Here's a general example for the switch section, this would go to /etc/config/network:
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports 'X X X Yt'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports 'X X Yt'
Before you do this configuration, you will need to use an SSH connection to the router and the 'swconfig' tool to identify how the physical ports of the router map to the ports on the switch chip. To do this, just plug an Ethernet cable between a PC or a laptop and each of the LAN or WAN ports of the router in sequence, and run 'swconfig switch0 show' after each connection.
For each test, you should see one port always connected (this is the CPU-facing port) and then one more, depending on which physical port you plugged the cable. Use Notepad or similar to write down the port numbers shown by swconfig (they start from 0) and the physical port numbers labelled on the router.
Note that the switch chip may have pin connectors for more ports than the number of physical ports on your router, so if 'swconfig' shows that you have 7 or 8 ports, and one or more of them is never connected regardless of which port you plug the cable in, then that's completely normal.
After you have identified the ports, fix the Xs and Ys on the config I've shown above so that three of the ports belong to the "LAN" VLAN, and two belong to the "WAN" VLAN. The port Y will be the port that is always lit (the CPU-facing port), and it needs to have the 't' suffix to indicate that packets going out of this port will receive the VLAN identier.
The LEDE project has documented the behavior of a switch quite succintly: https://lede-project.org/docs/user-guid … figuration The theory will help you understand how the switch works.
After you have written the switch config, it's time to fix the network interfaces, firewalls, Dropbear, DNS and DHCP configs etc. to match the new network infrastructure. You will use "eth0.1" to identify the LAN interface and "eth0.2" to identify the WAN interface.
Be careful to document and plan your entire configuration before you begin modifying the files or restarting the router or services. A mistake in your configuration may render your device inaccessible over the network when e.g. Dropbear is listening on the 'eth0' interface when it should listen on 'eth0.1', or due to a firewall zone being registered to wrong interface, or forwarding rules missing.
Also note that this configuration will bind the WAN port and one of the LAN ports to the same network interface. If you need to use two distinct network interfaces and do load-balancing, then you'd separate one of the two ports in the above switch config to a new switch_vlan section, and write a corresponding interface, firewall rules etc. for this VLAN.
(Last edited by Antek on 28 May 2017, 10:13)
Could you tell me what the new config. would look like? Is the vlan1 for wan and vlan2 for the lan switch?