VLAN Detached Networks (Separate Networks With Internet)

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 18:08, 8 January 2009 (edit)
Raymond (Talk | contribs)
(Procedure)
← Previous diff
Revision as of 18:08, 8 January 2009 (edit) (undo)
Raymond (Talk | contribs)
(GUI tutorial)
Next diff →
Line 118: Line 118:
JC JC
-=GUI tutorial=+=GUI Tutorial=
Tested with firmware DD-WRT v24-sp2 (01/02/09) std @ WRT54G V2.2 Tested with firmware DD-WRT v24-sp2 (01/02/09) std @ WRT54G V2.2

Revision as of 18:08, 8 January 2009

This will separate the ports on the back of your router and allow you to create individual networks that can’t see each other but that can still browse the internet. Note: Anything with < > around it needs supplemental information… Note: Anything with “ “ around it needs to be typed exactly as stated, except items in < >…


Contents

Assumptions:

  1. You have DD-WRT v23 SP2 installed and working to your liking.
  2. You know the Login & Password for web administration.
  3. You're running a Microsoft based operating system, Mac or Linux box.

How will this work?

  1. First it separates the ports from each other.
  2. It activates a DHCP server for each network.
  3. We tell the DD-WRT that we have changed the VLANs.

Procedure:

1. Telnet into the router.

Note: You don’t have to separate all of the ports, remove the sections that don’t apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don’t want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: “nvram set vlan0ports=”1 2 5*”, and just delete the sections that apply to vlan2.

2. Text to copy:

(Added by tetech: For the uninitiated, its worth noting that the port numbers don't necessarily correspond with how they are numbered on the back of the device. For me, "port 4" was the WAN port, and ports 0-3 corresponded to the labels 1-4 on the back of the device.) (Added by Wayland: actually I believe on the WRT54GL and V4 the ports are actually numbered 4 3 2 1 0 corresponding to WAN 1 2 3 4. Just to confuse further the VLAN settings on the web interface the numbers should read W 4 3 2 1. See http://garycourt.com/wp-content/images/WRT54_sw2_internal_architecture.png)

nvram set vlan0ports="1 5*"
nvram set vlan2ports="2 5*"
nvram set vlan3ports="3 5*"
nvram set vlan4ports="4 5*"

nvram set rc_startup='
#!/bin/ash
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

ifconfig vlan2 <router address on vlan> netmask 255.255.255.0
ifconfig vlan3 <router address on vlan> netmask 255.255.255.0
ifconfig vlan4 <router address on vlan> netmask 255.255.255.0

ifconfig vlan2 up
ifconfig vlan3 up
ifconfig vlan4 up
'

nvram set rc_firewall='
iptables -I INPUT -i vlan2 -j ACCEPT
iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan2 -j logdrop

iptables -I INPUT -i vlan3 -j ACCEPT
iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan3 -j logdrop

iptables -I INPUT -i vlan4 -j ACCEPT
iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan4 -j logdrop
'
nvram commit

Notes:

a) If you have your WLAN detached, you should write new rules for eth1 (WLAN port), not allowing traffic from br0 to eth1, and from eth1 to br0 (for your bridged vlans); and so on for all detached vlans you have, but vlan1 (default WAN port).

b) Probably you don't have ppp0 port, so don't write rules related with.

3. Open the Web Administration of the router by going to its IP address then:

4. Administration Tab --> Services Tab --> Under DNSMasq paste the following:

interface=vlan2
dhcp-option=vlan2,3,<router address on vlan>
dhcp-range=vlan2,<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan3
dhcp-option=vlan3,3,<router address on vlan>
dhcp-range=vlan3,<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan4
dhcp-option=vlan4,3,<router address on vlan>
dhcp-range=vlan4,<start ip>,<end ip>,<net mask>,<lease time>

Notes:

a) Take care of setting the correct vlan for each dhcp-option and dhcp-range, because if you don't say which parameter is for, DNSMasq couldn't know how set up more than one DHCP server (it doesn't depend on the order you write those lines).

b) When you set up router address and range with dhcp-option and dhcp-range, vlan address is set up automaticly without using ifconfig command (I've seen v24sp1 makes for you).

5. Click on “Save Settings”

6. Setup Tab --> VLANs

  • Set “Port 2” to “VLAN 2”
  • Set “Port 3” to “VLAN 3”
  • Set “Port 4” to “VLAN 4”

7. Click on “Save Settings”

8. Reboot the router.

9. Now test your networks…


A Word Document of this with an example can be found at Detached Networks By Ports.doc (Main webserver down, unknown return time for listed file...)

Created by: bordr415 Modified by: JC

GUI Tutorial

Tested with firmware DD-WRT v24-sp2 (01/02/09) std @ WRT54G V2.2
Thanks to pepe

Goal

-seperate LAN port 2 from LAN port 1,3,4
-all clients are configured with DHCP
-internet access for all clients

Procedure

Step 1: Settings in Setup > VLANs

Image:VLAN_Detached Networks_1.png

Step 2: Settings in Setup > Networking

Image:VLAN_Detached Networks_2.png

After these steps all clients are able to retrieve an IP via DHCP, can access the internet and each other. To deny the access each other go to Step 3.

Step 3: Firewall Settings in Administration > Commands

Type in „Commands“:
iptables -I FORWARD -i br0 -o vlan2 -j DROP
an click „Save Firewall“

Image:VLAN_Detached Networks_3.png