Guest WLAN on DD-WRT AP via VLAN
-
" However, if pfSense and the AP are configured for VLANs, it should work."
Why do you keep suggesting borked configurations.. Sending vlan tags over a dumb switch is not good practice…
I really need to grab a dumb switch off my shelf.. How does the dumb switch open the 802.1Q frame and look at the dest mac? if doesn't know the dest mac - would it not just flood every port.. So you basically turned your switch into a hub? So while the switch might pass the tagged traffic, won't it be passing the tagged traffic out every port since it doesn't know what its dest mac is?
It does work. If you have no need to manage a VLAN on a switch, an unmanaged switch works fine. As for the MAC address, it's in the same place as with any other Ethernet frame.
Here's a link to some VLAN info:
https://en.wikipedia.org/wiki/IEEE_802.1QNotice there is absolutely no difference in where the MAC addresses are. That's all the switch worries about, when forwarding frames. The 802.1Q VLAN tag is inserted between the source MAC and Ethertype/Length fields. Since Ethernet is designed to have any value, either type or length, in those 2 bytes, this is not a problem. Switches that can manage VLANs recognize the contents of the tag and handle the frame appropriately and unmanaged switches just pass on the frame as is. The only issue might be with older equipment that expect the frame to be no longer than 1518 byes. These days, with VLANs, MPLS and jumbo frames, switches are expected to pass any valid Ethernet frames without issue. Also, if you think the VLAN somehow obscures the MAC, you really don't understand Ethernet. Incidentally, gigabit equipment is expected to be able to handle jumbo frames, which can be 9KB or more. Those switches are not going to worry about the extra 4 bytes a VLAN tag adds to the frame.
You may be interested in a good Ethernet book. It's "Ethernet The Definitive Guide" from O'Reilly. It covers all this and more.
http://shop.oreilly.com/product/0636920028987.do -
Hey!
I simply tried today - and partly it seems to work. The part that's wirking is that the DHCP DISCOVERs and REQUESTs reach my pfsense-router at the right vlan-interface (capturable via diagnostics, also visible in DHCP system logs) and sends a nice OFFER back, but somehow it does not reach the client… SPI firewall is already disabled at DD-WRT...
What data do you need?
Again thanks in advance
dvs23 -
Are you using the DD-WRT as a router with the clients on the LAN side and pfSense on the WAN? If so, the DHCP requests will not reach pfSense and the ones you see must be coming from somewhere else. Are you certain they're coming from the client?
-
The requests definitely come from the clients, MAC and hostname match…
I followed this guide to make it an access point after reseting to factory defaults:
https://www.dd-wrt.com/wiki/index.php/Wireless_Access_Pointand this guide for the guest network (unfortunately in german, but there are pictures with the configuration):
https://www.flashsystems.de/articles/ddwrtguestlan-index/I loose my access while setting up VLAN's ("Kapitel 3"), because the DHCP requests do not reach my clients... By the way, the router itself seems to have no IP after this - Pfsense only tells me about one client at DHCP Leases - pfsense itself, no DD-WRT router...
-
You still haven't answered my question, is the DD-WRT being used as a router? When you see those DHCP requests, do they contain the MAC address of the originating device?
-
The requests definitely come from the clients, MAC and hostname match…
Yes, MAC addresss matches the address of the originating device, so they obviously also contain the address.
The long guide tells me to change the mode from gateway to router, so yes somehow it's still a router - but with wan connection type: disabled and without a dhcp server.
-
"unmanaged switches just pass on the frame as is."
That is the PROBLEM!!! Dude I just plugged in a dumb netgear gs108 between my trunk on pfsense to my smart switch…
Then I plugged in a laptop to another port - seeing every broadcast packet for EVERY vlan... What your suggesting is just BORKED!! Please do not suggest people do such things - especially those new to what vlans even are!!
And I didn't leave it long enough to figure out exactly why - but the laptop was not getting IP via dhcp either.. Running vlan tags over a dumb switch is pretty much the worst advice you could ever give.. Its just plain WRONG!! Please stop suggesting people can do it.. If you want to do it on your own network - have at it.. But please do not pass along such nonsense here.. Please!!!
-
Here is the packet capture file :)
Please tell me when you downloaded it so I can remove the attachment -
I do not see any vlan tags in that sniff.. But seeing 192.168.1 and dhcp for 192.168.2..
-
Then I plugged in a laptop to another port - seeing every broadcast packet for EVERY vlan… What your suggesting is just BORKED!! Please do not suggest people do such things - especially those new to what vlans even are!!
Yes, every frame, including VLAN will appear on the wire, no doubt about that. Now, how many devices will actually receive the VLAN frames? Only the ones that have been configured to receive it. If it's not been configured for the VLAN, the VLAN frame will be discarded.
-
The capture has been made by Diagnostics->Package capture from the VLAN-Interface "HOME", so pfsense seems to strip the vlan tags, but the package seemingly arrives at the correct interface (VLAN1) When I capture directly from a cable to the wan port of my router, the VLAN tags are there. If it helps I can post a cap file of that later, too.
-
The capture has been made by Diagnostics->Package capture from the VLAN-Interface "HOME", so pfsense seems to strip the vlan tags
That's why I like to use a managed switch, configured for port mirroring, and a computer running Wireshark to analyze network issues. If you used packet capture on the real interface, then you should see VLAN frames, as well as the native LAN traffic.
-
Well, buying a managed switch is no problem, I just cannot add a second wire to the APs… So I thought it would be unnecessary..
-
Well, buying a managed switch is no problem, I just cannot add a second wire to the APs… So I thought it would be unnecessary..
A VLAN to an access point is the usual method for multiple SSIDs. A common configuration is to have the native LAN used for normal users and the VLAN for guests, who are only allowed to access the Internet.
