1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

Vlans on Merlin (mini howto)

Discussion in 'Asuswrt-Merlin' started by c0mm0n, Nov 5, 2014.

  1. Ronald1368

    Ronald1368 New Around Here

    Dec 9, 2016

    What i want to do with my Rt-AC68U is the following:

    1 have switches that are connected to each other with a uplink , on a switch a have a untagged port in VLAN 100.
    i want the Asus to receive the tagged vlan on port 1 of the switch (this is the uplink) and i put port 3 untagged in VLAN100 and port 1 and 8 tagged
    But when i connect a dhcp server to the switch my laptop on port 3 of the Asus does not get a ip adress.
    i am new to scripting.

    what i did was :

    make a vlan 100, connected it to br0 and put ports in it 8t 3 1t,.
    i am not sure if i must put something in iptables or ebtables because i don't have to route anything it is on the internal switch.
    i use the latest MERLIN 380.63 .

    how can i achieve this goal?

    Kind regards,
  2. mhofman

    mhofman New Around Here

    Sep 12, 2013
    I started to go down the road of setting up my network to isolate some devices from each others (e.g. guests from authenticated, risky IoT & media devices from regular devices), while allowing some supervised communications between the groups (e.g. regular devices can control and present on media devices, but risky IoT devices cannot start probing my network).

    I also have the requirement that most devices are wired if possible, but I also have 4 APs to properly cover wireless devices (thanks plaster on wire mesh for creating faraday cages).
    While I haven't yet decided on the solution to isolate the devices from each other (bridge with filters or selective routing+broadcast relay), both would require setting up VLANs, sharing those over tagged ethernet, and bridging the VLANs with their respective virtual wireless interfaces.

    In a nutshell, the required steps are
    - configure the switch to offer the tagged VLANs on the physical port and CPU port.
    - create a virtual interface for VLAN ID
    - bring the interface up
    - create a bridge if none already exists for that network (e.g. bridge guest wireless with guest vlan, but isolate through routing instead of bridge filters)
    - add interface to the bridge
    - configure network and services on the interface/bridge, e.g. IPv4, IPv6 from prefix delegation and sla-id, Dnsmasq
    - setup firewall rules and/or bridge filters

    There seem to be a lot variations in suggestions on how to performs these steps.
    Most of them are user script based, optionally leveraging of builtin features through nvram configs.

    Ultimately, I'd like to have a solution where each step is performed at the right time (init, service start, lan up/down etc), with scripts containing as little configuration as possible, leveraging nvram for settings, in a way that doesn't conflict too much with GUI operations hopefully leverages builtin features.

    When digging through the firmware source, I realized some code exists for a lot of the vlan operations above, but it seems to be mostly behind the RTCONFIG_PORT_BASED_VLAN config flag, which seems to have been introduced in the code base when merging GPL code 380_2345 (https://github.com/RMerl/asuswrt-merlin/commit/c19e98a5072455965867004b3f07fb78d7b3bffe).
    From what I understand, when the config is enabled, 3 new pages are available (Advanced_VLAN_Content.asp, Advanced_VLAN_DHCP_Content.asp and Advanced_VLAN_Group_Content.asp), and a bunch of nvram settings control the VLAN operations:
    - vlan_rulelist to list the different vlans, their state, which ports and wireless interfaces are included.
    - lan%d_* to control the parameters of each lan, derived from vlan_ruleset it seems.
    - vlan_index to indicate the last lan index in use.
    - Some other related to filters, etc.

    It would seem that the vlan created are automatically numbered starting at vlan4, which is a bit of a bummer. I'm not sure if ports carry the vlans tagged or not.

    Has anyone tried to build a version of the firmware with this feature enabled to see how it works in real life?
    It would seem some limitations could be vlan ids and ipv6 prefix delegation subnets.

    At the very least, it should be a good source of inspiration for how to setup VLANs, especially everything in the following file: https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/rc/vlan.c
  3. Denna

    Denna Senior Member

    Aug 4, 2016

    Any chance of the above mentioned VLAN WebGUI tabs being enabled in a future version of the firmware ?​
  4. RMerlin

    RMerlin Super Moderator

    Apr 14, 2012
  5. lilCodie

    lilCodie New Around Here

    Mar 3, 2016
    If I recall the Merlin build, and official build are the only ones with HWAccel NAT/Switching and other ASUS/board specific features available - and ideally I want to use them as APs with dual ethernet running back to my main switch(s) and other ports for the TV, game console, or whatever is near - with each AP SSID on its own vlan and a dual gigabit LAGG/bonding/LACP(if possible) for the backhaul - with DHCPd, routing, NAT, DNS, and other stuff handled by PfSense - or with 1 of the AC66U's(or other Asus home gateway) as a router/DHCP/nat/AP/Switch and the other as Switch&AP - so having something, even if just to add VLANs to WAN [for customers needing it wanting to replace FiOs gear], and SSIDs w/ VLANs for guest isolation and on the switch maybe LAGGs/bonding/LACP(if available) to switch ports so port/wifi saturation doesn't max out the backhaul - and not anything overly complicated(dropping LACP if needed) would be nice - as running more prosumer gear(possibly with noisy fans) in the open with LAG/LACP/bonding, VLANs, and AP usually doesn't meet WAF or budget criteria just for the media center and main floor - unless you have ideas for other gear that might -- thinking maybe a MikroTik switch with dual SFP+, 8+ gigabit ports, and a standalone AP like AeroHive AP250 - but an ASUS RT-AC66U is much cheaper and my preferred route if someone has an easy way to do config - maybe with the APs pulling a readable/IOS/Broadcom like config down on boot, parsing it and running needed commands, or reading a local file? -- I know the official response is no GUI support ever, just wondering if we might get better CLI support or if people have any ideas for another device or way to do the config easier -- I'm just more used to Cisco IOS or Broadcoms fastpath OS(s) or a WebGUI - Not so much DD-WRT CLI/related CLI's. Thanks! PS sorry if the config method has changed some since I looked into it last and is much of what I stated - just point me at the links (i was also wondering if maybe parts of VyOS/Vyatta might be able to be used for a config file and parsing and such, although not sure how they do it either) Ideas anyone?
  6. burntoc

    burntoc Occasional Visitor

    Sep 20, 2015
    Hi @mystical, did you ever get this working and post it? I'm trying to figure this all out and it would really help. Thanks!
  7. Wisiwyg

    Wisiwyg Regular Contributor

    Feb 17, 2013
    Same here... I just want to setup an AP with one 2.4 Guest Wifi, tag it with a vlan, and then send that vlan out one of the 4 LAN ports. Still researching how to get it done.
  8. gpz1100

    gpz1100 Regular Contributor

    Aug 31, 2015
  9. Wisiwyg

    Wisiwyg Regular Contributor

    Feb 17, 2013
  10. SystemF

    SystemF Regular Contributor

    Sep 9, 2017
    Hi! I don't want to open new topic so will write here, recently swicth to Merlin, average user not an expert so please gyus bear with me. On rt-ac88u i want to do this for iptv: my internet is on vlan 2839 iptv on 546 untagged, the web interface can't set up maually, so i decide it to use script.
    robocfg show this:
    Port 0:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
    Port 1:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
    Port 2:   DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
    Port 3:  100FD enabled stp: none vlan: 1 jumbo: off mac: f0:de:f1:9d:50:77
    Port 4: 1000FD enabled stp: none vlan: 2 jumbo: off mac: a4:7b:2c:05:5f:ac
    Port 5: 1000FD enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
    Port 7: 1000FD enabled stp: none vlan: 1 jumbo: off mac: 84:c7:ea:3b:63:0b
    Port 8: 1000FD enabled stp: none vlan: 2 jumbo: off mac: 34:97:f6:23:66:50
    VLANs: BCM5301x enabled mac_check mac_hash
       1: vlan1: 0 1 2 3 5 7 8t
       2: vlan2: 4 8u
    From what i read, i manage to set up this not tested yet:
    # Force LAN Port4 to use IPTV
    robocfg vlan 1 port 0 1 2 5 7 8t
    robocfg vlan 546 port "4u"
    vconfig add eth0 546
    ifconfig vlan546 up
    brctl addif br0 vlan546
    Am I on right way? Imho everythig in script I wrote is wrong but...