Managed switch behind router for IPTV VLAN handling

Question

There are numerous similar topics, but still not exactly what I needed, or discussions are a bit outdated.

I have IPTV+Internet coming from my provider. They are divided into VLANs (IPTV VID=6, Internet VID=2). My provider gives us pre-configured router which supports port sharing (i.e. same port/cable for IPTV and Internet), however router itself is meh - connection drops happens quite often.

I have another much better router - Asus RT-AC68U (with Merlin firmware), so it's a shame I'm forced to use cheaper one provided by provider. I'm still trying to configure it. I had almost no issues configuring IPTV on dedicated port on Asus (IPTV works, Internet - not). However it's not sufficient solution for me, because I have one cable going from router to numerous devices, not just IPTV box.

Seems like there is no easy option to configure Asus route like provider hacked their own routers (probably it needs more modded firmware). I have to admit I gave up on that. However I have another idea, but I'm not very good at networking so have doubts it would really work.

I heard some buzz/suggestions about managed switches and that they might help with VLANs. So I'm considering to try such approach. The idea is that router will get and send further all data "as-is" and then I can set VLAN VID=6 on the managed switch on some port and connect my IPTV box to that port. However I'm really not sure if managed switch will get same VLANs "as-is" from router, or router is trimming it for good..

It's not easy to find appropriate managed switch (I don't really need professional one for 1000$$, with 24+ ports), so I'm trying to investigate if it's viable solution at the first place.

My planned topology:

Answer 1

It's not easy to find appropriate managed switch [..] I'm afraid it might lack some specific features. Usually it's Layer 2 switches, while there are some more VLAN features only on Layer 3.

ISPs generally use 802.1Q-tagged VLANs, and those are entirely layer-2. (Some switches support "Layer 3 VLANs" or "IP VLANs", but those are not the same thing as 802.1Q VLANs. You practically never need these features.)

As long as your switch declares 802.1Q VLAN support, it'll work... The real problem is that the router also needs decent 802.1Q support.

my main question is still if such switch would work in general, or if it's behind the router - router will trim "VLAN" data

VLANs are a layer 2 feature and work "under" IP – so they are terminated at the router just like real Ethernet connections would be. Each VLAN acts as a separate virtual interface, with its own IP subnet and routing.

(And just like real Ethernet connections, they can also be bridged; indeed your ISP router is most likely configured to bridge the IPTV VLAN 6 on both sides, while still routing between LAN and the Internet VLAN 2.)

So in your plan, it is not enough to just have a managed switch that'll untag/demultiplex the VLANs – the router needs to be able to (re-)tag them in the first place. In other words, your Asus must support 802.1Q VLANs on the LAN side, not only on the WAN side.

For example, to "transfer" IPTV VID 6 through a router, you'd (in generic terms):

1. create a tagged VLAN 6 on the WAN side,
2. create a tagged VLAN 6 on the LAN side,
3. create a bridge between the two (WAN.6 ↔ LAN.6).

(Note 1: Doing the same for the Internet VID 2 makes no sense – you don't want your game console or random other devices to directly be "on the Internet"; you want them to be on your LAN first and go through the router for Internet access. Your LAN is not the same VID 2 as the Internet VLAN.)

have another much better router - Asus RT-AC68U (with Merlin firmware), so it's a shame I'm forced to use cheaper one provided by provider. I'm still trying to configure it [...] Seems like there is no easy option to configure Asus route like provider hacked their own routers

802.1Q VLAN tagging is actually a quite standard feature among higher-grade routers, so it's a shame the expensive Asus lacks features that a cheaper ISP device has. ^{(Buy Mikrotik or Ubiquiti.)}

On a less snarky note, I found a forum thread mentioning that 802.1Q tagging is in fact available on Merlin firmware, but only through SSH command-line and not through graphical interface.

So if that advice from 2014 is still valid, then you should be able to use robocfg and nvram to configure a LAN port with multiple 802.1Q VLANs on it.

---

However, if your router's firmware absolutely doesn't support 802.1Q on LAN ports, you can still achieve a similar result using port-based VLANs, which you mention that your Asus does support. But you will need some device which is able to tag/multiplex the VLANs onto one cable. That means buying a second switch and connecting them like this:

router              switch 1                          switch 2

                    port 1 (tagged 1+6)   ========    port 1 (tagged 1+6)
port 1 (LAN)   ---  port 2 (untagged 1)               port 2 (untagged 1)  ---  console
port 2 (IPTV)  ---  port 3 (untagged 6)               port 3 (untagged 6)  ---  TV

A downside of this method is that you lose more ports on the router, but it is compensated by having a bunch of spare ports on switch 1 instead.

(Note 2: Yes, it is possible to bridge the physical LAN and WAN interfaces and get all VLANs passed through... but then the router will no longer act as a router. Remember note 1: Your LAN is not the same VID 2 as Internet VLAN.)