4

I have a typical home network comprised of an ASUS RT-N16 router running DD-WRT, and a handful of wired and wireless clients. New to the network is a Raspberry Pi which will be used by a team for a school project I am working on.

The Pi is set up to run a reverse SSH tunnel to an Internet facing server so that anybody on the wider Internet can SSH into the device on my home network.

Because the Pi is available on the Internet, and also on my home network, I want to segregate it from all my other devices on my network. Effectively, I want the Pi on one side of a fence, and everything else on the other. All devices need access to the Internet.

At first, I tried unsuccessfully to set up two VLANs on my DD-WRT router, but after a day of messing around and forum surfing, it seemed like many people had trouble with firmware bugs. To make my life easier, or so I thought, I bought a TP-Link TL-SG108E "Easy Smart Switch" which advertises VLAN support. For the life of me though, I cannot get it to work like I'd expect!

On the TP-Link switch:

  • Port 1 - Goes to router's built-in switch
  • Ports 2-7 - Various clients of mine
  • Port 8 - Raspberry Pi to be segregated

First, I tried to set up Port Based VLAN. It seems like I couldn't assign port 1 (the router) to two VLANs at once.

Port Based VLAN Setup:

enter image description here

If I had chosen VLAN 2 to include port 1 as well, it would have been removed from VLAN 1.

I moved on to trying to set up 802.1Q tag based VLANs.

802.1Q VLANs

i.stack.imgur.com/79fQP.png

With the PVIDs

PVIDs

i.stack.imgur.com/5ItpX.png

This setup did seem to work when port 8 had a different PVID than 1 through 7, the Pi was unreachable from my LAN, but it was also unreachable from the Internet too! If I made the router PVID 1, my clients PVID 2, and the Pi PVID 3, nothing could talk to the router at all.

At this point, I'm confused and ready to admit my ignorance. What am I doing wrong?

Improve this question
  • The switch does not route VLANs, it only supports them and passes them through, the router does all the work and will need to have 2 VLANs (you only need 2, default VLAN1 and VLANx). VLAN1 is untagged on a router port, the other is tagged on the same port, and connect this to port one of the switch. VLAN1 is untagged on ports 1-7, VLANx is tagged on switch port 1 and untagged on 8. Remember that the VLANs have to have unique subnets and the router will have TWO addresses. If memory servers me correctly, the Asus routers under RT-N56 did not perform VLANing correctly though. – acejavelin Oct 28 '16 at 19:47
  • Nuts. That was my original understanding when I tried to set this up on the RT-N16 with DD-WRT. It seemed like changing the settings either via the web GUI, or through the nvram utility over SSH, never changed the router's behaviour; it always operated with one simple subnet, one DHCP server, etc. I found this to be a recurring thing when researching it. Is there another way I can simply isolate the one device on my network? – TroyDowling Oct 28 '16 at 20:11
  • Can't you just port forward 22/TCP to the Pi and restrict access at the device with accounts or routes, or even modifying the hosts file? You are not going to get 2 networks in a single location with this equipment. You could cascade 2 routers, with the Pi behind the first one, and all the rest of the devices behind a second one. – acejavelin Oct 29 '16 at 0:44
  • The issue is that my router exists behind the building's infrastructure so port forwarding isn't possible. That's why I've been using reverse tunneling. Using an additional router is a decent solution though! I have some spare equipment I can use for that purpose. I suppose I'll just have to invest in setting up a better router in the future. – TroyDowling Oct 30 '16 at 18:19
3

The segregation you are asking for is what Multi-Tenant Unit VLAN is good for. Quoting the help text in the switch configuration:

MTU VLAN (Multi-Tenant Unit VLAN) defines an uplink port which will build up several VLANs with each of the other ports. Each VLAN contains two ports, the uplink port and one of the other ports in the switch, so the uplink port can communicate with any other port but other ports cannot communicate with each other.

So you could use that and configure port 1 as the uplink port. Unfortunately that also means that ports 2 through 7 cannot communicate with each other.

If you need ports 2 through 7 to communicate, you need to look at other options, because the Multi-Tenant Unit VLAN feature does not appear to be flexible enough to allow that.

Port based VLAN as you have noticed cannot do what you want either.

That leaves tagged VLANs as your last option. But having a port be an untagged member of more than one VLAN is problematic because untagged frames sent to the switch could be intended for any of those VLANs, and the switch cannot know.

Instead what you should do is to make the uplink port to the router be an untagged member of no more than one VLAN and a tagged member of the rest.

On the router itself you also need to configure the same VLAN tags such that the router will know which VLAN a packet originated from and the router can tell the switch which VLAN a packet is for.

On the router this will look like two virtual network interfaces connected to the two different VLANs. And the recommended configuration is to have the router use different IP prefixes for the two VLANs.

Improve this answer
3

Your desired setup is definitely possible on this device. "Port Based VLAN" is not sufficient as it doesn't allow one Port being member of several VLANs. With "802.1Q" this is possible. My setup, which I had running on exactly this device, was more or less identical to what you would like to achieve.

My setup:

Portnum   Device     Member of VLAN   VLAN-ID INCOMING FRAMES GET ASSIGNED (PVID)
--------|----------|----------------|-----------------------------------------
Port 1     Router        1,2,3                        1                 
Port 6    Device A        1,2                         2
Port 7    Device B        1,3                         3

With this configuration, Port 6 and 7 are seperated from each other. Both can communicate with Port 1, but not with each other.

Explanation: Ethernet frames entering Port 6 get pushed onto VLAN 2. As Port 1 is member of VLAN 2, they can leave through this port and thus reach the device behind it (Router). They cannot leave through Port 7, as it is not member of VLAN 2. When the router wants to reply, its ethernet frames, which enter through Port 1, get pushed onto VLAN 1. Port 6 is part of VLAN 1, hence they can leave through this port. They could leave through Port 7, but as the frames do not carry the MAC address of the device behind it, the switch has no reason to make them do so.

Please find screenshots of my working setup below.

802.1Q VLAN page enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.