1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

Wire interface isolation + DHCP

Discussion in 'Asuswrt-Merlin' started by acedev, Nov 8, 2018.

  1. acedev

    acedev New Around Here

    Nov 8, 2018
    Hi everybody

    I've been trying to archive the following setup with Asus AC86U + latest Merlin FW RT-AC86U_384.7_2:


    1. 2 wan interfaces in h9standy mode. Got this with

    nvram set wans_standby=1

    2. Isolated subnet with externa DHCP server. Just disabled DHCP on br0 using web interface. External DHCP works with subnet.

    3. Isolated eth1 interface with separate internal DHCP server range
    Got this with

        ip link add br2 type bridge
        ip link set eth1 master br2
        ip addr add broadcast dev br2
        ip link set up dev br2

    4. Isolated wl0.1 interface with separate internal DHCP server range
    Got this with similar to above solution with eapd custom settings found here in forum.

    5. Custom routing solution with ipset, ip route and iptables. Important note: there is no routing between bridges, they are isolated.

    Problem is looks like router works like a regular switch during the boot and eth1 interface is connected to br0.
    In that time client station gets lease from external DHCP server, lets say After all bridges have been configured it tries to update lease and in some way gets through all iptables rules to external DHCP again.

    I closed all br0 <-> br2 communtication through iptables in FILTER table and thought it may be related to dnsmasq, which listens on all interfaces in bind-dynamic mode and may just proxy request. I tried to kill dnsmasq from console during DHCP request, again, no luck.

    When client tries to get new lease it suggest old IP address, I see this request in br2 with tcpdump.
    Then I see DHCP answer from external DHCP on br0. What really bothers me I don't see DHCP request on br0 and DHCP response on br2.

    Then I though it may be related to HW acceleration on the router. I tried to use

    nvram set fb_disable=1
    nvram set runner_disable=1
    commands, but I'm not sure they really disable acceleration or that's just some kind of flags.
    At lease web interface showed both of them are disabled. This didn't help neither.

    Finally I got the idea I just can't take out eth1 from br0 because it is set up already somewhere inside FW as a bridge and what I do with brctl command makes no sense. I've found mention of robocfg command, which is unavailable and replaced with with ethctl, however there is no information on this command yet.

    Could somebody clarify this situation?
    Is it possible to setup such configuration?

    Thank you in advance.