Topic: Possible VLAN Configuration

The content of this topic has been archived on 14 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

Mandrake981

24 Feb 2012, 23:55

Hi guys,

I am wondering if it's possible to split out hosts in a VLAN by MAC address - all of them would be on wireless. I'd just basically like to be able to split some hosts off from the rest - so that the hosts on one VLAN can see each other, and the hosts on the other VLAN can see each other, but no-one from one VLAN can see anyone on the other VLAN and vice versa. Unfortunately, they are all on wireless, so I haven't found a lot of info on doing this kind of thing. If anyone has any insight, please feel free to share.

Thanks,
Randall.

Post #2

fyi

25 Feb 2012, 10:05

The easiest way is to separate them by different SSIDs. And, BTW, MAC addresses are not reliable and can be modified.

OpenWrt / SSID with multip VLAN's
Dynamic VLANs using hostapd OpenWrt by rpc

rpc wrote:

Dynamic VLAN is a configuration that enables us to authorize the user and automatically assigned to a defined network for the VLAN. This results in complete isolation and control of the various working groups such as the company.

Post #3

Mandrake981

25 Feb 2012, 16:55

Ah, OK, that makes sense. So I'd still need to set up a separate VLAN, but then assign that to the new SSID? If that's the case, then that sounds reasonable. I guess that essentially, it'd be the same thing as a "guest" access... I hadn't even thought about it that way.

As far as the MAC address being able to be duped, I don't think that's an issue. It's family - and I know they don't know how to change it. I just want to limit what they have access to, as things like printers aren't cheap to keep ink in. It's not a problem right now, but with these items not even showing up on their network, it won't be an issue whatsoever!

Thanks for the info... It's much appreciated.

Post #4

Mandrake981

25 Feb 2012, 16:56

Ah, posted too quick. I didn't pay attention to the links - just your post. Sorry.

Thank you for the links. I am following them now :-)

Post #5

fyi

25 Feb 2012, 19:35

Configure a guest WLAN - OpenWrt Wiki

Post #6

Mandrake981

25 Feb 2012, 19:38

Great, thank you. I am actually looking into the Radius setup that allows separate VLAN's - that's a perfect solution and seems easy enough to implement. I am in the process of setting it up right now, so I'll know soon how we're going to fare.

Thanks again for the links and info. You've helped a lot.

Randall

Post #7

ashkanull

29 Feb 2012, 23:07

apply this patch to your vlan_init.c and hostapd.sh referring to [OpenWrt-Devel,1/2] hostapd dynamic vlans and [OpenWrt-Devel,3/3] hostapd dynamic vlans

/packages/hostapd/patches/800-dynamic_vlan.patch wrote:

Index: hostapd-20111103/src/ap/vlan_init.c
===================================================================
--- hostapd-20111103.orig/src/ap/vlan_init.c 2011-12-04 14:52:34.927944410 -0800
+++ hostapd-20111103/src/ap/vlan_init.c 2011-12-04 14:56:13.895944447 -0800
@@ -403,8 +403,8 @@
/* Determine if a suitable vlan device already exists. */
- os_snprintf(if_request.device1, sizeof(if_request.device1), "vlan%d",
-    vid);
+ os_snprintf(if_request.device1, sizeof(if_request.device1), "%s.%d",
+    if_name, vid);
if_request.cmd = _GET_VLAN_VID_CMD;
@@ -487,7 +487,7 @@
while (vlan) {
if (os_strcmp(ifname, vlan->ifname) == 0) {
- os_snprintf(br_name, sizeof(br_name), "brvlan%d",
+ os_snprintf(br_name, sizeof(br_name), "br-vlan%d",
   vlan->vlan_id);
if (!br_addbr(br_name))
@@ -501,7 +501,7 @@
vlan->clean |= DVLAN_CLEAN_VLAN;
os_snprintf(vlan_ifname, sizeof(vlan_ifname),
-    "vlan%d", vlan->vlan_id);
+    "%s.%d", tagged_interface, vlan->vlan_id);
if (!br_addif(br_name, vlan_ifname))
vlan->clean |= DVLAN_CLEAN_VLAN_PORT;
@@ -534,7 +534,7 @@
while (vlan) {
if (os_strcmp(ifname, vlan->ifname) == 0) {
- os_snprintf(br_name, sizeof(br_name), "brvlan%d",
+ os_snprintf(br_name, sizeof(br_name), "br-vlan%d",
   vlan->vlan_id);
if (vlan->clean & DVLAN_CLEAN_WLAN_PORT)
@@ -542,7 +542,7 @@
if (tagged_interface) {
os_snprintf(vlan_ifname, sizeof(vlan_ifname),
-    "vlan%d", vlan->vlan_id);
+    "%s.%d", tagged_interface, vlan->vlan_id);
if (vlan->clean & DVLAN_CLEAN_VLAN_PORT)
br_delif(br_name, vlan_ifname);
ifconfig_down(vlan_ifname);
@@ -682,7 +682,7 @@
if (priv == NULL)
return NULL;
- vlan_set_name_type(VLAN_NAME_TYPE_PLUS_VID_NO_PAD);
+ vlan_set_name_type(VLAN_NAME_TYPE_RAW_PLUS_VID_NO_PAD);
priv->s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (priv->s < 0) {

The discussion might have continued from here.

Page 1 of 1