+ifconfig vlan2 <router address on vlan> netmask 255.255.255.0
-nvram set vlan2ports="2 5*"<br>+ifconfig vlan3 <router address on vlan> netmask 255.255.255.0
-nvram set vlan3ports="3 5*"<br>+ifconfig vlan4 <router address on vlan> netmask 255.255.255.0
-nvram set vlan4ports="4 5*"<br>+
-nvram set rc_startup='<br>+ifconfig vlan2 up
-<nowiki>#</nowiki>!/bin/ash<br>+ifconfig vlan3 up
-PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"<br>+ifconfig vlan4 up
-ifconfig vlan2 <router address on vlan> netmask 255.255.255.0<br> 
-ifconfig vlan3 <router address on vlan> netmask 255.255.255.0<br> 
-ifconfig vlan4 <router address on vlan> netmask 255.255.255.0<br> 
-ifconfig vlan2 up<br>+nvram set rc_firewall='
-ifconfig vlan3 up<br>+
-ifconfig vlan4 up<br>+
-'<br>+iptables -I INPUT -i vlan2 -j ACCEPT
-nvram set rc_firewall='<br>+iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT
 +iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT
 +iptables -I FORWARD -i br0 -o vlan2 -j logdrop
-iptables -I INPUT -i vlan2 -j ACCEPT<br>+iptables -I INPUT -i vlan3 -j ACCEPT
-iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i br0 -o vlan2 -j logdrop<br>+iptables -I FORWARD -i br0 -o vlan3 -j logdrop
-iptables -I INPUT -i vlan3 -j ACCEPT<br>+iptables -I INPUT -i vlan4 -j ACCEPT
-iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i br0 -o vlan3 -j logdrop<br>+iptables -I FORWARD -i br0 -o vlan4 -j logdrop
-iptables -I INPUT -i vlan4 -j ACCEPT<br>+nvram commit
-iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT<br>+
-iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT<br>+
-iptables -I FORWARD -i br0 -o vlan4 -j logdrop<br>+
-'<br>+
-nvram commit''<br>+
-----+</pre>
-<br>+
3. Open the web administration of the router by going to it's IP address then:<br> 3. Open the web administration of the router by going to it's IP address then:<br>
4. Administration tab --> Services tab --> Under DNSMasq paste the following: <br> 4. Administration tab --> Services tab --> Under DNSMasq paste the following: <br>
-<br>+<pre>
-----+interface=vlan2
- +dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
-interface=vlan2<br>+
-dhcp-range=<start ip>,<end ip>,<net mask>,<lease time><br>+
interface=vlan3<br> interface=vlan3<br>
-dhcp-range=<start ip>,<end ip>,<net mask>,<lease time><br>+dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan4<br> interface=vlan4<br>
-dhcp-range=<start ip>,<end ip>,<net mask>,<lease time><br>+dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
- +</pre>
-----+
-<br>+
5. Click on "Save Settings"<br> 5. Click on "Save Settings"<br>
6. Setup Tab --> VLANs<br> 6. Setup Tab --> VLANs<br>
<br> <br>
---- ----
- 
Set "Port 2" to "VLAN 2"<br> Set "Port 2" to "VLAN 2"<br>
Set "Port 3" to "VLAN 3"<br> Set "Port 3" to "VLAN 3"<br>
Line 101: Line 93:
[[Category:Lan]] [[Category:Lan]]
[[Category:Traffic moderation]] [[Category:Traffic moderation]]
 +[[Category:VLANs]]

Revision as of 03:15, 18 March 2018

This will separate the ports on the back of your router and allow you to create individual networks that can't see each other but that can still browse the internet.
Note: Anything with < > around it needs supplemental information…
Note: Anything with " " around it needs to be typed exactly as stated, except items in < >…


Assumptions:

1. You have DD-WRT v23 SP2 installed and working to your liking.
2. You know the login and password for web administration.
3. You're running a Microsoft based operating system.

How will this work?

1. First it separates the ports from each other.
2. It activates a DHCP server for each network.
3. We tell the DD-WRT that we have changed the VLANs.

Procedure:

1. Telnet into the router.
Note: You don't have to separate all of the ports, remove the sections that don't apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don't want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: nvram set vlan0ports="1 2 5*", and just delete the sections that apply to vlan2.
2. Text to copy:

nvram set vlan0ports="1 5*"
nvram set vlan2ports="2 5*"
nvram set vlan3ports="3 5*"
nvram set vlan4ports="4 5*"

nvram set rc_startup='
#!/bin/ash
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

ifconfig vlan2 <router address on vlan> netmask 255.255.255.0
ifconfig vlan3 <router address on vlan> netmask 255.255.255.0
ifconfig vlan4 <router address on vlan> netmask 255.255.255.0

ifconfig vlan2 up
ifconfig vlan3 up
ifconfig vlan4 up


nvram set rc_firewall='

iptables -I INPUT -i vlan2 -j ACCEPT
iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan2 -j logdrop

iptables -I INPUT -i vlan3 -j ACCEPT
iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan3 -j logdrop

iptables -I INPUT -i vlan4 -j ACCEPT
iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan4 -j logdrop

nvram commit

3. Open the web administration of the router by going to it's IP address then:
4. Administration tab --> Services tab --> Under DNSMasq paste the following:

interface=vlan2
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan3<br>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan4<br>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>

5. Click on "Save Settings"
6. Setup Tab --> VLANs


Set "Port 2" to "VLAN 2"
Set "Port 3" to "VLAN 3"
Set "Port 4" to "VLAN 4"



7. Click on "Save Settings"
8. Reboot the router.
5. Now test your networks…

A MS-Word document of this with an example can be found at
Detached Networks by Ports.doc

Created by: bordr415