Switched Ports

From DD-WRT Wiki

Revision as of 20:51, 1 November 2009 by Kmcgrego (Talk | contribs)
Jump to: navigation, search


Before you start

Check your default vlan configuration before you start so that you know the default configuration if you need to revert your changes.

nvram show | grep vlan.ports

With 802.11g routers the vlans typically appear like this:

nvram show | grep vlan.ports
vlan0ports=1 2 3 4 5*
vlan1ports=0 5 

With 802.11n routers the vlans typically appear like this:

nvram show | grep vlan.ports
vlan1ports=1 2 3 4 8*
vlan2ports=0 8

Usage examples

With an older router you can, for example, make ports 3 and 4 reside outside the router's NAT. Devices attached to these ports will request their IP addresses from the ISP instead of getting a private IP address from your WRT. One might want to have such behaviour when having unsorted firewall issues with a SIP operator.

nvram set vlan0ports="1 2 5*" 
nvram set vlan1ports="0 3 4 5" 
nvram commit 

According to the user reports, this is confirmed to work at least with a WRT54GSv1.1 after power cycling the router.

If you want to recover the default settings, write the following within ssh session:

nvram set vlan0ports="1 2 3 4 5*" 
nvram set vlan1ports="0 5" 
nvram commit 

Disable LAN ports

Another usage would be to disable all LAN ports except the one that connects you to the rest of the world. You can use your router as an access point and no one can plug in a network cable to get around your Radius authentication (requested in the German DD-WRT forum http://www.dd-wrt.com/phpBB2/viewtopic.php?p=26821).

Tested with a WRT54G v5

nvram set vlan0ports="3 5*"
nvram set vlan1ports="5"
nvram commit

will only enable LAN port 1. You can plug cables into the other ports and try to hijack the internet connection but you will not even get to the firewall.

The Port Numbering Explained

The numbers mean the following:

  • WRT54G v4, WRT54GS v3, WRT54GL v1.1
0  = port 4
1  = port 3
2  = port 2
3  = port 1
4  = WAN
5  = CPU internal
5* = CPU internal default
  • WRT54G v2/v3, WRT54GS v1/v2
0  = WAN
1  = port 1
2  = port 2
3  = port 3
4  = port 4
5  = CPU internal
5* = CPU internal default
  • New 802.11n routers
8 = CPU internal
8* = CPU internal default

For older routers the variable vlan0ports equals to the natted LAN side while vlan1ports refers to the WAN side, outside the router's internal NAT addressing scheme. For newer 802.11n routers the variable vlan1ports equals to the natted LAN side while vlan1ports refers to the WAN side.

A little extra explanation regarding port 5: the switch that is built in to the router is a 6 port switch. The sixth port (numbered 5) is the only port not connected to an outside connector. Instead, it is directly connected to the et0 interface on the motherboard. Port 5 must be included on any VLAN that must be visible to the CPU. The asterisk (*) signifies that the VLAN it is attached to is the default VLAN: if the switch receives a packet on port 5 that is not tagged it is put into the VLAN where the * is configured; always make sure this is vlan0 for older routers. For newer 802.11n routers the internal cpu connection is port 8 and the default vlan (*) should be vlan1.

The WLAN interface does not support VLANs. It is, however, usually bridged to vlan0. It's possible to bridge virtual wireless interfaces to different VLANs VLAN Detached Networks each with Wireless and Internet