Switched Ports

From DD-WRT Wiki

Revision as of 12:33, 5 August 2010 by Davidlai (Talk | contribs)
Jump to: navigation, search


Before you start

Check your default vlan configuration before you start so that you know the default configuration if you need to revert your changes.

nvram show | grep vlan.ports

With 100 mbps ports the vlans typically appear like this:

nvram show | grep vlan.ports
vlan0ports=1 2 3 4 5*
vlan1ports=0 5 

With gigabit ports the vlans typically appear like this:

nvram show | grep vlan.ports
vlan1ports=1 2 3 4 8*
vlan2ports=0 8

Usage examples

Second WAN port

You can move ports to the WAN VLAN to make them act as WAN ports residing outside the router's NAT or to just replace a damaged WAN port. Devices attached to these ports will request their IP addresses from the ISP instead of getting a private IP address from your router. One might want to have such behavior when having unsorted firewall issues with a SIP operator.

nvram set vlan0ports="1 2 3 5*" 
nvram set vlan1ports="0 4 5" 
nvram commit 

Note: the above didn't work using v24-sp2 on a linksys wrt54g-tm. Changing the vlan#ports variables didn't affect anything. However editing the port#vlans variables worked. The ports are numbered 1-4 naturally, port 0 is WAN, and port 5 is WLAN. The VLAN numbers are 0-LAN, 1=WAN. Not sure why theres also 18, 19, and 16, but I left them as is. Here are my settings for placing ports 1, 2, and 3 onto the WAN side, leaving port 4 on the LAN side. The wireless port is also on the LAN side.

port0vlans=1 18 19
port1vlans=1 18 19
port2vlans=1 18 19
port3vlans=1 18 19
port4vlans=0 18 19
port5vlans=0 1 16

Disable LAN ports

Another usage would be to disable all LAN ports except the one that connects you to the rest of the world. You can use your router as an access point and no one can plug in a network cable to get around your Radius authentication (requested in the German DD-WRT forum http://www.dd-wrt.com/phpBB2/viewtopic.php?p=26821).

Tested with a WRT54G v5

nvram set vlan0ports="3 5*"
nvram set vlan1ports="5"
nvram commit

will only enable LAN port 1. You can plug cables into the other ports and try to hijack the internet connection but you will not even get to the firewall.

Separate LAN ports (into another subnet)

You can create new VLAN's to separate LAN ports into different subnets. After you have them separated you can use iptables to restrict access between the VLAN's/subnets.

nvram set vlan0ports="1 2 3 5*" 
nvram set vlan1ports="0 5" 
nvram set vlan3ports="4 5"
nvram set vlan3hwname=et0
nvram set port4vlans="3 18 19"
nvram commit 

Note: vlan3ports is a list of ports that are in vlan 3, and port4vlans is a list of vlans that port 4 is in. I do not know why there are essentially 2 lists in this way, but you should make sure that they match ie. vlan#ports includes the port being moved and port#vlans includes to the vlan the port is being moved into. I also do not know what role vlan 18 and 19 fulfill, but they are included in every port#vlans variable.

The Port Numbering Explained

The numbers mean the following:

  • WRT54G v4, WRT54GS v3, WRT54GL v1.1
0  = port 4
1  = port 3
2  = port 2
3  = port 1
4  = WAN
5  = CPU internal
5* = CPU internal default
  • WRT54G v2/v3, WRT54GS v1/v2
0  = WAN
1  = port 1
2  = port 2
3  = port 3
4  = port 4
5  = CPU internal
5* = CPU internal default
  • Gigabit routers
8 = CPU internal
8* = CPU internal default (only put in one VLAN)

For 100mbps routers the variable vlan0ports is the NAT'd LAN side while vlan1ports refers to the WAN side, outside the router's internal NAT addressing scheme. For gigabit routers the variable vlan1ports equals to the NAT'd LAN side while vlan2ports refers to the WAN side.

A little extra explanation regarding the CPU internal port: The switch that is built into 100 mbps routers is a 6 port switch. The sixth port (numbered 5) is the only port not connected to an outside connector. Instead, it is directly connected to the et0 interface on the motherboard. On gigabit routers the CPU internal port is number 8 but I do not know what ports 5-7 are for on these models. The CPU internal port must be included on any VLAN that must be visible to the CPU. The asterisk (*) signifies that the VLAN it is attached to is the default VLAN (ie. only put this in one VLAN). If the switch receives a packet on the CPU internal port that is not tagged then it is put into the VLAN where the * is configured; always make sure this is the LAN VLAN.

The WLAN interface does not support VLANs though it can create virtual interfaces which are similar. The WLAN interface is bridged to the LAN VLAN by default. It is possible to bridge VLAN's to different virtual wireless interfaces using Multiple WLANs.