Help needed, WAP, guest VLAN, no DCHP response

Discussion in 'Tomato Firmware' started by JeffD, Dec 22, 2018.

  1. JeffD

    JeffD Serious Server Member

    I'm having problems with a guest vlan on a WAP being able to get DHCP address when connecting.
    The primary LAN (the main one) I can roam and jump between the main router and the AP.
    I have the VLAN configured the same on both main router and AP router.

    Wireless enabled in the admin / admin access but I don't think this is needed as it's wired and I'll only connect wired (thinking I should have this disabled, but Toasman's tutorial said to enable...)
    The authentication is correct on the AP and it's only after connecting that it can't get a IP address.
    The guest LAN is on a different sub-net and that information is the same on both routers.
    br0 is primary LAN
    br1 is secondary LAN (guest subnet)
    the main router is configured with DHCP enabled for both bridges, only difference is lease times (1440 for primary, 120 for guest).

    Secondary router uses lan port connected to main through lan port. The WAN port on the secondary is diabled and enabled connect through gateway when no WAN is enabled.

    I don't have any logging info because I don't have it enabled because I don't know what to do with that info yet.

    Are there any tricks or suggestions for why the secondary router (WAP) VLAN can't route DHCP request to the main router?
  2. rs232

    rs232 Network Guru Member

    I'm sorry but I find it very difficult to understand your scenario. 2 tomato devices? One primary one secondary? 2x WLAN (Primary and secondary)? Does the end to end connectivity work without involving wireless? Do youhave a network diagram of what the connectivity looks like? Can you post the VPN config page from both devices?
  3. JeffD

    JeffD Serious Server Member

    Thanks RS232, Can post the images. Currently working on the port mapping, I'm not sure this router has each mapped correctly, there's something strange about WAN/port4 I'm trying to figure out). I have tried and undone a couple things, but since I know you've been through this before I'll spare those details and discuss if you're interested. I tried to KISS. The one thing which isn't clear is if I want specific ports linked to a bridge...

    All the wifi settings (both 2.4 and 5G) are configured as APs (on each router), they are secure. Just one WAN.

    router1->as router (but gateway in adv/routing page) - this is the one with WAN access, DHCP server
    router2->as WAP (also as gateway in adv/routing page) - all DHCP disabled and all bridges enabled and mapped to VLANs but bridges not mapped to ports.

    I also couldn't enable tagging in the VLAN settings.

    Attached Files:

    Last edited: Dec 23, 2018
  4. rs232

    rs232 Network Guru Member

    Before going into DHCP... it seem like you're not trunking (tagging) between the 2 devices? Make sure you identify the port you use t interconnect the 2 devices and enable trunk on it for the VLAN you want to transport.

    e.g. from one of my devices

    make sure the tagging is enabled on the right port which might not be the one you're thinking it is.
  5. JeffD

    JeffD Serious Server Member

    Attached Files:

  6. JeffD

    JeffD Serious Server Member

    Interesting... if I try to put two bridges on a single port (say 4 in your example) I get a warning and it doesn't. Turns out user error! I needed to enable tagging on br0 before can link to another bridge... at least after the physical port to tomato port troubleshooting I think I have two ports I can use for trunking.

    Seems that fixed the wireless problem, but I've now got another problem accessing the router. I'll need to investigate if that's the switch or router. I'm a little confused if I should two wires from switch to router doesn't cause issues.
  7. JeffD

    JeffD Serious Server Member

    I've now completely confused myself... and I'm sure the router port mapping isn't helping.

    To check: if I have both br0 (for generic traffic from all ports as show earlier)
    Enable Trunk VLAN support override (experimental)
    br0 port 2 enable tagging
    br1 port 2 enable tagging


    Connecting a cable from any port to the switch I can access the router from any PC on the LAN.
    I can connect with the main wifi (on br0) when I move cable to any of the ports.

    I cannot get a IP address from my phone with the guest wifi (br1).
    Question: should I have one or more cables from the router to switch? Just one, right and if so, does the port matter? All are configured to br0 so I think one wire makes sense (along with eliminating parallel paths).
  8. rs232

    rs232 Network Guru Member

    I think you're adding way too much information hence yes you might get confused. Keep it simple :)

    No need for Enable Trunk VLAN support override (experimental) so disable it.

    I also suggest you ignore the switches for the time being and focus on the routers only.

    All you need are two bridges br0 and br1 on both devices which you define under network/basic with different IPs but same subnet. say: - -
    Do not even enable DHCP yet.

    Once they are defined use the VLAN image I posted above. Mine uses the router port 4 to tag traffic, your as far as I can see port 2. If the config is correct and especially you are using the correct port (main issue!) you should be able from router 1 to ping the br0 and br1 IPs of router2. At that point your wired VLAN end to end configuration is completed and only at that point you can start with the WLAN.
  9. JeffD

    JeffD Serious Server Member

    thanks again.

    The strange thing about the Enable Trunk VLAN support override, I can't do tagging without it:

    Here's if I enable it:

    I don't need to save or anything, just click it, that's all that's needed.

    I think I'll upgrade firmware again and make sure nvram is cleared during the upgrade in case it's a problem with settings.
  10. rs232

    rs232 Network Guru Member

    What version of Tomato are you running? Mine is Freshtomato 2018.4/5 and the Experimental reference is gone as far as I can see, not sure when this was removed though...
  11. JeffD

    JeffD Serious Server Member

    I had been running shibby's tomato-K26USB-1.28.RT-MIPSR2-132-VPN
    but just switched over to toastman's tomato-K26USB-1.28.7508.2MIPSR2Toastman-RT-VLAN-VPN
    I know both are old.

    Since I last posted I've done the update to advanced-vlan to "fix" the port ordering on my router
    In addition I modified trunk_vlan_support to default to a value of 1.
    My nvram boardflags show that port_vlan_supported will be 1, but my nvram trunked_vlan_so was 0, so I set that to 1.
    So, now I'm running toastman's build with the ability to enable tagging. I've just got this going on one router, so am still working on getting everything working.

    Will look up freshtomato too. These routers are old and slow, so flash and nvram are limitations.

    Interesting, only the miniVPN of freshtomato will work for me, but installing it looks like the best of Shibby's and what I had done. Trunk and tagging is now available. Will configure and test.
    Last edited: Dec 26, 2018
  12. JeffD

    JeffD Serious Server Member

    Ok, I'm not too clear on exactly how both ends are suppose to be configured.
    Here's what I got:
    Router 1 (on WAN):
    WAN1 configured DHCP
    br0 as the primary LAN address space:, DHCP enabled with pool of 100 addresses
    br1 for the VLAN address:, DHCP enabled with pool of 100 addresses
    VLAN 1 configured with all ports tied to br0, port4 tagged, WAN port to WAN.
    VLAN 2 configured with port 4 tagged to br1
    The wires out are on WAN port to modem, and port2 to the main switch in the LAN.

    Router 2:
    WAN1 is disabled
    WAN port not mapped to br0
    br0 is with IP in the (outside Router1's DHCP pool), DHCP disabled
    br1 for with IP in the (outside Router1's DHCP pool), DHCP disabled
    VLAN 1 configured with all ports tied to br0, port4 tagged, WAN port to WAN.
    VLAN 2 configured with port 4 tagged (VLAN1/br0) on br1
    The wires on port1 (to main switch), and port4 to a laptop.

    Does that sound correct?
  13. rs232

    rs232 Network Guru Member

    once again ignore DHCP, even better disable it for the time being.
    What is the subnet of IPs Router2?
    Can you ping the IPs of Router 2 from Router 1? If not work with the VLAN page.
  14. JeffD

    JeffD Serious Server Member

    Both routers are configured the same for subnets:
    R1 - br0 on, br1
    R2 - br0 on, br2

    Sorry, I'm confused.
    By disabling dhcp, are you referring just to br1?
    I wasn't clear on exactly what you were asking about the pings so all cases were tested, not sure if this is expected.

    laptop with fixed IP of
    Connected to R1 br0 (192.168.1 subnet),
    Ping (R2 br0 @ 192.168.1) works
    ping (R2 br1@ 192.168.10) unreachable
    Connected to R1 br1 (192.168.10 subnet)
    Ping (R2 br0 @ 192.168.1) works
    ping (R2 br1 @ 192.168.10) unreachable

    laptop with fixed IP of
    Connected to R1 br0 (192.168.1 subnet),
    Ping (R2 br0) unreachable
    ping (R2 br1) unreachable
    Connected to R1 br1 (192.168.10 subnet),
    Ping (R2 br0) unreachable
    ping (R2 br1) unreachable
    Last edited: Dec 26, 2018
  15. rs232

    rs232 Network Guru Member

    Almost. The first part of the test looks good(ish, I suppose this below worksalso right?

    ping from R1 while connected to br0

    e.g. VLAN1 (br0) can locally access VLAN3 (br1) but not the way around

    The second part of the test... I guess you plugged your laptop in a port assigned to the wrong VLAN (linked to br0 and not br1) that's why it doesn't work.

    Once it works you'll see it's nothing that complicated but the very crucial point to make this happening is to understand what port "WAN 0 1 2 3 4" in tomato correspond to which physical hardware port. Once you work out the link it's all coming together easily. Using a "modern" version of Tomato will simply this task as things have been corrected on a model basis.
  16. JeffD

    JeffD Serious Server Member

    Thanks, I think that makes sense. Freshtomato miniVPN, has a lot of fixes, and it looks like that status correctly reflects the connection, although the Invert Ports Order needs to be checked.
    I did assign different subnets to each port and found it does match what the GUI displays.
    I rechecked the pings:
    Wired to br0 (same router vlan1 192.168.1 subnet)
    ping (same router) worked
    ping (same router vlan3) worked
    ping (router 2, vlan1) worked
    ping (router2, vlan3) didn't work

    wired to br1 (same router vlan3, 192.168.10 subnet)
    ping (same router, vlan1) worked
    ping (same router, vlan3) worked
    ping (router 2, vlan1) didn't work
    ping (router2, vlan3) didn't work

    Should I have the VLAN tagging enabled during these tests?
    I think that's looking closer to what is expected can't get access to .1 beyond the .1 (local router).
    on .1 subnet had access to everything except remote (router2) .10 devices.

    I also discovered the advance/routing needs to remain gateway on WAN connected router, but can be switched to router on the second router (without WAN connection). At least I think that's right...
  17. rs232

    rs232 Network Guru Member

    On the second test this should have worked:
    ping (router2, vlan3) didn't work, equally you're not telling us where you physically connect for these tests? Are they all from R1?

    if you are connected to vlan3 physically you should be able to reach any device within vlan3
    Once you fix this you can go setting up WLAN and guest WLAN + DHCP and see if you can connect to either and roam around (give the WLAN same name but different channels)

    As far as I can tell you are using VLAN tagging right? Or are you talking about the "Trunk VLAN support override (experimental)?" If so no do not enable the experimental support not needed. Please post here the VLAN page for R1 and R2

    Do leave the mode to Gateway even if this is an internal AP with no wan connectivity. the "bridge WAN to br0" which you used on basic/networks is the only setting you're looking for.
  18. JeffD

    JeffD Serious Server Member

    Thanks, given your comments at the end I'm not sure I'm configured correctly. I hadn't used the "bridge WAN to br0" option, but I will.

    I'm using freshtomato miniVPN, so there is no more "trunk VLAN support override", that's not enable. I had also erased nvram when installing freshtomato, so should be no lingering settings...

    I currently do not have the tagging enabled on these vlan ports, I found doing this messed with my testing, but will reenable.

    I tested router 2 on port 4 (VLAN3, br1 the .10 subnet)
    Found I could only ping (router 2's subnet the PC was on, so that was looking good)
    All others (all .1 subnets and 10.1 didn't work. And I don't have any trunking enabled)
  19. rs232

    rs232 Network Guru Member

    Can you post the 2x VLAN config pages please?
  20. JeffD

    JeffD Serious Server Member

    I added trunking to port 4 (the 10 subnet) and found when connected to port 4 I can't ping anything.
    These are the settings from router 1 (nothing currently connected to P3 or P4) :

    These are settings from router 2. Laptop connected to P4 with set subnet 10 IP, 24 bit mask, and gateway of 10.1:

    From laptop connected through p4 on router 2 with the manual IP settings:
    Ping 1.1 (br0 on router1) and 10.2 (br2 on router2) get host unreachable
    ping 1.2 (br0 on router2) and 10.1 (br2 on router1) get timeout
  21. JeffD

    JeffD Serious Server Member

    Sorry forgot to answer this... those tests were all done connected directly to R1.

    The latest tests (post above this) were all done from R2.
  22. rs232

    rs232 Network Guru Member

    the VLAN settings seem to be correct. So the both VLANs 1 and 3 are extended between the two devices.
    What is it that you're trying to achieve now?

    P.S. What does this sentence mean? Connected what?
    "I added trunking to port 4 (the 10 subnet) and found when connected to port 4 I can't ping anything."
  23. JeffD

    JeffD Serious Server Member

    That means that after I added tagging to port 4 on VLAN 1 and VLAN3 and I connect a laptop to port 4 (and manually configure the laptop NIC to 192.168.10.x). At that point I can't ping any of these addresses:
    Pinging R1 (while connected to P4 on R2, meaning I'm in the .10 subnet):: (R1 br0) host unreachable (R1 br1 (had said br2 by accident earlier)) timeout

    Pinging R2 (while connected to P4 on R2, meaning I'm in the .10 subnet):
    ping 1.2 (br0 on router2) get timeout
    and 10.2 (br2 on router2) get host unreachable

    What does it mean that VLANs 1 and 3 are extended between the two devices?
    What I think this configuration means is that traffic coming in through P4 (br1) on R2 gets sent out whatever port on br0 to the default gateway configured in basic networking. The default gateway is use because "use user entered gateway" is checked under the advanced DHCP/DNS server settings.

    On Router 1 the traffic comes in over br0 and if external IP dest goes out the wan. if local with dest in .10 subnet goes through br1 to get to the dest? If local and in .1 subnet gets blocked? I'm totally confused as to how this is working. I don't have any devices connected to P3 or P4 (the ones connected to br1 on R1).

    Ultimately I want to have R2 be acting like a WAP and sending DHCP requests to the server on R1 to fill. That was not something I could get working. I had previously needed to have DCHP running on each router with different (non-conflicting) pools, and that's not idea. I'd like to have roaming working with wireless and not allowed to access the main LAN (.1 subnet).

    FWIW, here's my advanced dhcp/dns page (yes I've been ignoring it as you suggested. =)
  24. rs232

    rs232 Network Guru Member

    I stopped reading after you mentioned laptop on port 4.

    Are you clear on what a trunk is and what an access port is and the differences? Also are you clear that VLANs exist to separate and therefore you're not expecting to have your laptop to be able to ping everywhere are you?

    If these points above are not clear for whatever reason (we've all been there trust me!) it's probably better if you read up some good docs on VLANs and I'm sure everything will be crystal clear all of a sudden :)

    Then you can come back and we can finish this no problem
  25. JeffD

    JeffD Serious Server Member

    Thanks, I think I'm pretty clear on the use, but admit I'm not a network admin and this is a bit more than I have experience with, I can also be wrong. I do interchange VLAN and subnet, I understand they are different but thought it ok because VLAN is connected to a subnet but not sure this is required. I haven't found any great documentation on setting this up. Lots of information but often mis-information or something similar but different enough to not make sense (this is why I'm so confused!).

    When I was saying things weren't reachable I didn't mean it's always bad. But... there is something going on which isn't clear to me. For example, when on subnet 10 (VLAN3) I couldn't ping either of the routers on the same VLAN (subnet). (ie laptop connected to P4 for .10 subnet, I thought should be able to ping routers with ping 10.2 (R2 br1) or 10.1 (R1 br1)).

    I understand VLANs are basically like subnets, as they are independent and traffic across is not allow without some sort of interface between the two.

    I thought trunking allows the use of a single cable path between routers to get traffic from VLAN3 on one router to the VLAN3 on the other router. The VLAN1 to VLAN3 is not clear.

    There are other things like when I'm connected to .1 subnet on R2 why I'm able to ping .10.1 (R1's br1), but not 10.2 (R2's br1). I would expect that I should be able to reach both.
    I can reach both 1.1 (R1's br0) and 1.2 (R2's br0). There's something here which isn't clear to me.
  26. rs232

    rs232 Network Guru Member

    Ok with your last post I understand much between what type of input you need now. Read below:

    A subnet is defined at network (IP) level where VLAN is data-link (frame). So per say you could have multiple subnets in a single VLAN even thogh you usually have one and only one subnet per VLAN. Just to say they are not the same thing.

    A VLAN is created marking frames so e.g. adding 1 or 3 in your case to a specific area of the frame. This can be done inmultiple ways but for the sake of tomato the VLAN demarcation is performed on physical access port or Individual WLAN clients. A trunk allows multiple VLANS on the same link and should be use between routers only. There are exceptions but let's say only routers for the sake of this thread.

    Technically speaking two subnets belonging to two different VLAN can't communicate unless there's a routing engine in between them. Tomato being a router does this job indeed... but it has been designed for SOHO usage. So segregation between VLANs is the enabled by default where each VLAN is allowed into Internet only if that's makes sense. There are two exceptions to this:
    - the local router IPs (br0, br1, brx ) assigned to each VLAN are pingable from all the VLANS. Yes you read well. So if you have a client with 1.x IP you can ping the router .10.1 IP but nothing else.
    - To allow additional communication intra VLAN you could use the "LAN Access" page in tomato

    So going back to your OP if the IP from R1/br0 can ping the IP of R2/br0 and the same happen for R1/br1 towards R2/br1 your end-to-end intra router VLAN config is done and dusted.

    What you will want to do at this point is to yes enable DHCP on R1 only hopefully for both br0 and br1 and also enable the guest WLAN on both R1 and R2 assigning GWLAN to the br1 of both routers (the main WLAN whould be mapped to br0 instead). This way connecting to the main WLAN you get a 1.x IP where connecting to the guest WLAN you'll get a 10.x IP.

    Hopefully this is going to help you getting to the bottom of this issue.
  27. JeffD

    JeffD Serious Server Member

    Thanks for the clarification, I don't think I was too far off, but the VLAN/subnet issue was something that wasn't totally obvious except that they are independent but function in a similar way.

    So I'm back where I started, but with tagging and the results are different. I'm not sure if you'll say tagging is required, but this is where I'm at.
    R1 wired to WAN on WAN port
    R1 wired to switch on LAN Port1
    VLAN1 tied to LAN/br0 (.1 subnet), on Ports 1 (tagged), 2 and 3
    VLAN3 tied to LAN1/br1 (.10 subnet) on Ports 1 (tagged) and 4

    R2 wired to switch on LAN Port1
    VLAN1 tied to LAN/br0 (.1 subnet), on Ports 1 (tagged), 2 and 3
    VLAN3 tied to LAN1/br1 (.10 subnet) on Ports 1 (tagged) and 4

    Can connect to DHCP on LAN, WLAN and GWLAN (get .1 for LAN/WLAN and .10 for GWLAN)
    Can connect to from LAN/WLAN/GWLAN, I'm not sure guest wireless is good
    Can connect to other devices on .1 subnet with LAN only (expected), not WLAN (not expected) nor GWLAN (expected)

    Thanks again for the help, feels like it's getting close to correct.
    I haven't tried roaming but will soon.
  28. rs232

    rs232 Network Guru Member

    Apologies but I don't understand what you mean by tagged. If you play with VLANS you must tag all the ports/WLANs.

    Can you post the VLAN config page as per today please (including the bridge wireless to part), the "LAN Access" page and also "Overview" tab of Virtual Wireless? For both routers.

    Also when you say "can connect" how (wired/wireless) from where (source IP) and to where (Destination IP)?
  29. JeffD

    JeffD Serious Server Member

    Hmmm I didn't understand that as being true, (more of my confusion caused by countless web-guides where you don't even assign a port to a VLAN)

    I'll collect images and try to create a table showing connections with that info
  30. JeffD

    JeffD Serious Server Member

    Ok, this is Router 1 (


  31. JeffD

    JeffD Serious Server Member

    This is Router 2 (


  32. JeffD

    JeffD Serious Server Member



    The laptop2 IP4 Route Table starts with the two gateways, and I'm not clear why there are two.

    Active Routes:
    Network Destination_______Netmask_________Gateway_________Interface___Metric
    _________0.0.0.0__________0.0.0.0______192.168.1.1 ____192.168.10.100_____20

    wow that sucks, so much for spaces with a mono-spaced font... need to figure out nbsp in this interface
    Last edited: Dec 28, 2018
  33. rs232

    rs232 Network Guru Member

    Your config looks ok, I'm not sure about the colours you use for your test.
    I don't understand why laptop2 has a gateway? Is this set manually? All the clients within the same VLAN/WLAN must behave the same, if they don't it's a client issue.
  34. JeffD

    JeffD Serious Server Member

    Sorry about the colors, green=good, or as expected; orange=questionable; and red=what I believe is bad. The questionable include laptop2 with IP of not being able to access Although I think it's perfectly fine for laptop 1 on to be able to reach

    The second gateway on that second laptop makes no sense to me too. I thought that's discouraged by MS with their OS, but I think it's "legal". I dug through all the setting to figure out where that could be set, but came up empty. I think this may be what's allowing this laptop to access tomato on 1.1, but would then expect should be able to ping 1.1/2 due to the same setting.

    One question about something I said earlier about confused by online guides with VLANs and not specifying tagging. I guess what I should have asked is, do the VWLANS have an internal tagging that doesn't require the user to setup?
  35. rs232

    rs232 Network Guru Member

    the way VLANs are implemented in tomato is to tag on access port and WLANs so depended on how/where you connect you get tagged. The end device has no part in this what so ever (it could but hopefully it doesn't)
    Having said that make sure that your devices do not tag traffic some network card drivers allow you to specify the "default" VLAN. I suggest you remove any setting on the client side (if any).
    The client with 2 default gateway seems a client issue so outside the scope of tomato configuration.
  36. JeffD

    JeffD Serious Server Member

    Thanks again, been checking everything out and discovered my VoIP was not getting out.
    Can I ask, since P1 is tagged on both routers, should I not have anything connected to the physical ports?
    With the setup show above both routers connected to switches through router's LAN Port1, which seems good for most things. While troubleshooting VoIP I found that its traffic was blocked somewhere. It's IP address (static because it fails to accept the DHPC address given) is in the .1 subnet. if I move the switch connected to R1 to Port2 the VoIP traffic can get out. Both Port1 and Port2 are tied to br0. Does this make sense?

    I've also added a third VLAN on an 3rd bridge and have my IOT things running through a switch on R2 working correctly. Things are getting better!!

    Update: I appears there's something about the Ooma devices and a priority tagging which can conflict with VLAN tags. Unfortunately falls under your: "(it could but hopefully it doesn't)"
    Last edited: Dec 29, 2018
  37. Sean B.

    Sean B. Network Guru Member

    You should not have a switch in-line with the trunk connection between the routers. Traffic from other clients on the switch will not flow in with the tagged traffic, rather it will be dropped on either end. Enterprise level switches can assign their ports to VLANs facilitating integration of clients into said VLANs without that traffic having to first hit a router so the frames can be marked with the VLAN ID, but not consumer hardware as we're discussing.

    Also note that virtual wireless interfaces, such as the wl0.x's you're using, often don't work well with VLANs if the virtual interface is bridged to a different VLAN/subnet than its parent interface. Something to keep in mind if you encounter issues that seem to only affect clients connected to those virtual interfaces.
  38. JeffD

    JeffD Serious Server Member

    Thanks for the info, I had wondered if there's a need some parallel path between the two routers outside the switches just for tagged traffic. But I know you can't do that, and was just trying to understand what happens on a network level with the tags. RS232 clarified data vs IP handling that made sense the tags are outside IP headers, which makes sense. Now I need to think about this new point. I have some knowledge of the OSI model and how data flows, I just don't understand what tomato is doing and think I should look into that.
  39. JeffD

    JeffD Serious Server Member

    I decided to check out the freshtomato repo because I'm on a router with only 32K NVRAM and was looking to see if there's some make flag to disable WAN2 since I only have one and two is wasting lots of my tiny NVRAM space.
    In this process I discovered there are special builds for my router which I was never aware of located in the RT-N builds! Now I need to investigate that further.
  40. Sean B.

    Sean B. Network Guru Member

    I'd suggest reading up on 802.1Q, which is the protocol standard used for VLAN tagging/trunking, if you wish to learn or understand more about how the process works. For a place to start:
  41. JeffD

    JeffD Serious Server Member

    Thanks for the link, I'm familiar with the frame format and the rest makes sense.
    So I guess if you have tagging any port used in a VLAN that all ports should have tagging enabled?

    If VLAN P1 is the trunking line the all ports for all VLANs which are connected to that trunking line should have tagging enabled, right? The only other option would be parallel paths (one with, one without tags) and I don't expect that's valid to do.

    So, this wouldn't work if the trunk between routers lies on Port 1 and you connect a device on P2 of R2. The new device on P2 would get lost without tags?

    To fix you'd need to add tagging to P2 like this then all traffic between routers can be carried on P1?
  42. Sean B.

    Sean B. Network Guru Member

    Tagging should be enabled for the port that is carrying multiple VLAN traffic only. So if you have 2 VLANs of which reach across 2 routers, you would enable tagging on the port that connects one router to the other, and do so on both ends for both VLANs. IE:

    VLAN1/3 ---- Router1/Port1 <--cable--> Router2/Port1 ---- VLAN1/3

    You would include Port #1 in VLAN 1 and 3 with tagging enabled on both router 1 and 2. Any other ports you assign to either VLAN on either router should not have tagging enabled, and can only be added to one VLAN or the other, not both. Non tagged ports cannot be added to multiple VLANs, and tagged ports cannot be used as client connected endpoints.

    **NOTE** Technically, a tagged port can be used to connect to a client endpoint such as a desktop. However the desktops network card would have to support virtual interfacing a long with the 802.1Q protocol, combined with OS multihoming functionality. This is uncommon enough in consumer grade equipment that I justify saying "can't" be used in this fashion.
    Last edited: Dec 30, 2018
  43. JeffD

    JeffD Serious Server Member

    Ahhhhh no tagging on unshared ports? This would make sense. So on my previous screen shots, I think I incorrectly configured Port4. I should remove Port4 from VLAN1 and remove tagging from Port4 with VLAN4 because I'm treating Port4 as the gateway for devices which are all on VLAN4 (either through a switch or WLAN).

    Sounds like at a router level, tagging is just a secondary method of keeping VLAN traffic from the unintended ports/devices. The ports that only have a single VLAN attached don't need this secondary information because the there's no additional filtering/directing needed?

    If I understand... when a frame arrives at R2 through Port 4/VLAN4 and it's dest IP is routed through P1 then that frame gets the VLAN .1Q header added before being sent out Port1 to R1. R1 in turns find the frame on P1 with .1Q header and redirects that frame out Port4 (also VLAN4) and may strip .1Q header because port4 is exclusive to VLAN4. Is that close?
  44. Sean B.

    Sean B. Network Guru Member

    Let me toss out an analogy for VLAN tagging which may help explain the concept, as it's easy to over complicate what it's doing when you're trying to think about which router, which port number on which router, and which VLAN is involved at the same time.

    Imagine you have 2 prisons in the middle of nowhere, both prisons have several cell blocks with differing levels of privileges and security. Those prisons are connected by a pathway between them. So we have the prisons as your networks, prisoners as network traffic to/from clients, guards as the routers, and pathway as the ethernet cable between the routers.

    Scenario A, no VLAN tagging:

    A prisoner is being transferred from prison 1 to prison 2. The guard at prison one lets the prisoner exit and start walking the path to the other prison. When the prisoner arrives at prison 2, the guard would have two courses of action: Ask the prisoner which cell blocks he's allowed to be in and what privileges he can have - Or - Allow the prisoner access/privileges for only the cell block directly on the other side of the entry door.

    Obviously, asking the prisoner where he can go and what he's allowed to do is about as secure as handing him the keys and telling him to guard himself. This is why untagged ports cannot be assigned to more than one VLAN. If normal ports could be in more than one VLAN, you have negated the purpose of having VLANs in the first place, as it would be up to the client connected to that port to say which ones he's allowed to access. So on a normal port, the receiving router will treat the traffic as part of the VLAN the receiving port has been assigned to, as it has no trust for whomever may be connected to it.

    Scenario B, using VLAN tagging:

    Same situation, with a prisoner going from prison 1 to prison 2. Prison administration ( network admins ) have stated the pathway is not for public use, and fenced it from end to end. The prisoners are wearing colored overalls, of which the color corresponds to what cell blocks the prisoner is allowed to access and what privileges he has. Sense the pathway is now fenced, and the guards at each end know that when the prisoner was sent out onto the pathway the guard who released him made sure he was wearing the correct color, they can now securely provide access to multiple cell blocks on each end over one path.

    VLAN tagging is just a way of saying "this port is not used as a client endpoint, it is used for network infrastructure, and each packet will have a tag placed on it saying where it can go in a format both sides can read".

    To recap: Only the ports on either end of the cable connecting the routers together should be tagged. That is your fenced pathway. No other ports should be tagged, as access and policy governing traffic over those ports is to be determined by the VLAN the individual port has been assigned to on the receiving end.

    NOTE: It's worth pointing out that VLANs cannot exist without a subnets, and subnets cannot exist without VLANs***. Prior to VLANs, if you wanted to have segregated networks with differing access and privileges, you literally had to have duplicate routers/switches/cables/servers etc for each one. VLANs ( virtual local area network ) made it possible to achieve the same result over a single hardware infrastructure.

    ***This may not sound correct, because in terms of IP addressing, it isn't. However, without VLANs each subnet needs its own entire set of networking hardware to actually segregate its traffic from another, and so becomes a physically complete stand-alone network. At that point, the concept of subnets fades to something more like just "networks".
    Last edited: Dec 31, 2018
  45. JeffD

    JeffD Serious Server Member

    Thanks Sean, you got me pretty close to that with message #42. Prisoner analogy makes sense and close to what I understood. How to get that configured wasn't totally obvious with the limited experience.

    I'll update the settings shown in the first image in post 41 to remove Port4 from LAN(br0), leave Port4 in LAN2 but remove tagging from this port.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice