Switched Ports

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:44, 1 September 2018 (edit)
Webbed.Pete (Talk | contribs)
(Introduction - Added references to the GUI VLANS page which usually should be used first. Corrected other info.)
← Previous diff
Revision as of 19:56, 1 September 2018 (edit) (undo)
Webbed.Pete (Talk | contribs)
(Reworked the NVRAM section extensively. Simplified, added detail.)
Next diff →
Line 38: Line 38:
nvram commit nvram commit
-==NVRAM Variables Explained==+==Explaining the connection between Hardware, VLANs, and NVRAM Variables==
-===vlan#ports===+You've saved the existing NVRAM information already, as described above. Right? You DO need that info!
-The vlan'''#'''ports variables are the main variables to configure to place ports into different VLAN's and to enable 802.1q tagging.+ 
 +===Visible Hardware, Internal Ports, and VLANs===
 +First, let's describe how your router hardware is mapped to ports, bridges, ethernet devices, etc. This is also described in [[Default_Configuration_Overview#Illustration_of_port_and_vLAN_mappings]] but lots of people get confused... so we'll make another attempt here.
 + 
 +You have the advantage of the actual NVRAM data for your router, so that helps.
 + 
 +====Switch====
 +Inside the router is a (gigabit or 100mbit) switch with six ports. Five of the ports map to five physical ethernet ports on the router box. One port is internally connected to the CPU.
 + 
 +; CPU Port : First, one of the ports in one of the "vlan*ports" values has an asterisk. That port is either 5 or 8. That's the port number for the invisible backbone trunk between the switch and the ''eth0 device'' that the CPU talks to. We often think of that port as the "CPU" port. We'll use 5(8) sometimes in the documentation because many popular devices use port 5, but others use 8.
 +; Other Ports : This is tricky because it varies by manufacturer and router switch speed. Here's a general rule of thumb that mostly applies but don't be surprised if your situation is different, particularly if you have an unusual router brand. ''At the very least, take note whether or not you have vlan0! This is crucial.''
 +:* ''If you have vlan0:'' probably your WAN port is port 0, and the other ports are 1-4. But it could be the other way around (WAN is internal port 4, other ports are 0-3.) vlan0 is your ''default internal LAN;'' vlan1 is your ''default WAN.''
 +:*'' If you have no vLAN 0:'' probably your WAN port is port 0, and the others are 1-4. vlan1 is your ''default internal LAN;'' vlan2 is your ''default WAN.''
 + 
 +Some examples (no we don't want to list every device here):
 +;WRT54G v2/v3, WRT54GS v1/v2 : CPU port is 5, WAN port is 0 (vlan0 and vlan1?)
 +;WRT54G v4, WRT54GS v3, WRT54GL v1.1 : CPU port is 5, WAN port is 4 (vlan0 and vlan1?)
 +; Netgear R7000 gigabit : CPU is 5, WAN is 0 (vlan1 and vlan2)
 +; Most non-Netgear gigabit : CPU 8, WAN 0
 + 
 +====Network devices at the CPU end====
 +;eth0 device : eth0 is mentioned above. This is what the actual CPU sees when it comes to the switch CPU port (5 or 8).
 +;eth1 device : eth1 connects to the wifi devices. Note that this is not part of the switch, nor do they have port numbers. Below we explain the default bridge (br0) that connects eth1 to the default internal LAN vlan.
 + 
 +====VLANs====
 +VLANs are virtual constructs. They do have meaning, but basically they are a flexible way to accomplish a few simple things:
 +* One or more physical switch ports can be linked to a given vlan. They are isolated from other vlans on the same switch unless bridges or other methods are used to allow a connection.
 +* vlan traffic on one router can be tagged and travel over a single trunk to another router -- and the same vlans are available there. A simple way for traffic to be appropriately connected.
 + 
 +DD-WRT has two default vlans that are mapped to the hardware:
 +; Default internal LAN vLAN : By default your first vLAN (1 or 0) is the internal LAN. By default a bridge (br0) is automagically created to link the WiFi devices (eth1) to this vlan. To break that you may have to do significant custom configuration that may well vary by router brand/etc. This is the default path for untagged packets.
 +; Default WAN vLAN : By default, the second vlan (2 or 1) is the WAN connection. By default packets on this vLAN are also untagged (marked with a "u" next to the CPU port in nvram... see below.)
 + 
 +====A few important notes====
 +* The CPU port must be included in any vlan if that vlan is to be seen by the cpu. Which is basically all the time.
 +* We urge that the default WAN vlan (2 or 1) be reserved for that purpose. If you don't need a WAN function, use other vlan numbers because DD-WRT probably assumes this purpose in various places.
 +* The same is a safe assumption for the default LAN vlan (1 or 0) as well.
 +* We've spent a lot of effort on these low-numbered vlan ID's. The DD-WRT GUI allows you to easily define much higher vlan numbers. And the newest releases support vlan id's as high as 4096, but you have to use those via direct NVRAM configuration as shown below, rather than in the GUI.
 + 
 +===Summary===
 +At this point, we have not explained anything about those interesting NVRAM variables. But you should be able to think about your hardware ports and internal port numbering (and vlan numbering) schemes. And you can now plan how you actually want to configure your vlans for the router.
 + 
 +What you get to play with:
 +;The CPU :
 +* Connects to eth0 which trunks to the internal switch "CPU" port (5 or 8)
 +* Connects to eth1, which trunks to the WiFi devices
 + 
 +;One default bridge :
 +* br0 links eth1 (wifi devices) and the default LAN vlan (vlan1 or vlan0), all untagged
 + 
 +;Two default vlans :
 +* Default LAN vlan (vlan1 or vlan0), by default connecting to all LAN hardware ports (0-3 or 1-4)
 +* Default WAN vlan (vlan2 or vlan1), by default connecting to the WAN hardware port (4 or 0)
 + 
 +;Five switch ports :
 +* 100mbit or gigabit
 +* 0-4 or 4-0... it varies by brand and model
 + 
 +; Available vlan numbers : could be 0-15, 1-16 or even 1-4096 depending...
 + 
 +Whew! OK, now we're ready to tackle the NVRAM variables.
 + 
 +==NVRAM variables--defining the switch and VLANS==
 + 
 +As noted above, the DD-WRT GUI is able to handle properly setting some of these values, for basic configurations. However, if you create new VLANs or reconfigure in any of a number of ways, or make non-default use of these (eg set up a new bridge, etc), you will likely find that things don't fully work correctly unless you ensure all of these NVRAM values are correctly set.
 + 
 +''We don't mean to scare you.'' There are only three sets of VLAN/Port-related NVRAM variables, and they truly are not that hard to set correctly.
 + 
 +Here they are, in quick summary:
 +; vlan#ports : Each vlan is assigned one or more ports plus the CPU port. Default vlan and tagging also specified.
 +; port#vlans : Each port is assigned to one vlan (CPU to all vlans). Plus other per-port settings for speed, duplex, etc.
 +; vlan#hwname : Activates a vlan, ensuring it is properly initialized.
 + 
 +===Required Manual NVRAM Changes===
 +'''VERY IMPORTANT''' For a fully working VLAN Config, you must make the following manual changes (if needed) because the current GUI doesn't do it! Each of these NVRAM variables is explained below.
 + 
 +*''Add'' vlan'''N'''hwname for every VLAN other than the defaults (which already should have these values in your saved entries.) Each one has a value of "et0". ie (if you're adding vlan 103)
 + nvram set vlan103hwname=et0
 +*''Add'' a correct vlan'''N'''ports value for each new VLAN, and correct any existing ones to remove/change ports no longer in those VLANs. Each entry contains the ports in that VLAN, plus the CPU port (5 or 8). Also add tagging (if needed) for the new VLANs. For example, if port 4 is now in VLAN 103 instead of VLAN 1, you might need:
 + nvram set vlan1ports="1 2 3 5*"
 + nvram set vlan103ports="4 5"
 +*''Add'' a correct port'''N'''vlans value, if you're using vlans outside of GUI capabilities (eg more than 16). In our sample case with port 4 now in VLAN 103, we might use:
 + nvram set port4vlans="103 18 19 21"
 + nvram set port5vlans="1 2 103 16"
 +*''Verify'' your changes and save
 +**You have made the changes but they are not yet active nor saved!
 +**Use the above nvram show commands to view your updated settings. Are you sure they're correct? If so, move ahead. Just know that once you commit, your router will follow the new rules, for better or worse
 +**Commit the changes.
 + nvram commit
 + 
 +===NVRAM vlan#ports===
 +The vlan'''#'''ports variables are per-VLAN. They define which ports are assigned to each VLAN, plus other VLAN-specific attributes (default VLAN, 802.1q tagging, and forcing the WAN VLAN to be untagged.)
 + 
 +As noted above,
 +* You must know your CPU internal port number (5 or 8).
 +* Be aware of your default LAN and WAN vlans (1 and 2 or 0 and 1)
With 100 mbps ports, the vlan'''#'''ports variables typically appear like this: With 100 mbps ports, the vlan'''#'''ports variables typically appear like this:
- nvram show | grep vlan.*ports+ nvram show | grep vlan.*ports | sort
vlan0ports=1 2 3 4 5* vlan0ports=1 2 3 4 5*
vlan1ports=0 5 vlan1ports=0 5
With gigabit ports, the vlan'''#'''ports variables may instead appear like this: With gigabit ports, the vlan'''#'''ports variables may instead appear like this:
- nvram show | grep vlan.*ports+ nvram show | grep vlan.*ports | sort
 + vlan1ports=1 2 3 4 5*
 + vlan2ports=0 5u
 +or
 + nvram show | grep vlan.*ports | sort
vlan1ports=1 2 3 4 8* vlan1ports=1 2 3 4 8*
vlan2ports=0 8 vlan2ports=0 8
-*NOTE: '''Some gigabit routers (e.g. Netgear R7000) use port 5 for the CPU, not port 8.''' 
- 
- 
-For 100mbps routers the variable ''vlan0ports'' is the VLAN for LAN ports while ''vlan1ports'' is for the WAN ports. For gigabit routers the variable ''vlan1ports'' is the VLAN for LAN ports while ''vlan2ports'' is for the WAN ports. 
-*Example mapping for WRT54G v4, WRT54GS v3, WRT54GL v1.1:+As noted above, there are default VLANs for the LAN and WAN. They are either
- 0 = port 4+* vlan0ports and vlan1ports
- 1 = port 3+or
- 2 = port 2+* vlan1ports and vlan2ports (there won't be a vlan0)
- 3 = port 1+
- 4 = WAN+
- 5 = CPU internal+
- 5* = CPU internal default+
-*Example mapping for WRT54G v2/v3, WRT54GS v1/v2:+====Other VLAN attributes====
- 0 = WAN+These are suffixes for the final CPU port number.
- 1 = port 1+; "t" : tag with 802.1q vlan header ''(e.g. for trunking).
- 2 = port 2+; "u" : used on WAN vlan, to ensure WAN traffic is ''untagged''.
- 3 = port 3+; "*" : used on default LAN VLAN, untagged incoming traffic goes here.
- 4 = port 4+
- 5 = CPU internal+
- 5* = CPU internal default+
-*Example mapping for some Gigabit routers (but some still use 5 instead of 8 e.g. R7000):+See [[Switched_Ports#802.1q_VLAN_trunk|below]] and [[Switched_Ports#References|References]] for more information.
- [0-4] = Can be ordered forward or reverse, like above+
- 8 = CPU internal+
- 8* = CPU internal default+
-A "t" port number suffix indicates an 802.1q header ''tag'' should be added (e.g. for trunking). Suffix "u" is built into the default configuration (i.e. vlan2ports=0 5u) to ensure traffic to the WAN port is ''untagged''.+===NVRAM port#vlans===
-*See [[Switched_Ports#802.1q_VLAN_trunk|below]] and [[Switched_Ports#References|References]] for more information.+The port'''#'''vlans variables define the vlan for each port, and other per-port attributes.
-===CPU internal port===+Note that each port can only be in one vlan, except that the CPU port is connected to all vlans. ALSO note that ''for this NVRAM variable, the CPU port is always port 5, never port 8.''
-The switch built into 100 mbps routers has 6 ports, with only the sixth port (numbered 5, from 0) not connected externally. It is instead directly connected to the et0 interface. '''On some gigabit routers, the CPU internal port is number 8, but may be port 5.''' If it is 8, the use of ports 5-7 is unknown on these models. The CPU internal port must be included on any VLAN which must be visible to the CPU. The asterisk (*) signifies the default ''single'' VLAN. If the switch receives a packet on the CPU internal port that ''is not tagged'', it goes to the default (*) VLAN, which must be the LAN VLAN.+
-===port#vlans===+By default, then WAN port is connected to the default WAN VLAN (1 or 2), and all other ports are connected to the default LAN VLAN (0 or 1).
-The port'''#'''vlans variables primarily control what the GUI displays and don't seem to have much other effect; however, the ''port5vlans'' variables is important. While the previous vlan'''#'''ports variables contained a list of ports that are in the VLAN, the port'''#'''vlans variables contain a list of VLAN's that the port is in.+
-With 100 mbps ports the port'''#'''vlans variables typically appear like this:+Normally, every port also has one or more additional hardware attributes assigned.
- port0vlans=1+
- port1vlans=0+
- port2vlans=0+
- port3vlans=0+
- port4vlans=0+
- port5vlans=0 1 16+
-With gigabit ports the port'''#'''vlans variables typically appear like this:+==== Port Attributes====
- port0vlans=2+ '''0 or 1 to 15, or even 4096''' This is the VLAN for the port. NOTE that due to the other attributes below, VLANs 16 to 21 are not supported!
- port1vlans=1+ '''16''' '''Tagged'''
- port2vlans=1+ '''17''' NOT Auto-Negotiate. (If #17 is off, you'll get 18, 19, and 21 on a gigabit switch)
- port3vlans=1+ '''18''' = NOT '''forced-100 MBit''' (either Auto-Negotiate is used, or some other speed is forced)
- port4vlans=1+ '''19''' = NOT '''Full-Duplex''' (either Auto-Negotiate is used, or Half-duplex is forced)
- port5vlans=1 2 16+ '''20''' = NOT '''Enabled''' (ie. disabled)
 + '''21''' = NOT '''forced-Gigabit''' (either Auto-Negotiate is used, or some other speed is forced)
-If you've ever pressed the save or apply buttons on the VLANs GUI page then you'll also see 18 and 19 in the values for port[0-4]vlans. The number mapping is as follows:+Some sample attribute settings:
- 0 = VLAN 0 is checked+ 18 19 21 = Auto-negotiate Gigabit
- 1 = VLAN 1 is checked+ 18 19 = Auto-negotiate 100 MBit
- ...+ 17 19 = Force 100 MBit, half-duplex
- 15 = VLAN 15 is checked+ 17 = Force 10 MBit, full duplex (on a 100 MBit router)
- 16 = '''Tagged''' is checked+ 17 18 = Force Gigabit full duplex (on a gigabit router)
- 17 = '''Auto-Negotiate''' is unchecked+ 16 = For some reason, the CPU port is generally given this "tagged" attribute
- 18 = '''100 Mbit''' is unchecked/greyed because Auto-Negotiate '''or Gigabit''' is checked+
- 19 = '''Full-Duplex''' is unchecked/greyed because Auto-Negotiate is checked+
- 20 = '''Enabled''' is unchecked.+
- 21 = Gigabit is unchecked/greyed because Auto-Negotiate is checked+
-The ''port5vlans'' is unusual, as it corresponds to the internal port, regardless of whether you have 100mbit or gigabit ports ('''no''' models have a ''port8vlans'' variable). It is also essential to set it correctly if you are enabling additional VLAN's. It must be set to include every active VLAN and be tagged.+As noted in the quick example above, if we're assigning port 4 to VLAN 103, we would need to set two port'''N'''vlans variables. On a Gigabit router (with WAN port 0) it would look like this:
 + nvram set port5vlans="1 2 103 16"
 + nvram set port4vlans="103 18 19 21"
-For instance, if you had ports in VLAN 1, 2, and 3 then you would set it like so:+===NVRAM vlan#hwname===
- nvram set port5vlans="1 2 3 16"+This ensures each vlan is initialized properly. There must be one for each vlan. '''The gui never adds these variables as of today.''' ''You must do this'' to ensure DD-WRT features all work correctly.
-===vlan#hwname===+So far, the correct value is always "et0"
-These are the simplest variables. If you are enabling additional VLAN's then you simply need to set the vlan'''#'''hwname variables to et0 for each VLAN # you're enabling.+
-For instance, if you were enabling VLAN 3 you would set:+For instance, if you were enabling VLAN 103 you would set:
- nvram set vlan3hwname=et0+ nvram set vlan103hwname=et0
===Finishing up=== ===Finishing up===

Revision as of 19:56, 1 September 2018

Contents

Introduction

This page explains how to finish proper configuration of VLAN's on the router's internal switch (internal and external ports), usually after using the GUI (DD-WRT Setup->VLANS) page.

These instructions are necessary:

  • Only for Broadcom-based routers (as far as we know)
  • For a variety of "basic" setups that are not properly handled in NVRAM by the GUI
  • For advanced setups that the GUI cannot handle at all.

Important: Before you follow the instructions below, DO use the DD-WRT Setup->VLANs page to make your initial configuration changes.

  • If your only changes involve the checkboxes at the bottom of the page (e.g. Auto-Negatiate...Enabled), your job is done!
  • If you need other changes, by setting it up first on the VLANS page, most of your work is already done.
  • While some changes made on the VLANs page do require additional manual configuration, most of the time the GUI takes care of the hard part!

Note: The WLAN is a separate interface from the switch and it does not support VLANs, although it can create virtual interfaces which are similar in some aspects. The WLAN interface is bridged to the LAN VLAN by default. It is possible to bridge VLAN's to different physical or virtual wireless interfaces using Multiple WLANs.

Preserve Settings Before you start

Telnet or SSH to the router (do not use the Commands GUI!) and run these commands to check the nvram variables for your default vlan configuration before you start so that you know the default configuration if you need to revert your changes without hard resetting.

nvram show | grep vlan.*ports | sort
nvram show | grep port.*vlans | sort
nvram show | grep vlan.*hwname | sort

These commands will output a bunch of lines that have a name, an equal sign (=), and then some more text which is the value of the variable like so:

vlan1ports=1 2 5*
vlan2ports=0 5u
...

Save that list!

If you run into trouble, to revert your changes you will have to modify each line in the list and paste it back as follows: put nvram set in front of each line, and encapsulate each value with quotes:

nvram set vlan1ports="1 2 5*"
nvram set vlan2ports="0 5u"
...

Then paste that into the Telnet or SSH command line (to reset those values), and save them permanently:

nvram set vlan1ports="1 2 5*"
nvram set vlan2ports="0 5u"
...
nvram commit

Explaining the connection between Hardware, VLANs, and NVRAM Variables

You've saved the existing NVRAM information already, as described above. Right? You DO need that info!

Visible Hardware, Internal Ports, and VLANs

First, let's describe how your router hardware is mapped to ports, bridges, ethernet devices, etc. This is also described in Default_Configuration_Overview#Illustration_of_port_and_vLAN_mappings but lots of people get confused... so we'll make another attempt here.

You have the advantage of the actual NVRAM data for your router, so that helps.

Switch

Inside the router is a (gigabit or 100mbit) switch with six ports. Five of the ports map to five physical ethernet ports on the router box. One port is internally connected to the CPU.

CPU Port 
First, one of the ports in one of the "vlan*ports" values has an asterisk. That port is either 5 or 8. That's the port number for the invisible backbone trunk between the switch and the eth0 device that the CPU talks to. We often think of that port as the "CPU" port. We'll use 5(8) sometimes in the documentation because many popular devices use port 5, but others use 8.
Other Ports 
This is tricky because it varies by manufacturer and router switch speed. Here's a general rule of thumb that mostly applies but don't be surprised if your situation is different, particularly if you have an unusual router brand. At the very least, take note whether or not you have vlan0! This is crucial.
  • If you have vlan0: probably your WAN port is port 0, and the other ports are 1-4. But it could be the other way around (WAN is internal port 4, other ports are 0-3.) vlan0 is your default internal LAN; vlan1 is your default WAN.
  • If you have no vLAN 0: probably your WAN port is port 0, and the others are 1-4. vlan1 is your default internal LAN; vlan2 is your default WAN.

Some examples (no we don't want to list every device here):

WRT54G v2/v3, WRT54GS v1/v2 
CPU port is 5, WAN port is 0 (vlan0 and vlan1?)
WRT54G v4, WRT54GS v3, WRT54GL v1.1 
CPU port is 5, WAN port is 4 (vlan0 and vlan1?)
Netgear R7000 gigabit 
CPU is 5, WAN is 0 (vlan1 and vlan2)
Most non-Netgear gigabit 
CPU 8, WAN 0

Network devices at the CPU end

eth0 device 
eth0 is mentioned above. This is what the actual CPU sees when it comes to the switch CPU port (5 or 8).
eth1 device 
eth1 connects to the wifi devices. Note that this is not part of the switch, nor do they have port numbers. Below we explain the default bridge (br0) that connects eth1 to the default internal LAN vlan.

VLANs

VLANs are virtual constructs. They do have meaning, but basically they are a flexible way to accomplish a few simple things:

  • One or more physical switch ports can be linked to a given vlan. They are isolated from other vlans on the same switch unless bridges or other methods are used to allow a connection.
  • vlan traffic on one router can be tagged and travel over a single trunk to another router -- and the same vlans are available there. A simple way for traffic to be appropriately connected.

DD-WRT has two default vlans that are mapped to the hardware:

Default internal LAN vLAN 
By default your first vLAN (1 or 0) is the internal LAN. By default a bridge (br0) is automagically created to link the WiFi devices (eth1) to this vlan. To break that you may have to do significant custom configuration that may well vary by router brand/etc. This is the default path for untagged packets.
Default WAN vLAN 
By default, the second vlan (2 or 1) is the WAN connection. By default packets on this vLAN are also untagged (marked with a "u" next to the CPU port in nvram... see below.)

A few important notes

  • The CPU port must be included in any vlan if that vlan is to be seen by the cpu. Which is basically all the time.
  • We urge that the default WAN vlan (2 or 1) be reserved for that purpose. If you don't need a WAN function, use other vlan numbers because DD-WRT probably assumes this purpose in various places.
  • The same is a safe assumption for the default LAN vlan (1 or 0) as well.
  • We've spent a lot of effort on these low-numbered vlan ID's. The DD-WRT GUI allows you to easily define much higher vlan numbers. And the newest releases support vlan id's as high as 4096, but you have to use those via direct NVRAM configuration as shown below, rather than in the GUI.

Summary

At this point, we have not explained anything about those interesting NVRAM variables. But you should be able to think about your hardware ports and internal port numbering (and vlan numbering) schemes. And you can now plan how you actually want to configure your vlans for the router.

What you get to play with:

The CPU 
  • Connects to eth0 which trunks to the internal switch "CPU" port (5 or 8)
  • Connects to eth1, which trunks to the WiFi devices
One default bridge 
  • br0 links eth1 (wifi devices) and the default LAN vlan (vlan1 or vlan0), all untagged
Two default vlans 
  • Default LAN vlan (vlan1 or vlan0), by default connecting to all LAN hardware ports (0-3 or 1-4)
  • Default WAN vlan (vlan2 or vlan1), by default connecting to the WAN hardware port (4 or 0)
Five switch ports 
  • 100mbit or gigabit
  • 0-4 or 4-0... it varies by brand and model
Available vlan numbers 
could be 0-15, 1-16 or even 1-4096 depending...

Whew! OK, now we're ready to tackle the NVRAM variables.

NVRAM variables--defining the switch and VLANS

As noted above, the DD-WRT GUI is able to handle properly setting some of these values, for basic configurations. However, if you create new VLANs or reconfigure in any of a number of ways, or make non-default use of these (eg set up a new bridge, etc), you will likely find that things don't fully work correctly unless you ensure all of these NVRAM values are correctly set.

We don't mean to scare you. There are only three sets of VLAN/Port-related NVRAM variables, and they truly are not that hard to set correctly.

Here they are, in quick summary:

vlan#ports 
Each vlan is assigned one or more ports plus the CPU port. Default vlan and tagging also specified.
port#vlans 
Each port is assigned to one vlan (CPU to all vlans). Plus other per-port settings for speed, duplex, etc.
vlan#hwname 
Activates a vlan, ensuring it is properly initialized.

Required Manual NVRAM Changes

VERY IMPORTANT For a fully working VLAN Config, you must make the following manual changes (if needed) because the current GUI doesn't do it! Each of these NVRAM variables is explained below.

  • Add vlanNhwname for every VLAN other than the defaults (which already should have these values in your saved entries.) Each one has a value of "et0". ie (if you're adding vlan 103)
nvram set vlan103hwname=et0
  • Add a correct vlanNports value for each new VLAN, and correct any existing ones to remove/change ports no longer in those VLANs. Each entry contains the ports in that VLAN, plus the CPU port (5 or 8). Also add tagging (if needed) for the new VLANs. For example, if port 4 is now in VLAN 103 instead of VLAN 1, you might need:
nvram set vlan1ports="1 2 3 5*"
nvram set vlan103ports="4 5"
  • Add a correct portNvlans value, if you're using vlans outside of GUI capabilities (eg more than 16). In our sample case with port 4 now in VLAN 103, we might use:
nvram set port4vlans="103 18 19 21"
nvram set port5vlans="1 2 103 16"
  • Verify your changes and save
    • You have made the changes but they are not yet active nor saved!
    • Use the above nvram show commands to view your updated settings. Are you sure they're correct? If so, move ahead. Just know that once you commit, your router will follow the new rules, for better or worse
    • Commit the changes.
nvram commit

NVRAM vlan#ports

The vlan#ports variables are per-VLAN. They define which ports are assigned to each VLAN, plus other VLAN-specific attributes (default VLAN, 802.1q tagging, and forcing the WAN VLAN to be untagged.)

As noted above,

  • You must know your CPU internal port number (5 or 8).
  • Be aware of your default LAN and WAN vlans (1 and 2 or 0 and 1)

With 100 mbps ports, the vlan#ports variables typically appear like this:

nvram show | grep vlan.*ports | sort
vlan0ports=1 2 3 4 5*
vlan1ports=0 5 

With gigabit ports, the vlan#ports variables may instead appear like this:

nvram show | grep vlan.*ports | sort
vlan1ports=1 2 3 4 5*
vlan2ports=0 5u

or

nvram show | grep vlan.*ports | sort
vlan1ports=1 2 3 4 8*
vlan2ports=0 8

As noted above, there are default VLANs for the LAN and WAN. They are either

  • vlan0ports and vlan1ports

or

  • vlan1ports and vlan2ports (there won't be a vlan0)

Other VLAN attributes

These are suffixes for the final CPU port number.

"t" 
tag with 802.1q vlan header (e.g. for trunking).
"u" 
used on WAN vlan, to ensure WAN traffic is untagged.
"*" 
used on default LAN VLAN, untagged incoming traffic goes here.

See below and References for more information.

NVRAM port#vlans

The port#vlans variables define the vlan for each port, and other per-port attributes.

Note that each port can only be in one vlan, except that the CPU port is connected to all vlans. ALSO note that for this NVRAM variable, the CPU port is always port 5, never port 8.

By default, then WAN port is connected to the default WAN VLAN (1 or 2), and all other ports are connected to the default LAN VLAN (0 or 1).

Normally, every port also has one or more additional hardware attributes assigned.

Port Attributes

0 or 1 to 15, or even 4096 This is the VLAN for the port. NOTE that due to the other attributes below, VLANs 16 to 21 are not supported!
16 Tagged
17 NOT Auto-Negotiate. (If #17 is off, you'll get 18, 19, and 21 on a gigabit switch)
18 = NOT forced-100 MBit (either Auto-Negotiate is used, or some other speed is forced)
19 = NOT Full-Duplex (either Auto-Negotiate is used, or Half-duplex is forced)
20 = NOT Enabled (ie. disabled)
21 = NOT forced-Gigabit (either Auto-Negotiate is used, or some other speed is forced)

Some sample attribute settings:

18 19 21 = Auto-negotiate Gigabit
18 19 = Auto-negotiate 100 MBit 
17 19 = Force 100 MBit, half-duplex
17      = Force 10 MBit, full duplex (on a 100 MBit router)
17 18 = Force Gigabit full duplex (on a gigabit router)
16      = For some reason, the CPU port is generally given this "tagged" attribute

As noted in the quick example above, if we're assigning port 4 to VLAN 103, we would need to set two portNvlans variables. On a Gigabit router (with WAN port 0) it would look like this:

nvram set port5vlans="1 2 103 16"
nvram set port4vlans="103 18 19 21"

NVRAM vlan#hwname

This ensures each vlan is initialized properly. There must be one for each vlan. The gui never adds these variables as of today. You must do this to ensure DD-WRT features all work correctly.

So far, the correct value is always "et0"

For instance, if you were enabling VLAN 103 you would set:

nvram set vlan103hwname=et0

Finishing up

After you've set all your nvram variables you need to make sure to commit them so that they will be saved! Then you need to reboot to have your new configuration take effect.

nvram commit
reboot

Usage examples

Note: Only VLAN's 0-15 are usable on 100mbit models and VLAN's 1-15 on gigabit models.

Second WAN port

You can move ports to the WAN VLAN to make them act as WAN ports residing outside the router's NAT or to just replace a damaged WAN port. Devices attached to these ports will request their IP addresses from the ISP instead of getting a private IP address from your router. One might want to have such behavior when having unsorted firewall issues with a SIP operator.

nvram set vlan0ports="1 2 3 5*" 
nvram set vlan1ports="0 4 5" 
nvram commit 
reboot

Disable LAN ports

Another use is to disable all LAN ports except the one that connects you to the rest of the world. You can use your router as an access point and no one can plug in a network cable to get around your Radius authentication (requested in the German forum).

Example to only enable LAN port 1 (tested with a WRT54Gv5):

nvram set vlan0ports="3 5*"
nvram set vlan1ports="5"
nvram commit
reboot 

Separate LAN ports (into another subnet)

You can create new VLAN's to separate LAN ports into different subnets. After you have them separated you can use iptables to restrict access between the VLAN's/subnets.

nvram set vlan0ports="1 2 3 5*" 
nvram set vlan1ports="0 5" 
nvram set vlan3ports="4 5"
nvram set vlan3hwname=et0
nvram set port4vlans="3 18 19"
nvram set port5vlans="0 1 3 16"
nvram commit 
reboot

802.1q VLAN trunk

VLAN trunking allows you to connect VLAN's across multiple devices without having to use a cable for each VLAN. For instance, if you had VLAN 1 and VLAN 3 on two different devices then you can create a trunk port on both devices to tag the Ethernet frames with an 802.1q header. Then devices in VLAN 1 on router 1 can communicate with devices in VLAN 1 on router 2 and devices in VLAN 3 on router 1 can communicate with devices in VLAN 3 on router 2.

Note: Broadcom's 100mbit switches use VLAN 0 as the default LAN VLAN but 802.1q specifies that a tag of "0" means that the frame doesn't belong to any VLAN. This is the reason gigabit models use VLAN 1 for their LAN and you should avoid using VLAN 0 in a trunk because of this.

For every VLAN that you want to be trunked you must put the trunk port into the VLAN and add a "t" after the port number to indicate that it will be tagged.

Here is an example of how to put three LAN ports into separate VLAN's and use the fourth LAN port as a trunk on a gigabit model. The commands that are commented out should already be set by default.

nvram set vlan1ports="3 4t 8*"
#nvram set vlan2ports="0 8"
nvram set vlan3ports="2 4t 8"
nvram set vlan4ports="1 4t 8"
#nvram set port0vlans="2 18 19"
nvram set port1vlans="4 18 19"
nvram set port2vlans="3 18 19"
#nvram set port3vlans="1 18 19"
nvram set port4vlans="1 3 4 16 18 19"
nvram set port5vlans="1 2 3 4 16"
#nvram set vlan1hwname=et0
#nvram set vlan2hwname=et0
nvram set vlan3hwname=et0
nvram set vlan4hwname=et0
nvram commit
reboot

It is also possible to have only the trunk port in a VLAN. This is useful for connecting VAP's on different devices together by bridging an 'empty' VLAN with the VAP.

nvram set vlan1ports="1 2 3 4t 8*"
nvram set vlan3ports="4t 8"
nvram set port4vlans="1 3 16 18 19"
nvram set port5vlans="1 2 3 16"
nvram set vlan3hwname=et0
nvram commit
reboot

On some models it is also possible to create a default VLAN (untagged VLAN on a trunk port) which is not possible at all in the GUI even if the GUI works for your model. This example makes VLAN 1 the default VLAN for port 4 while also tagging VLAN 3 on port 4.

nvram set vlan1ports="1 2 3 4 8*"
nvram set vlan3ports="4t 8"
nvram set port4vlans="1 3 16 18 19"
nvram set port5vlans="1 2 3 16"
nvram set vlan3hwname=et0
nvram commit
reboot

Broadcom VLAN limit

The 15 VLAN limit for Broadcom has been extended to 4096 for k3.10+ starting in build 35244.

References