Switched Ports

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:43, 28 October 2007 (edit)
Carlb (Talk | contribs)
m (Disable LAN ports)
← Previous diff
Revision as of 01:03, 23 January 2008 (edit) (undo)
Wayland (Talk | contribs)
(The Port Numbering Explained)
Next diff →
Line 67: Line 67:
The WLAN interface does not support VLANs. It is, however, usually bridged to vlan0. The WLAN interface does not support VLANs. It is, however, usually bridged to vlan0.
 +It's possible to bridge virtual wireless interfaces to different VLANs [[VLAN Detached Networks each with Wireless and Internet]]
[[Category:English documentation]] [[Category:English documentation]]
[[Category:Basic tutorials]] [[Category:Basic tutorials]]

Revision as of 01:03, 23 January 2008

Usage examples

With an older router, you can make for instance ports 3 and 4 to reside outside the router's NAT. Devices attached to these ports will request an own IP address from the ISP instead of getting a private IP address from your WRT. One might want to have such behaviour when having unsorted firewall issues with a SIP operator.

nvram set vlan0ports="1 2 5*" 
nvram set vlan1ports="0 3 4 5" 
nvram commit 
reboot 

According to the user reports, this is confirmed to work at least with a WRT54GSv1.1 after power cycling the router.

If you want to recover the default settings, write the following within ssh session:

nvram set vlan0ports="1 2 3 4 5*" 
nvram set vlan1ports="0 5" 
nvram commit 
reboot

Disable LAN ports

Another usage would be to disable the LAN ports exept the one that connects you to the rest of the world . You can use your router as an access point and nobody can plug in his network cable to get around your Radius authentication (requested in the German DD-WRT forum http://www.dd-wrt.com/phpBB2/viewtopic.php?p=26821)

Tested with a WRT54G v5

nvram set vlan0ports="3 5*"
nvram set vlan1ports="5"
nvram commit
reboot 

will make only LAN port 1 work. So you can plug in cables to the other ports and try to hijack the internet connection but will not even get to the firewall.

The Port Numbering Explained

The numbers mean the following:

  • WRT54G v4 & WRT54GS v3
0  = port 4
1  = port 3
2  = port 2
3  = port 1
4  = WAN
5  = CPU internal
5* = CPU internal default
  • WRT54G v2/v3 & WRT54GS v1/v2
0  = WAN
1  = port 1
2  = port 2
3  = port 3
4  = port 4
5  = CPU internal
5* = CPU internal default
  • WRT54GL v1.1
0  = port 4
1  = port 3
2  = port 2
3  = port 1
4  = WAN
5  = CPU internal
5* = CPU internal default


The variable vlan0ports equals to the natted LAN side. Correspondently vlan1ports refers to the WAN side, outside the router's internal NAT addressing scheme.

A little extra explanation regarding port 5: the switch that is built in to the router is a 6 port switch. The sixth port (numbered 5) is the only port not connected to an outside connector. Instead, it is directly connected to the et0 interface on the motherboard. Port 5 must be included on any VLAN that must be visible to the CPU. The asterisk (*) signifies that the VLAN it is attached to is the default VLAN: if the switch receives a packet on port 5 that is not tagged it is put into the VLAN where the * is configured. Always make sure this is vlan0.

The WLAN interface does not support VLANs. It is, however, usually bridged to vlan0. It's possible to bridge virtual wireless interfaces to different VLANs VLAN Detached Networks each with Wireless and Internet