Hello all,
I am trying to setup a DMZ on a VLAN separate from the local private lan.
So far I have read through much of the documentation and seen that it doesn't apply very well to my particular router but this is probably just ignorance on my part; and I suppose that's why I'm here.
As far as I can tell based on the documentation, the steps to setting up a DMZ go like this:
1. Partition your ports into separate VLANs
2. Setup Firewall Rules for the new VLAN
3. Restart the network and the firewall.
So far I've had limited (success?) in step one, here is what I've done so far:
I read over the Network Interface section of the wiki and determined that I wanted to use one of my router's ports for a new VLAN which would become the DMZ.
After taking a look at the documentation for my router I determined that I wanted to make the LAN Port 1 the port for my DMZ.
If you look over by that blue cable on the left there's a tiny almost impossible to see abs inset label that reads "1".
The documentation states that LAN "1" should be port 3 where it is mentioned in the configuration file /etc/config/network
And so I modified the existing configuration file as follows:
...
config 'switch_vlan'
option 'device' 'rtl8366s'
option 'vlan' '1'
option 'ports' '0 1 2 3 5'
...Before modification
...
config 'switch_vlan'
option 'device' 'rtl8366s'
option 'vlan' '1'
option 'ports' '0 1 2 5'
config 'switch_vlan'
option 'device' 'rtl8366s'
option 'vlan' '2'
option 'ports' '3'
...After modification with port 3 assigned to a new vlan
After restarting the network, I tested this new configuration by running the swconfig command to make sure the ports were all where they were expected to be, and was delighted with the results:
swconfig dev rtl1886s vlan 1 show
VLAN 1:
info: VLAN 1: Ports: '0125', members=0027, untag=0027, fid=0
fid: 0
ports: 0 1 2 5swconfig dev rtl866s vlan 2 show
VLAN 2:
info: VLAN 2: Ports: '3', members=0008, untag=0008, fid=0
fid: 0
ports: 3And just as would be expected port 3 is now on vlan2 and ports 0 1 2 and 5 are on vlan 1.
Now my new vlan has no ip address and I'm not entirely certain how to assign it one.
I looked at the lan configuration and it appears to be tied to a physical interface a few lines above in /etc/config/network:
config 'interface' 'lan'
option 'ifname' 'eth0'
option 'type' 'bridge'
option 'proto' 'static'
option 'ipaddr' '192.168.1.1'
option 'netmask' '255.255.255.0'
option 'ip6addr' '2001:470:1f0f:ea7::/64'Upon seeing this and also looking at the dmz howto I tried to configure the new vlan in much the same way (even though I don't really understand how vlan 1 and lan are connected):
config 'interface' 'dmz'
option 'ifname' 'eth0.2 # Corresponds to vlan 2 (some how...)
option 'ipaddr' 192.168.2.1 # Remember this is a separate network.
option 'netmask' 255.255.255.0With this I got the error interface type not supported
I also tried to take a look at the Interfaces under OpenWrt section of the wiki, but I'm having a difficult time translating it to my routers configuration.
I even tried making a diagram that would match my routers configuration, but the examples don't on that page don't appear to have any context, and thus I'm confused by them; for instance under Interface Configuration it lists some lines of configuration, but they dont' appear to be placed in a config block:
vlan0hwname=et0
vlan0ports="1 2 3 4 5*"
vlan1hwname=et0
vlan1ports="0 5*"I guess my question is "What do I need to do to assign an ip address to my new vlan? And how do I associate the dmz interface with a port?"
Thank you,
Andrew J. Leer
(Last edited by leeand00 on 2 Nov 2011, 05:16)
