VLAN Detached Networks (Separate Networks With Internet)

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 18:21, 8 January 2009 (edit)
Raymond (Talk | contribs)
(Procedure)
← Previous diff
Revision as of 09:25, 27 February 2009 (edit) (undo)
Lavalys (Talk | contribs)
(Removing all content from page)
Next diff →
Line 1: Line 1:
-This will separate the ports on the back of your router and allow you to create individual networks that can’t see each other but that can still browse the internet. 
-Note: Anything with < > around it needs supplemental information… 
-Note: Anything with “ “ around it needs to be typed exactly as stated, except items in < >… 
- 
-==Assumptions:== 
- 
-# You have DD-WRT v23 SP2 installed and working to your liking. 
-# You know the Login & Password for web administration. 
-# You're running a Microsoft based operating system, Mac or Linux box. 
- 
-==How will this work?== 
- 
-# First it separates the ports from each other. 
-# It activates a DHCP server for each network. 
-# We tell the DD-WRT that we have changed the VLANs. 
- 
-==Procedure:== 
- 
-1. Telnet into the router. 
- 
-''Note: You don’t have to separate all of the ports, remove the sections that don’t apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don’t want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: '''“nvram set vlan0ports=”1 2 5*”''', and just delete the sections that apply to '''vlan2'''.'' 
- 
-2. Text to copy: 
- 
-(Added by tetech: For the uninitiated, its worth noting that the port numbers don't necessarily correspond with how they are numbered on the back of the device. For me, "port 4" was the WAN port, and ports 0-3 corresponded to the labels 1-4 on the back of the device.) (Added by Wayland: actually I believe on the WRT54GL and V4 the ports are actually numbered 4 3 2 1 0 corresponding to WAN 1 2 3 4. Just to confuse further the VLAN settings on the web interface the numbers should read W 4 3 2 1. See http://garycourt.com/wp-content/images/WRT54_sw2_internal_architecture.png) 
- 
-<pre> 
-nvram set vlan0ports="1 5*" 
-nvram set vlan2ports="2 5*" 
-nvram set vlan3ports="3 5*" 
-nvram set vlan4ports="4 5*" 
- 
-nvram set rc_startup=' 
-#!/bin/ash 
-PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}" 
- 
-ifconfig vlan2 <router address on vlan> netmask 255.255.255.0 
-ifconfig vlan3 <router address on vlan> netmask 255.255.255.0 
-ifconfig vlan4 <router address on vlan> netmask 255.255.255.0 
- 
-ifconfig vlan2 up 
-ifconfig vlan3 up 
-ifconfig vlan4 up 
-' 
- 
-nvram set rc_firewall=' 
-iptables -I INPUT -i vlan2 -j ACCEPT 
-iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT 
-iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT 
-iptables -I FORWARD -i br0 -o vlan2 -j logdrop 
- 
-iptables -I INPUT -i vlan3 -j ACCEPT 
-iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT 
-iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT 
-iptables -I FORWARD -i br0 -o vlan3 -j logdrop 
- 
-iptables -I INPUT -i vlan4 -j ACCEPT 
-iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT 
-iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT 
-iptables -I FORWARD -i br0 -o vlan4 -j logdrop 
-' 
-nvram commit</pre> 
- 
-Notes: 
- 
-a) If you have your WLAN detached, you should write new rules for eth1 (WLAN port), not allowing traffic from br0 to eth1, and from eth1 to br0 (for your bridged vlans); and so on for all detached vlans you have, but vlan1 (default WAN port). 
- 
-b) Probably you don't have ppp0 port, so don't write rules related with. 
- 
-3. Open the Web Administration of the router by going to its IP address then: 
- 
-4. Administration Tab --> Services Tab --> Under DNSMasq paste the following:  
- 
-<pre> 
-interface=vlan2 
-dhcp-option=vlan2,3,<router address on vlan> 
-dhcp-range=vlan2,<start ip>,<end ip>,<net mask>,<lease time> 
-interface=vlan3 
-dhcp-option=vlan3,3,<router address on vlan> 
-dhcp-range=vlan3,<start ip>,<end ip>,<net mask>,<lease time> 
-interface=vlan4 
-dhcp-option=vlan4,3,<router address on vlan> 
-dhcp-range=vlan4,<start ip>,<end ip>,<net mask>,<lease time> 
-</pre> 
- 
-Notes: 
- 
-a) Take care of setting the correct vlan for each dhcp-option and dhcp-range, because if you don't say which parameter is for, DNSMasq couldn't know how set up more than one DHCP server (it doesn't depend on the order you write those lines). 
- 
-b) When you set up router address and range with dhcp-option and dhcp-range, vlan address is set up automaticly without using ifconfig command (I've seen v24sp1 makes for you). 
- 
-5. Click on “Save Settings” 
- 
-6. Setup Tab --> VLANs 
- 
-*Set “Port 2” to “VLAN 2” 
- 
-*Set “Port 3” to “VLAN 3” 
- 
-*Set “Port 4” to “VLAN 4”  
- 
-7. Click on “Save Settings” 
- 
-8. Reboot the router. 
- 
-9. Now test your networks… 
- 
- 
- 
-'''A Word Document of this with an example can be found at  
-[http://bordr.us/misc/DD-WRT/Detached%20Networks%20By%20Ports.doc Detached Networks By Ports.doc]''' 
-(Main webserver down, unknown return time for listed file...) 
- 
-Created by: 
-bordr415 
-Modified by: 
-JC 
- 
-=GUI Tutorial= 
- 
-Tested with firmware DD-WRT v24-sp2 (01/02/09) std @ WRT54G V2.2 
-<br>Thanks to pepe 
- 
-==Goal== 
-*seperate LAN port 2 from LAN port 1,3,4 
-*all clients are configured to use DHCP 
-*internet access for all clients 
- 
-==Procedure== 
-'''Step 1: Settings in Setup > VLANs''' 
- 
-[[Image:VLAN_Detached Networks_1.png]] 
- 
- 
-'''Step 2: Settings in Setup > Networking''' 
- 
-[[Image:VLAN_Detached Networks_2.png]] 
- 
- 
-After these steps all clients are able to retrieve an IP via DHCP, can access the internet and each other.<br> 
-To deny the access each other go to Step 3.  
- 
-'''Step 3: Firewall Settings in Administration > Commands''' 
- 
-Type in „Commands“:<br> 
-<pre> 
-iptables -I FORWARD -i br0 -o vlan2 -j DROP 
-</pre> 
-and click „Save Firewall“ 
- 
-[[Image:VLAN_Detached Networks_3.png]] 

Revision as of 09:25, 27 February 2009