VLAN Detached Networks (Separate Networks With Internet)

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 22:53, 10 July 2007 (edit)
T0ny (Talk | contribs)
('''How will this work?''')
← Previous diff
Revision as of 23:01, 10 July 2007 (edit) (undo)
T0ny (Talk | contribs)

Next diff →
Line 1: Line 1:
-This will separate the ports on the back of your router and allow you to create individual networks that can’t see each other but that can still browse the internet.<br>+This will separate the ports on the back of your router and allow you to create individual networks that can’t see each other but that can still browse the internet.
-Note: Anything with < > around it needs supplemental information…<br>+Note: Anything with < > around it needs supplemental information…
-Note: Anything with “ “ around it needs to be typed exactly as stated, except items in < >…<br>+Note: Anything with “ “ around it needs to be typed exactly as stated, except items in < >…
-== '''Assumptions:''' ==+==Assumptions:==
# You have DD-WRT v23 SP2 installed and working to your liking. # You have DD-WRT v23 SP2 installed and working to your liking.
Line 12: Line 12:
==How will this work?== ==How will this work?==
-# First it separates the ports from each other.<br>+# First it separates the ports from each other.
-# It activates a DHCP server for each network.<br>+# It activates a DHCP server for each network.
-# We tell the DD-WRT that we have changed the VLANs.<br>+# We tell the DD-WRT that we have changed the VLANs.
-== '''Procedure:''' ==+==Procedure:==
- 1. Telnet into the router.<br>+1. Telnet into the router.
-''Note: You don’t have to separate all of the ports, remove the sections that don’t apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don’t want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: '''“nvram set vlan0ports=”1 2 5*”''', and just delete the sections that apply to '''vlan2'''.''<br>+
- 2. Text to copy:<br>+
-----+''Note: You don’t have to separate all of the ports, remove the sections that don’t apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don’t want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: '''“nvram set vlan0ports=”1 2 5*”''', and just delete the sections that apply to '''vlan2'''.''
-nvram set vlan0ports="1 5*"<br>+2. Text to copy:
-nvram set vlan2ports="2 5*"<br>+
-nvram set vlan3ports="3 5*"<br>+
-nvram set vlan4ports="4 5*"<br>+
-nvram set rc_startup='<br>+<pre>
-#!/bin/ash<br>+nvram set vlan0ports="1 5*"
-PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"<br>+nvram set vlan2ports="2 5*"
 +nvram set vlan3ports="3 5*"
 +nvram set vlan4ports="4 5*"
-ifconfig vlan2 <router address on vlan> netmask 255.255.255.0<br>+nvram set rc_startup='
-ifconfig vlan3 <router address on vlan> netmask 255.255.255.0<br>+#!/bin/ash
-ifconfig vlan4 <router address on vlan> netmask 255.255.255.0<br>+PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
-ifconfig vlan2 up<br>+ifconfig vlan2 <router address on vlan> netmask 255.255.255.0
-ifconfig vlan3 up<br>+ifconfig vlan3 <router address on vlan> netmask 255.255.255.0
-ifconfig vlan4 up<br>+ifconfig vlan4 <router address on vlan> netmask 255.255.255.0
-'<br>+ifconfig vlan2 up
-nvram set rc_firewall='<br>+ifconfig vlan3 up
 +ifconfig vlan4 up
 +'
-iptables -I INPUT -i vlan2 -j ACCEPT<br>+nvram set rc_firewall='
-iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT<br>+iptables -I INPUT -i vlan2 -j ACCEPT
-iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i br0 -o vlan2 -j logdrop<br>+iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT
 +iptables -I FORWARD -i br0 -o vlan2 -j logdrop
-iptables -I INPUT -i vlan3 -j ACCEPT<br>+iptables -I INPUT -i vlan3 -j ACCEPT
-iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i br0 -o vlan3 -j logdrop<br>+iptables -I FORWARD -i br0 -o vlan3 -j logdrop
-iptables -I INPUT -i vlan4 -j ACCEPT<br>+iptables -I INPUT -i vlan4 -j ACCEPT
-iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT<br>+iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT
-iptables -I FORWARD -i br0 -o vlan4 -j logdrop<br>+iptables -I FORWARD -i br0 -o vlan4 -j logdrop
-'<br>+'
-nvram commit''<br>+nvram commit''</pre>
-----+3. Open the Web Administration of the router by going to its IP address then:
-<br>+
- 3. Open the Web Administration of the router by going to its IP address then:<br>+
- 4. Administration Tab --> Services Tab --> Under DNSMasq paste the following: <br>+
-<br>+
-----+
-interface=vlan2<br>+4. Administration Tab --> Services Tab --> Under DNSMasq paste the following:
-dhcp-option=3,<router address on vlan><br>+
-dhcp-range=<start ip>,<end ip>,<net mask>,<lease time><br>+
-interface=vlan3<br>+
-dhcp-option=3,<router address on vlan><br>+
-dhcp-range=<start ip>,<end ip>,<net mask>,<lease time><br>+
-interface=vlan4<br>+
-dhcp-option=3,<router address on vlan><br>+
-dhcp-range=<start ip>,<end ip>,<net mask>,<lease time><br>+
-----+<pre>
-<br>+interface=vlan2
- 5. Click on “Save Settings”<br>+dhcp-option=3,<router address on vlan>
- 6. Setup Tab --> VLANs<br>+dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
-<br>+interface=vlan3
-----+dhcp-option=3,<router address on vlan>
 +dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
 +interface=vlan4
 +dhcp-option=3,<router address on vlan>
 +dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
 +</pre>
-Set “Port 2” to “VLAN 2”<br>+5. Click on “Save Settings”
-Set “Port 3” to “VLAN 3”<br>+
-Set “Port 4” to “VLAN 4”<br>+
-----+6. Setup Tab --> VLANs
-<br>+
- 7. Click on “Save Settings”<br>+
- 8. Reboot the router.<br>+
- 9. Now test your networks…<br>+
-<br>+
-'''A Word Document of this with an example can be found at <br>+*Set “Port 2” to “VLAN 2”
 + 
 +*Set “Port 3” to “VLAN 3”
 + 
 +*Set “Port 4” to “VLAN 4”
 + 
 +7. Click on “Save Settings”
 + 
 +8. Reboot the router.
 + 
 +9. Now test your networks…
 + 
 + 
 + 
 +'''A Word Document of this with an example can be found at
[http://bordr.us/misc/DD-WRT/Detached%20Networks%20By%20Ports.doc Detached Networks By Ports.doc]''' [http://bordr.us/misc/DD-WRT/Detached%20Networks%20By%20Ports.doc Detached Networks By Ports.doc]'''
Created by: Created by:
bordr415 bordr415

Revision as of 23:01, 10 July 2007

This will separate the ports on the back of your router and allow you to create individual networks that can’t see each other but that can still browse the internet. Note: Anything with < > around it needs supplemental information… Note: Anything with “ “ around it needs to be typed exactly as stated, except items in < >…


Assumptions:

  1. You have DD-WRT v23 SP2 installed and working to your liking.
  2. You know the Login & Password for web administration.
  3. You're running a Microsoft based operating system, Mac or Linux box.

How will this work?

  1. First it separates the ports from each other.
  2. It activates a DHCP server for each network.
  3. We tell the DD-WRT that we have changed the VLANs.

Procedure:

1. Telnet into the router.

Note: You don’t have to separate all of the ports, remove the sections that don’t apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don’t want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: “nvram set vlan0ports=”1 2 5*”, and just delete the sections that apply to vlan2.

2. Text to copy:

nvram set vlan0ports="1 5*"
nvram set vlan2ports="2 5*"
nvram set vlan3ports="3 5*"
nvram set vlan4ports="4 5*"

nvram set rc_startup='
#!/bin/ash
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

ifconfig vlan2 <router address on vlan> netmask 255.255.255.0
ifconfig vlan3 <router address on vlan> netmask 255.255.255.0
ifconfig vlan4 <router address on vlan> netmask 255.255.255.0

ifconfig vlan2 up
ifconfig vlan3 up
ifconfig vlan4 up
'

nvram set rc_firewall='
iptables -I INPUT -i vlan2 -j ACCEPT
iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan2 -j logdrop

iptables -I INPUT -i vlan3 -j ACCEPT
iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan3 -j logdrop

iptables -I INPUT -i vlan4 -j ACCEPT
iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan4 -j logdrop
'
nvram commit''

3. Open the Web Administration of the router by going to its IP address then:

4. Administration Tab --> Services Tab --> Under DNSMasq paste the following:

interface=vlan2
dhcp-option=3,<router address on vlan>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan3
dhcp-option=3,<router address on vlan>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan4
dhcp-option=3,<router address on vlan>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>

5. Click on “Save Settings”

6. Setup Tab --> VLANs

  • Set “Port 2” to “VLAN 2”
  • Set “Port 3” to “VLAN 3”
  • Set “Port 4” to “VLAN 4”

7. Click on “Save Settings”

8. Reboot the router.

9. Now test your networks…


A Word Document of this with an example can be found at Detached Networks By Ports.doc

Created by: bordr415