VLAN Detached Networks (Separate Networks With Internet)

From DD-WRT Wiki

Revision as of 08:35, 23 September 2007 by Tetech (Talk | contribs)
Jump to: navigation, search

This will separate the ports on the back of your router and allow you to create individual networks that can’t see each other but that can still browse the internet. Note: Anything with < > around it needs supplemental information… Note: Anything with “ “ around it needs to be typed exactly as stated, except items in < >…


Assumptions:

  1. You have DD-WRT v23 SP2 installed and working to your liking.
  2. You know the Login & Password for web administration.
  3. You're running a Microsoft based operating system, Mac or Linux box.

How will this work?

  1. First it separates the ports from each other.
  2. It activates a DHCP server for each network.
  3. We tell the DD-WRT that we have changed the VLANs.

Procedure:

1. Telnet into the router.

Note: You don’t have to separate all of the ports, remove the sections that don’t apply to your needs and make sure to add that port in to the very first line of text to copy. Example: if you don’t want port 2 to be on its own network and would like to share that port with port 1 then the first line would read: “nvram set vlan0ports=”1 2 5*”, and just delete the sections that apply to vlan2.

2. Text to copy:

(Added by tetech: For the uninitiated, its worth noting that the port numbers don't necessarily correspond with how they are numbered on the back of the device. For me, "port 4" was the WAN port, and ports 0-3 corresponded to the labels 1-4 on the back of the device.)

nvram set vlan0ports="1 5*"
nvram set vlan2ports="2 5*"
nvram set vlan3ports="3 5*"
nvram set vlan4ports="4 5*"

nvram set rc_startup='
#!/bin/ash
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

ifconfig vlan2 <router address on vlan> netmask 255.255.255.0
ifconfig vlan3 <router address on vlan> netmask 255.255.255.0
ifconfig vlan4 <router address on vlan> netmask 255.255.255.0

ifconfig vlan2 up
ifconfig vlan3 up
ifconfig vlan4 up
'

nvram set rc_firewall='
iptables -I INPUT -i vlan2 -j ACCEPT
iptables -I FORWARD -i vlan2 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan2 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan2 -j logdrop

iptables -I INPUT -i vlan3 -j ACCEPT
iptables -I FORWARD -i vlan3 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan3 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan3 -j logdrop

iptables -I INPUT -i vlan4 -j ACCEPT
iptables -I FORWARD -i vlan4 -o vlan1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i vlan4 -o ppp0 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o vlan4 -j logdrop
'
nvram commit''

3. Open the Web Administration of the router by going to its IP address then:

4. Administration Tab --> Services Tab --> Under DNSMasq paste the following:

interface=vlan2
dhcp-option=3,<router address on vlan>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan3
dhcp-option=3,<router address on vlan>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan4
dhcp-option=3,<router address on vlan>
dhcp-range=<start ip>,<end ip>,<net mask>,<lease time>

(Added by tetech: At least for me in v24 Beta, the following seemed to work better:

interface=vlan2
dhcp-range=vlan2,<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan3
dhcp-range=vlan3,<start ip>,<end ip>,<net mask>,<lease time>
interface=vlan4
dhcp-range=vlan4,<start ip>,<end ip>,<net mask>,<lease time>
dhcp-option=net:vlan2,3,<router address on vlan>
dhcp-option=net:vlan3,3,<router address on vlan>
dhcp-option=net:vlan4,3,<router address on vlan>

With the options above, only the last gateway IP was sent, i.e. ALL of vlan2, vlan3, vlan4 would use the gateway IP for vlan4, which means vlan2 and vlan3 didn't route properly.)

5. Click on “Save Settings”

6. Setup Tab --> VLANs

  • Set “Port 2” to “VLAN 2”
  • Set “Port 3” to “VLAN 3”
  • Set “Port 4” to “VLAN 4”

7. Click on “Save Settings”

8. Reboot the router.

9. Now test your networks…


A Word Document of this with an example can be found at Detached Networks By Ports.doc

Created by: bordr415