I just installed second router in network to extend infrastructure coverage. My previous network was handled by RB2011 2HnD, almost everything in one place, plus one device in another part of building connected through ethernet over powerline to RB2011 directly. However whereas it was sufficient solution on wired level, it didn’t provide any wireless access around this place. So I bought hAP lite (this EoP is 10/100 anyways)
So I have 4 networks handled by RB and I’d like to “export” them to hAP using this single EoP link so that all of them would be finally bridged between hAP and RB. Possibly securely because EoP is unencrypted.
How to achieve such network “properly”? At first I tried something with VLANs but I’m not sure if it can work, especially with wireless only networks and I don’t think it’s actually proper way to deal with such setup.
No it mentions how to bridge 2 wifi networks but that’s simplified version of what I need. I know how to bridge 1 network using one link on L2 level or 4 networks over 4 links but what I’m asking about is situation like this:
and ofc the same networks bridged. gw is gw, private is high trust level network with router config access, servers is network for WAN accessible hardware, lower trust, public is public wifi for guests, no security WAN only, secure wifi is protected wifi but without critical config access. So I want to “tunnel” multiple networks (4 or 3 without private bridging) with varius trust level/access range through single link between routers.
If you want the Hap to provide several diferent, isolated SSIDs, you’ll need to set up the virtual AP interfaces with VLAN modeuse tag, and set the VLAN id, so that traffic from wireless clients gets tagged on each VirtualAP interface with its respective VID.
You can then bridge the VirtualAP interfaces to the ether port that goes to the main router acting as trunk.
Then once back at your main router, you’ll need to create VLAN interfaces with proper VIDs, hanging from the ether port where the Hap is connected to, and bridge each VLAN interface with their respective networks.
Thanks a lot I’ve succesfully exported all 4 networks on wired level through VLAN including .1.0/24 for config. However I can’t set this VLAN mode on VWLAN interfaces. It makes AP isolated from anything. Laptop does connect to AP but i can’t access anything - even router itself. I tried both use tag and use service tag. None of them works.
On the other hand - what does it even do? I mean well, each VWLAN is bridged with different VLAN interface on both sides. So for example vwlan in br-alt bridge (.4.0/24) is bridged with vlan4 on both sides sooo… it should get only traffic from .4.0/24 directly on bridge level? traffic between lets say [ vwlan3 <> vlan3 <> EoP <> vlan3 <> vwlan3 ] link should be routed to [ vwlan4 <> vlan4 <> EoP <> vlan 4 <> vwlan4 ] on IP level, through firewall and only this way i guess. In addition to this I have firewall rules which filter out invalid src IPs on bridges so it’d filter out eg. packet with .4.6 coming to vwlan3 (I already had them before anyways because router was accepting packets from IPs not belonging to network and i found it quite disturbing).
However I can’t set this VLAN mode on VWLAN interfaces. It makes AP isolated from anything. Laptop does connect to AP but i can’t access anything - even router itself. I tried both use tag and use service tag. None of them works.
Torch the VirtualAP interfaces when the laptop is connected, can you see VLAN id there?
Problem is symmetric so I’ll just post hAP as it has shorter config.
I see that packets ARE incoming to router, RB even receives them on trunk interface from hAP but there’s no response. I see on RB packets incoming from phone but nothing else. Data is recorded on both routers in br-alt bridge traffic. Router itself also doesn’t respond correctly to input requests
Then you configure the IP addresses of the 2011, and the DHCP servers and firewall rules, etc - set them on the vlan interfaces.
If you want to make vlan10 appear on other ethernet switch ports of the 2011, then create a new bridge in the 2011:
/interface bridge add name=bridge-v10
/interface bridge port add bridge=bridge-v10 interface=vlan10
/interface bridge port add bridge=bridge-v10 interface=ether3
/interface bridge port add bridge=bridge-v10 interface=ether4
etc…
Furthermore, when bridging the vlans to other interfaces, you should move the IP, Firewall Rules, and DHCP services to the bridge-v10 interface (the vlan10 interface becomes a “dumb” bridge port)
Note that ether2 and ether3 in this example must not be running as slaves in the switch setup:
/interface ethernet set [find where name=ether3] master-port=none
etc…
The hAP is very simple - its IP address in the example is 192.168.0.2 and appears in the un-tagged IP network of the 2011 router - where 192.168.0.1 is configured directly on ether1 of the 2011.
Basically what the HAP does is whenever it sees an ethernet frame on the bridge with a tag of 10, it will forward this to the VAP1 virtual AP interface, and strip off the tag as it sends it over the air. Any traffic from the SSID1 hosts will get a tag of 10 added as traffic is forwarded onto the bridge. The 2011’s vlan10 interface will see this tagged traffic and accept it from the ethernet link - vlan20 and vlan30 will ignore traffic that has the wrong tag. Untagged traffic gets “past” the vlan interfaces and reaches ether1 itself.
That’s pretty much what I’m doing. The problem is VLAN mode doesn’t work on VAP interfaces.
Yes - bridges with vlan interfaces work properly, as in br-main shows only traffic from .1.0/24, br-alt only from .4.0/24 transferred through trunk (vlan1 and vlan4 respectively) in torch so I think this part works. VAP interfaces without vlan mode also work fine. But when I’m turning vlan tag on in wireless interface it gets screwed.
The key is that traffic between the 2011 and the hAP must have vlan tags on it, and the interfaces intended to participate in the VLANs must be connected to interfaces/bridges where the tags are present.
So on the hAP, a single bridge interface with ether1 and wlan1 conencted as ports is enough to “conduct” the vlans between the physical ethernet port and the wlan interface. I would think that you don’t want service tag mode - just regular “use tag” mode.
The way to confirm the hAP portion is correct or not is to try a ping from a client to the default GW while running the sniffer on the hAP - capturing the ethernet interface and saving the results to a file. After capturing some packets, download the capture file and open it in Wireshark.
The traffic coming from the wireless client should have an 802.1q vlan header on it.
vlan2.png
As I said with vlan mode “use tag” I can’t ping gw. I can’t ping even router itself from connected device. It doesn’t get any responses. Torch shows empty “VLAN Id” field on packets arriving through VLAN interfaces and trunk port, however as I said Torch shows only valid network packages when listening to VLAN interfaces.
I’d recommend disconnecting wlan1 itself from the br-main, and moving the current wlan1’s ssid / security profile onto a new vap.
(basically keep wlan1 as a “dumb” media-only interface) and connect the wlan1-base and wlan1-main (whatever you name the new vap replacement for the actual wlan1 interface) to the br-main
This is because the wlan1 interface itself carries all of the wlans, tagged or not, so when you connect the physical interface to br-main, then the devices on any of those vaps will have their traffic possibly leak onto br-main.
Also - you might start using vlan-id=10,20,30,40 - just because vlan id 1 is kinda synonymous with “untagged” vlan in many platforms.
I’m starting to think that VLAN mode isn’t really what i thought it is? I’ve just made plain VAP. Gave it router IP directly → .4.2 address on wlan4-alt interface. And with VLAN mode “use tag” hAP wasn’t able to ping phone using ping tool on hAP. After disabling VLAN mode it was able to do it. So idk… it looks weird to me. Exactly the same behavior on RB. Ofc I mean pinging phone from router directly connected to radio, not pinging through trunk
Well I thought that’s exactly what VLAN mode is supposed to protect form isn’t it? I mean i thought that all vwlans are switched on L2 level so that’s why i need to set vlan mode on each of them, am I right? If not then what is it for?
1.- Wireless: Create VirtualAP10, VLAN Id=10, use tag
2.- Create a Vlan interface VLAN10 hanging from from VirtualAP10, VID=10
3.- Assign an IP to VLAN10, say 192.168.10.1/24
4.- Set up e.g. DHCP, on top of the VLAN10 interface.
torch the VirtualAP10 interface, do you see the VIDs? Do you get an ip and can ping 192.168.10.1?
well, yes and no - if you bridge a physical interface that contains vlan-tagged traffic, then the traffic is going to be forwarded just like any other traffic, just with the vlan tags intact as well.
On the 2011, since you’ve got a bridge for each vlan, you’re essentially doing it all “by hand” so there isn’t a need for vlan tags there - the tags are needed whenever traffic goes between physical devices so device 2 can know which vlan device 1 considered the traffic to be a member of.
Notice how you never connected the trunk interface directly to any bridges, but instead connected the vlan interfaces? Do the same for the vaps on the 2011 (namely, think of the wlan1 interface itself as a trunk, and the vap interfaces as the actual interfaces in use). You use the vlan interfaces on the 2011 as a way of “signalling” to the hAP which bridge the individual frames came from. The hAP’s configuration can be much simpler because you just bridge the raw trunk interface to the raw wlan interface, and then the vlan tags are used to route the individual frames to the proper vap. Thus the hAP is being configured as a simple layer2-only device.
created wlan10, vlan mode “use tag” 100
vlan10 id 100 from wlan10
router ip .10.2/24, phone .9 static
works and actually requires “use tag” on vwlan (after vlan mode disabled phone can’t reach router). But torch still doesn’t show vlan id when listening to vlan10.
So current config actually does work? It just could be simpler but does work properly right? Well that cheers me up a bit at least I have plan B then. Besides I’ve updated my exports to current status - fixed VIDs and made wlan-root as physical AP interface without any network
I’ve succesfully exported all 4 networks on wired level through VLAN including .1.0/24 for config. However I can’t set this VLAN mode on VWLAN interfaces. It makes AP isolated from anything. Laptop does connect to AP but i can’t access anything - even router itself. I tried both use tag and use service tag. None of them works.
at least I have plan B then. Besides I’ve updated my exports to current status - fixed VIDs and made wlan-root as physical AP interface without any network