Differences

This shows you the differences between two versions of the page.

--- computing:openwrt [2021/04/25 19:28] – oemb1905
+++ computing:openwrt [2026/08/11 11:49] (current) – oemb1905
@@ Line 1: / Line 1: @@
 -------------------------------------------
-  * **openwrt**
+  * **openwrt-mt6000**
   * **Jonathan Haack**
   * **Haack's Networking**
-  * **netcmnd@jonathanhaack.com**
+  * **webmaster@haacksnetworking.org**
 -------------------------------------------
-//openwrt//
+//openWRT on two GL.Inet MT6000s//
 -------------------------------------------
+[[https://tech.haacksnetworking.org/2024/09/28/openwrt-on-two-gl-inet-mt6000s/|WordPress Version]]
+-------------------------------------------
+==== Introduction ====
+This tutorial reviews the unique manner in which I was able to get public and private interfaces/subnets/vlans set up on two GL.Inet MT6000s. One device is used as the router and has WiFi setup for emergencies, an openvpn server for external access, and public and private lan interfaces/subnets/vlans. The other device is in AP-only mode and only has the public and private lan interfaces/subnets/vlans. I'll call the first device the router and the second device the AP. The AP is centrally located in the house and has a cat6 that is fed to it from across the house where the primary wiring distribution is. The router has incoming DOCSIS cable internet from an Arris SB33 at 1200 Gbps and feeds into a 2.5Gbps WAN port on the router. The router then feeds a cat6 cable out of its 2.5Gbps LAN port into a 2.5Gbps switch, and from there to all remaining hardwired servers, devices, including into the AP device's 2.5Gbps LAN port. Fun ASCII drawing below.
+{{ :computing:screenshot-from-2024-09-22-11-19-17-2-1-1024x711.png?direct&600 |}}
+Only the router has a dhcp server. The AP is just a radio and serves two different public SSIDs and two different private SSIDs. Each is attached to the matching VLAN as entered on the AP. Alright, so now that I've provided the overview, let's review how to do this step by step. It might help others as its different than the way I'm used to doing this (1) and it will help me document and remember what I did so I can replicate in production for Haack's Networking clients (2).
+==== Setting up the Router ====
+The first step is to create VLAN filtering on the default br-lan device.
+{{ :computing:screenshot-from-2024-09-28-14-19-33-1.png?direct&600 |}}
+To get here, go to Interfaces > Devices > Bridge VLAN filtering. Enable the option and add as many VLANs as you desire. In my case, I want the ports tagged as I have above but you will likely need a different arrangement so make sure to alter or adjust these instructions for your use case.
+NOTE: You must not Save and Apply the settings above.
+Instead, you need to go to Interfaces > Interfaces > lan Edit > Device. Change the device from the default br-lan to the Software VLAN called br-lan.1 that you just created.
+{{ :computing:screenshot-from-2024-09-28-14-24-48.png?direct&600 |}}
+Once you've attached the lan interface to the newly created Software VLAN br-lan.1, you can safely Save and Apply the changes and your router will remain reachable. After this, you need to create a public interface, firewall zone, and two separate radios/SSIDs for each frequency that are attached to the public interface (not private). To do this, go to Interfaces > Interfaces > Add new interface. Enter something like pub for the name, switch the protocol to static address, and for device, you would select the other Software VLAN you created in the step above, or something like br-lan.192. The last three digits would be whatever you chose for the VLAN ID in the VLAN filtering step above. Once you complete these steps, your main Interfaces page and the public break down tab should look like the assets below.
+{{ :computing:screenshot-from-2024-09-28-14-33-05.png?direct&600 |}}
+As you can see above, you need to change the br-lan’s interface’s underlying Device from br-lan to the new Software bridge br-lan.1.
+{{ :computing:screenshot-from-2024-09-28-14-33-25-1.png?direct&600 |}}
+As you can see on the Interface overview page, the lan is connected to br-lan.1 and the VLAN is connected to br-lan.192 (for example). These are the two Software VLANs we created off the primary bridge device above. In short, we forked the physical hardware bridge into two separate VLANs and separated subnets. After creating the public interface on the router, make sure to also create an appropriate firewall zone. Yours might look something similar to this:
+{{ :computing:screenshot-from-2024-09-28-14-41-45.png?direct&600 |}}
+My router has an openvpn server as well, but that's not the focus of this tutorial. If you are interested in that, you can look over my openvpn server on openWRT wiki notes. For now, what's important to note is that you need to click on the pub zone, click Edit, then under "Allow forward to destination zones" make sure to specify the wan zone or your public interface won't be able to route out. More than likely, you will want to set input/output to accept, while forwards are typically set to reject. Once your firewall zone is setup for the newly added public interface on your router, you can now optionally setup backup SSIDs on the router. That is, in this design, we intend for the AP device (only) to handle WiFi and we will be setting that up soon. But/and, if the AP fails some point in the future, it's still a good idea to have public/private WiFi functioning on the router in case you need to fix or pull the AP out of production. Otherwise, the router SSIDs/radios remain disabled. Here's what the router SSIDs look like from the overview page, and also within each radio.
+{{ :computing:screenshot-from-2024-09-28-14-49-05.png?direct&600 |}}
+As you can see above, each frequency has both a public and private SSID setup.
+{{ :computing:screenshot-from-2024-09-28-14-49-18.png?direct&600 |}}
+Under the private radio/SSID, you can see that it is attached to the lan interface/subnet/VLAN.
+{{ :computing:screenshot-from-2024-09-28-14-49-35.png?direct&600 |}}
+As you can see here, the public SSID is attached to the pub interface/subnet/VLAN.
+The most important thing to note in the assets above is that the private SSID is attached to the lan network, while the public SSID is attached to the pub network. This is essential so that the router's dhcp server will provide devices connected on each interface different address schemes, for example, 10.0.0.X on the private subnet and 192.168.1.X on the public subnet. The VLAN IDs usually are named after the chosen subnets in some fashion, but that's optional of course. If you did not remember to establish differing subnets above for the lan and pub interfaces, do so now. Also, make sure that the dhcp tab under Interfaces > Interfaces > lan/pub Edit > DHCP Server is enabled and set up (on the router only).
+==== Setting up the AP ====
+Once that's done and once you've tested the radios and vlan/subnets for both private and public networks (on the router) and confirmed they work ... you can finally disable the radios and set up the AP. The AP device should be connected to the other device through its 2.5Gbps LAN port. The AP interfaces are set up identically except for two primary differences:
+  * You do not set up dhcp on either lan or pub interfaces on the AP
+  * Remove the WAN and WAN6 interfaces as this device is in AP-only mode
+Other than these key differences, you repeat the same steps as indicated above:
+  * Create the two VLAN IDs under VLAN filtering option on br-lan (on the AP) in Interfaces > Devices > br-lan Configure; make sure not to apply changes
+  * Change the Device in Interfaces > Interfaces > lan Edit to use br-lan.1 instead of br-lan
+After this you save and apply the changes, create your public interface, add the associated firewall zone to the public interface and attach the public interface to br-lan.192 (for example), or what would be the other Software VLAN you created for the public network. Here are example assets of those configurations:
+{{ :computing:screenshot-from-2024-09-28-15-04-52.png?direct&600 |}}
+The first thing you should notice is that there are no WAN or WAN6 interfaces present since this is the AP. Each interface on the AP is attached is to the same / matching name Software VLANs as were created on the router. Just like the router, those Software VLANs were created on the AP under Interfaces > Devices > br-lan Configure > Add VLAN Filtering; see the steps above for how to do this.
+{{ :computing:screenshot-from-2024-09-28-15-05-05.png?direct&600 |}}
+If you click Edit on the lan interface and look under the DHCP Server tab, make sure that Ignore interface is selected. The reason this information is populated is because the lan interface comes with DHCP Server enabled by default on the AP; one must disable it by selecting the box above.
+{{ :computing:screenshot-from-2024-09-28-15-05-26.png?direct&600 |}}
+When you create a new interfaces, as you will do on the AP for the public network, openWRT does not automatically create a DHCP Server and so there will be no information populated under the tab. This is what you want, as you don't want the AP doing DHCP, only the router.
+{{ :computing:screenshot-from-2024-09-28-15-07-05.png?direct&600 |}}
+The AP's firewall setup is also simpler because there's notably no vpn server on the AP. Otherwise, the zone settings are identical to the router. The last step on the AP is configuring the private and public SSIDs/radios, and attaching them to the lan and pub interfaces. This will also look very similar to the router.
+{{ :computing:screenshot-from-2024-09-28-15-13-39.png?direct&600 |}}
+==== Final Thoughts ====
+Just as with the router, the SSIDs marked "priv" in the picture above are attached to the lan Network under Edit, while the SSIDs marked pub in the picture above are attached to the pub Network under Edit. Once all of this setup, make sure to reboot both devices. Attempt connecting to both the private and public SSIDs/subnets/VLANs, make sure that you get assigned addresses on each network, can route out, and so on. If you can't, install tcpdump on the router and AP and begin problem solving. You can also use tools like ip link on your workstations to monitor dhcp solicitations and behavior. The workstations in this home and home office now all regularly get 800 - 1200 down, while most WiFi clients can reach 500-800 regularly now. As noted earlier, I keep WiFi off on the router, only using it if/when I need to take the AP down. Everything is just purring!
+{{ :computing:mt6000_3-1692964916.png?direct&600 |}}
+Update: 08-11-26
+When I first wrote this, I had the good fortune of having mainly dual-NIC machines in the shop / home office. For this reason, I simply untagged the main lan on the 2.5Gbps switch and untagged the guest lan on the 1Gbps switch. From there, I could simply run cables to each machine and had dual-connectivity to each vlan/subnet with minimal fuss. However, over time, I expanded this to having an additional subnet/vlan that is not tied to pihole+unbound. The reason for this was to mitigate downtime for others in the house if/when my pihole+unbound vms failed, etc., or a fallback interface / SSID as it were. This meant I either had to expand to get tri-NIC setups or finally setup proper vlan support on my clients. I chose the latter. First, I use managed ifupdown within Network Manager so I need to let it know to manage (not overlook) my interfaces file:
+  sudo apt install network-manager nm-connection-editor networking bridge-utils
+  sudo nano /etc/NetworkManager/NetworkManager.conf
+Inside there, make sure that your file includes these directives:
+<code>
+[main]
+plugins=ifupdown,keyfile
+[ifupdown]
+managed=true
+</code>
+Then, after that, install the vlan package and setup your interfaces file to match the ''.xxx'' vlan designations you created in openWRT.
+  sudo apt install vlan
+Inside interfaces, I setup the following:
+<code>
+# ===== First NIC (enp1s0) – 2.5G =====
+auto enp1s0
+iface enp1s0 inet manual
+# Private 10.30.30.0/24 – untagged
+auto br-priv
+iface br-priv inet dhcp
+    bridge_ports enp1s0
+    bridge_stp off
+    bridge_fd 0
+# VLAN 178 (172.60.60.0/24) – tagged
+auto enp1s0.178
+iface enp1s0.178 inet manual
+    vlan-raw-device enp1s0
+auto br-open
+iface br-open inet dhcp
+    bridge_ports enp1s0.178
+    bridge_stp off
+    bridge_fd 0
+# VLAN 177 (172.38.38.0/24) – tagged
+auto enp1s0.177
+iface enp1s0.177 inet manual
+    vlan-raw-device enp1s0
+auto br-lock
+iface br-lock inet dhcp
+    bridge_ports enp1s0.177
+    bridge_stp off
+    bridge_fd 0
+# ===== Second NIC (enp2s0) - 1Gbps =====
+#auto enp2s0
+#iface enp2s0 inet dhcp
+# this was moved to NM only since they seemed to fight over this one
+#If bridge is needed on enp2s0, use the following
+# VLAN 177 (172.38.38.0/24) – untagged
+#auto enp2s0
+#iface enp2s0 inet manual
+#auto br-lock2
+#iface br-lock2 inet dhcp
+#    bridge_ports enp2s0
+#    bridge_stp off
+#    bridge_fd 0
+</code>
+For the second NIC, I found that - if left unbridged - Network Manager would take it over. Of course, you could disable the interface in Network Manager's connection editor, which let ifupdown take over. You could also just comment out the second interface in ifupdown and let Network Manager handle it. Since I was not bridging the second interface, only the first (including the three subnets/vlans), I decided letting Network Manager handle it was fine. I did, however, put the entries above showing how you could just as easily let ifupdown handle the second NIC and/or even bridge that interface too within ifupdown. I found upon reboot that ''ifupdown-pre.service'' was trying to do stuff before the vlans/subnets all got raised, causing failures. For that reason, I disabled the service:
+  systemctl mask ifupdown-pre.service
+After that, I was able to freely reboot without errors. Every once and a while a bridge will take a bit to raise or fail to raise. If that happens, just restart networking and it populates. It takes time for all the negotiations, so this is a feature not a bug from what I can tell.
+-- -- OLD STUFF - EDIT -- --
-For the language and style save page error during upgrades, check the luci configuration file that came in, as it likely is missing the configuration option below it on the new config file.  I can't remember the wiki that helped me on this or why bringing in the new packages does not bring in a proper config file, but regardless, here is the fix.
+This is a general openwrt wiki page, for flashing the OS onto routers and/or common issues/configurations for its use.  The first main error I get is that when I upgrade, I get a language and style save page error because the new configuration file that comes in is missing the line/option below.
   nano /etc/config/luci
-In the file that opens, make sure the configure internal themes parameter has the bootstrap entry below it, which it likely will not.
+Check the option Bootstrap part - it is likely missing and/or not complete.
   config internal themes
           option Bootstrap '/luci-static/bootstrap'
- --- //[[jonathan@haacksnetworking.com|oemb1905]] 2021/04/25 13:24//
+ --- //[[alerts@haacksnetworking.org|oemb1905]] 2025/12/23 02:35//

Haack's Wiki

User Tools

Site Tools

Differences

Page Tools