Tagged VLAN tutorial for idiots?

[disuye]

I need help. Not a networking guy but I can muddle my way through instructions.

I have 3x routers at home (1x RUTX50 and 2x RUT950) all connected by LAN cable / powerline. What I want to have is:

– Dual Wifi SSIDs (private and guest) on all routers.
– Dual subnets (private traffic = 192.168.1.0 and guest traffic = 192.168.88.0) on all routers.

I have set this up successfully on the RUTX50 i.e: dual Wifi SSID and dual subnets with firewall rules to keep traffic and devices secure. I can also create dual SSIDs and Interfaces on the RUT950s … but where I am struggling is Tagged VLAN setup which I get the concepts but can’t quite wrap my head around the options in RutOS to get it working.

If anyone has a Teltonika tutorial link aimed at morons such as myself, please post here. I’ve been watching these OpenWRT videos, which conceptually make sense, but I’m failing to translate the instructions into RutOS setting changes: https://youtu.be/4t_S2oWsBpE

Thanks!

[disuye]

p.s: I also think I’m failing to assign correct Physical / Bridge settings to the guest_lan interface as well (currently No Interface / not Bridged) … adding to my confusion.

[AndzejJ]

Hello,

VLAN configuration is available here.

Is the issue with tagged VLANs only? If so, make sure you assign VLAN Tags to end devices as well. On Windows, go to Device manager → Select your adapter → Properties → Advanced → VLAN ID and set the VLAN ID configured on the router.

Kind Regards,

[anon97864815]

imho: if guests are only wireless, then you do not need separate vlan for them.
you need create interface guest_lan, connect wireless_guest interface to it, and create one firewall rule, allowing traffic from guest_lan to wan. second rule - allow DHCP from guest_lan to router (udp 67-68 accept). any other traffic by default denied by firewall.

[disuye]

Ah OK so tagged VLAN also requires setup on the individual devices? That might be more than I want. Cheers!

[disuye]

Yes – guests are only ever on Wifi – so perhaps your suggestion would do it, I’ll look into it, thanks!

[anon97864815]

look at my config samples, as example. I paste only relevant config parts for guest wireless

1) /etc/config/network
config interface ‘guest_lan’
option metric ‘6’
option netmask ‘255.255.255.0’
option proto ‘static’
option delegate ‘0’
option ipaddr ‘192.168.2.254’
option type ‘bridge’
option stp ‘0’
option force_link ‘1’

2) /etc/config/dhcp
config dhcp ‘guest_lan’
option interface ‘guest_lan’
option relay_enabled ‘0’
option force ‘1’
option leasetime ‘8h’
option start ‘1’
option limit ‘50’
option netmask ‘255.255.255.0’
list dhcp_option_force ‘3,192.168.2.254’
list dhcp_option_force ‘6,1.1.1.1,8.8.8.8’
list dhcp_option_force ‘15,guest.home.my’
Note: you also need to add guest_lan interface to dnsmasq interface list
config dnsmasq
option interface ‘lan guest_lan’

3) /etc/config/wireless
config wifi-iface
option device ‘radio0’
option mode ‘ap’
option wifi_id ‘wifi1’
option encryption ‘psk2+ccmp’
option key ‘For_Friends1’
option skip_inactivity_poll ‘0’
option hidden ‘0’
option ieee80211r ‘0’
option network ‘guest_lan’
option short_preamble ‘1’
option disassoc_low_ack ‘1’
option ssid ‘My_Guests’
option isolate ‘1’

config wifi-iface
option device ‘radio1’
option mode ‘ap’
option wifi_id ‘wifi2’
option encryption ‘sae’
option key ‘For_Friends1’
option skip_inactivity_poll ‘0’
option hidden ‘0’
option ieee80211r ‘0’
option network ‘guest_lan’
option short_preamble ‘1’
option disassoc_low_ack ‘1’
option ssid ‘My_Guests’
option isolate ‘1’

4) /etc/config/firewall
config rule ‘xxxx’
option proto ‘udp’
option name ‘DHCP4GUESTS’
option target ‘ACCEPT’
list dest_port ‘67-68’
option src ‘guest_lan’
option enabled ‘1’
option utc_time ‘0’
option priority ‘1’

config zone ‘yyyy’
option output ‘ACCEPT’
option name ‘guest_lan’
option log ‘0’
option conntrack ‘0’
option masq ‘0’
option mtu_fix ‘0’
option input ‘REJECT’
option forward ‘REJECT’
option network ‘guest_lan’

config forwarding ‘zzzz’
option dest ‘wan’
option src ‘guest_lan’

[disuye]

awesome – thank you! I’ll give this a shot tonight. D

[disuye]

For anyone else struggling on this – and Google seems to bring this thread up re: RUT950 VLAN –the answer is:

Sell the RUT950 and buy RUTX10 instead.

There is a hardware limitation with the RUT950 which prevents tagged & untagged VLANS sharing the same physical port. You can have a port with all tagged VLANs, or a port with one untagged + the rest set to off… neither of which met my site requirements.

With a device capable of mixing tagged & untagged VLAN on the same hardware ethernet port (such as my main RUTX50 router and my RUTX10 access points), relaying main_lan DHCP + relaying guest_lan DHCP (and therefore extending main_wifi + guest_wifi) over one trunk cable (distributed via a home powerline) is actually very simple if you follow the Teltonika instructions for:

– first, setting up a guest VLAN on both the RUTX50 and RUTX10
– configuring the RUTX50 as a DHCP server for both main_lan/wifi and guest_lan/wifi
– configuring the RUTX10 as an Access Point with DHCP relay a/a
– configure guest_zone Firewall on the RUTX50 and RUTX10 under ‘General Settings’
– and finally make two Firewall ‘Traffic Rules’ on the RUTX50: 1) Prevent guest_zone getting onto lan. 2) Prevent guest_zone requesting to access SSH, FTP, webUI, SMB etc. etc. ports on specific hardware devices, such as the RUTX50 or any IOT devices.

That’s it. The RUT950 hardware/VLAN limitation had me going in effing circles. If Google brought you here, and the above doesn’t help, send me a DM or post Q’s here.