Tagged VLAN tutorial for idiots?

Teltonika Networks
1

I need help. Not a networking guy but I can muddle my way through instructions.

I have 3x routers at home (1x RUTX50 and 2x RUT950) all connected by LAN cable / powerline. What I want to have is:

– Dual Wifi SSIDs (private and guest) on all routers.
– Dual subnets (private traffic = 192.168.1.0 and guest traffic = 192.168.88.0) on all routers.

I have set this up successfully on the RUTX50 i.e: dual Wifi SSID and dual subnets with firewall rules to keep traffic and devices secure. I can also create dual SSIDs and Interfaces on the RUT950s … but where I am struggling is Tagged VLAN setup which I get the concepts but can’t quite wrap my head around the options in RutOS to get it working.

If anyone has a Teltonika tutorial link aimed at morons such as myself, please post here. I’ve been watching these OpenWRT videos, which conceptually make sense, but I’m failing to translate the instructions into RutOS setting changes: extend a guest wifi on second access point with OpenWrt using VLANs - YouTube

Thanks!

2

p.s: I also think I’m failing to assign correct Physical / Bridge settings to the guest_lan interface as well (currently No Interface / not Bridged) … adding to my confusion.

3

Hello,

VLAN configuration is available here.

Is the issue with tagged VLANs only? If so, make sure you assign VLAN Tags to end devices as well. On Windows, go to Device manager → Select your adapter → Properties → Advanced → VLAN ID and set the VLAN ID configured on the router.

image

Kind Regards,

1 Like
5

imho: if guests are only wireless, then you do not need separate vlan for them.
you need create interface guest_lan, connect wireless_guest interface to it, and create one firewall rule, allowing traffic from guest_lan to wan. second rule - allow DHCP from guest_lan to router (udp 67-68 accept). any other traffic by default denied by firewall.

1 Like
6

Ah OK so tagged VLAN also requires setup on the individual devices? That might be more than I want. Cheers!

7

Yes – guests are only ever on Wifi – so perhaps your suggestion would do it, I’ll look into it, thanks!

8

look at my config samples, as example. I paste only relevant config parts for guest wireless

1) /etc/config/network
config interface ‘guest_lan’
option metric ‘6’
option netmask ‘255.255.255.0’
option proto ‘static’
option delegate ‘0’
option ipaddr ‘192.168.2.254’
option type ‘bridge’
option stp ‘0’
option force_link ‘1’

2) /etc/config/dhcp
config dhcp ‘guest_lan’
option interface ‘guest_lan’
option relay_enabled ‘0’
option force ‘1’
option leasetime ‘8h’
option start ‘1’
option limit ‘50’
option netmask ‘255.255.255.0’
list dhcp_option_force ‘3,192.168.2.254’
list dhcp_option_force ‘6,1.1.1.1,8.8.8.8’
list dhcp_option_force ‘15,guest.home.my’
Note: you also need to add guest_lan interface to dnsmasq interface list
config dnsmasq
option interface ‘lan guest_lan’

3) /etc/config/wireless
config wifi-iface
option device ‘radio0’
option mode ‘ap’
option wifi_id ‘wifi1’
option encryption ‘psk2+ccmp’
option key ‘For_Friends1’
option skip_inactivity_poll ‘0’
option hidden ‘0’
option ieee80211r ‘0’
option network ‘guest_lan’
option short_preamble ‘1’
option disassoc_low_ack ‘1’
option ssid ‘My_Guests’
option isolate ‘1’

config wifi-iface
option device ‘radio1’
option mode ‘ap’
option wifi_id ‘wifi2’
option encryption ‘sae’
option key ‘For_Friends1’
option skip_inactivity_poll ‘0’
option hidden ‘0’
option ieee80211r ‘0’
option network ‘guest_lan’
option short_preamble ‘1’
option disassoc_low_ack ‘1’
option ssid ‘My_Guests’
option isolate ‘1’

4) /etc/config/firewall
config rule ‘xxxx’
option proto ‘udp’
option name ‘DHCP4GUESTS’
option target ‘ACCEPT’
list dest_port ‘67-68’
option src ‘guest_lan’
option enabled ‘1’
option utc_time ‘0’
option priority ‘1’

config zone ‘yyyy’
option output ‘ACCEPT’
option name ‘guest_lan’
option log ‘0’
option conntrack ‘0’
option masq ‘0’
option mtu_fix ‘0’
option input ‘REJECT’
option forward ‘REJECT’
option network ‘guest_lan’

config forwarding ‘zzzz’
option dest ‘wan’
option src ‘guest_lan’

9

awesome – thank you! I’ll give this a shot tonight. D