Guest Wi-Fi over Mesh with VLAN tunneling
Vložit
- čas přidán 28. 05. 2024
- MANY THANKS TO ALL MY PATRONS on / onemarcfifty !!!
Please visit my channel page: / onemarcfifty
Want to talk to me? Join my Discord Server: / discord
How to extend e.g. a guest Wi-fi over a Wi-fi Mesh ? the mesh does not support VLAN tagging... In this video we will use GRE (Generic Routing Encapsulation) and tap devices in order to tunnel an ISO layer 2 VLAN over the Wi-fi Mesh with OpenWrt.
0:00 Recap Wi-fi Mesh
02:11 Options and the desired result
02:50 Setup Guest Wi-fi on the main Router
07:40 install the required software
08:40 Configure GRE TAP
12:11 Configuration 2nd node (Access Point)
15:40 Conclusions and Limitations
Marc on Patreon: / onemarcfifty
Marc's channel on youtube: / onemarcfifty
Marc on Twitter: / onemarcfifty
Marc on Facebook: / onemarcfifty
Marc on Reddit: / onemarcfifty
Chat with me on Discord: / discord - Věda a technologie
Hi Marc! I can't wait for your video about Mesh with B.A.T.M.A.N and VLANs 😊
It will come ;-) there are a couple of others in the pipe before however ;-)
I'm also eagerly waiting for the b.a.t.m.a.n tutorial. Great stuff!
I decided to get rid of my "zyxel multy u 3 node mesh system" . You can't use it without an app, and active internet connection. I was using it in bridge mode with my router. After I discovered your channel, I bought a mi 4a giga. İnstalled openwrt and now it's working. I bought 2 more of them and it's on the way. I'll try to build a wired mesh system by following your guides.
Thank you for these very easy-to-understand videos. Much appreciated. greetings from Turkey 🇹🇷🇩🇪
At first it didn't work for me (no IP address assigned to the guest interface on the second device) until I found out that "Input" for the new guest -> wan firewall rule was set to reject by default. Setting it to accept like it was visible on your video made it work. Afterwards guests were able to access the main router, to avoid this I configured traffic rules for DHCP and DNS as decribed in your other video and set Input back to reject afterwards again. Now it seem to work fine, thank you very much :)
Thank you for the detailed and informative videos. Please continue with OpenWRT project videos since these are generally cheap and consumer grade devices we can afford for home.
Hi Francisco - I will continue OpenWrt for sure. A lot of stuff is planned for the near future ;-)
Great video. Setup MSS Clam is necessary to avoid fragments.
Many thanks for the feedback - yes, you are presumably right. Clamping would work. It's a pitty that Path MTU discovery doesn't work the way it should ;-)
Nice video Marc, thanks for the details cover here. I will test this, as soon I buy another access point like that you have. Currently, I have three a rt3200 and 2 r6100. These last one, work perfect.
Cool - let us know how things go ;-)
Looking forward to part 3!!! Thanks for this video..
Thank you very much ;-)
Pretty awesome, please keep the openwrt advance configs coming....awesome!
I will ;-) Next ones will be about batman-adv, building an LTE router and adguard DNS filtering ;-)
@@OneMarcFifty awesome, I have always wanted to learn about batman-adv....your videos are awesome, specially the "call for action" piece. Love them!
Thank you sir,for all video...You're so great Teacher.
Thank you
Another excellent video. Idea - could you do something on using a RADIUS or similar server for Wifi APs, instead of pre-shared keys?
Hi Nick, many thanks for the suggestion - I had thought about stuff like OpenWisp, Ansible, Radius, OpenLDAP etc. for my videos but they are all more for larger deployments really and also - let's admit it - require additional effort to manage. I might do something in that space in the future but there's a lot of more basic/hobbyist friendly stuff that I'd like to do first like LTE, VOIP, OPNSense, Lag free remote Computing, QEMU/KVM/libvirt, more with Raspi's, Arp spoofing, more with Proxmox, Security basics, Reverse Proxy, Client certificates, Monitoring, 2FA/MFA, Airprint / Airplay, Synology NAS, NMAP/ZENMAP, Wireshark, Letsencrypt, Dashboards and....
thank you very much for your video, really interesting.
I have a doubt, I have a router-openwrt and an ap-openwrt, and the router have ssid with different vlans and I want to extend those ssids to the AP-opwnwrt, which has no cable connection, so question is , should I use for each ssid a specific mesh network and connect the vlan through a gretap tunnel interface for each vlan? or I could use a single mesh network to connect all the vlans associated to the different ssids and all within a single tunnel?
Thank you for the explanation... Can I connect a wifi device to the Vilan port on my kt412 openwrt device?
Really terrific again! Will you be covering the speeds between the access points over the mesh as well as between two devices connected to separate access points on the mesh? Finally, any speed results for internet access from the main router AP vs the mesh node AP? Thanks again for all of this.
Hi Brian, I'll take note of that and maybe will cover when I do the episode with batman-adv. Actually speed depends a lot on whether you have a separate (3rd) radio in your device (like the Asus Lyra MAP AC2200 for example) or if you are using one of the radios in mixed mode. I would assume that you could get up to 300 Mbps on one mixed-mode 5 GHz, maybe 150 Mbps on a separate 2.4 GHz backbone and presumably a theoretical 600 Mbps on a separate 5 GHz if you have enough CPU. But I will do testing.
Mark, thanks for your work. I set up a mesh according to your instructions for my IoT devices, but now I don’t understand how to transfer this vlan to the lan4 port on which I have qnap nas with homeassistant in docker. GRE TAP in this instruction already has a vlan, but how to transfer it to lan4 with a tag?
Hello great tutorial. Thanks for this. Short question the 2nd. device is a dump access point without Firewall rules. Only the Main router does have some. Does I need to create the FW Rules for Guest like in the main router for the dump AP, too ?
No. You define the firewall rules solely on the main router.
Confused as to what network to bind the 802.11s device to... I have also done this by simply using multiple mesh-ids and starting multiple mesh connections.
Hi Mike, that's definitely an alternative. The reason I bind the 802.11s device to LAN is that it makes an easier transition to the first episode of the series. The most flexible solution would however be batman-adv or the like.
Good video. Like the new format of the videos. A suggestion is to slow down the step-by-step just a little. Sometimes is a little hard to follow. Other than that, I'll be back again and again for the wonderful content.
That seems to be my eternal problem - going too fast at times ;-) Many thanks for your feedback !
Kicking myself for buying a router with wifi hardware from Broadcom!
Yeah Broadcom don't seem to be very open source friendly in my opinion. The problem is that hardware vendors sometimes have devies with the same name using different hardware as well and usually don't tell you which one is inside...
Awesome mate, thx! Do you know if it's possible to up the MTU?
It should be possible, even though I haven't done the calculations. This older article backreference.org/2013/07/23/gre-bridging-ipsec-and-nfqueue/ looks a bit more in depth into it
Great video,
I followed it and have set up a mesh (2 Linksys MR8300), and added IOT.
Have tried adding a lan port on the router/ap for IOT.
Have tried several methods inspired by your other videos, but to no avail.
Is there a description somewhere?
And you mention around 10:00 that it will perhaps be corrected later?
Hi Lars, maybe try batman ?
Top content
Thank you very much ;-)
Hi, Marc! Thank you for your excellent video. I've been watching them again and agian. I've a question resently. Could we only use 802.11s and vlan on the brigde (DSA) to set up eth guest WiFi? I mean without GRE and Batman-adv. I've been searching for this solution. But it seems no one metioned it. Maybe you can help me with it. Thanks again,
Hi, unfortunately no. You can't segregate traffic on a Wireless connection (using VLANs) like you could on a wire.
guest user network need the following point
1-allow to access the printer to print document
2-allow to access LCD or projector to show a PowerPoint presentation
3-the homeowner must redirect the guest network to the VPN nord vpn or surfshark to avoid illegal download (torrent)
Hi FreeMan, 1) can be addressed easily with a Firewall traffic rule 2) might be a bit more fiffling depending on the protocol (Airplay, Chromecast, (IGMP/mDNS and the like)) 3) I wouldn't use an outgoing VPN for that
First of all, great channel and videos! Do the steps in this video still work for firmware 22.03? I've double checked all my settings and can't get this to work. My setup is not a mesh network. I'm using a combination of cabling and WDS with three pieces of hardware (all with firmware 22.03): TP-LINK Archer A7 v5 (main router) TP-LINK EAP255-Outdoor v1 TP-LINK Archer A7 v5. The GUEST interfaces on the EAP225 and additional Archer A7 are not receiving addresses via DHCP. Thanks!
Hi Davin, difficult to say without checking the config in detail. Maybe join the discord and describe your problem in more detail there ?
Hi, thanks for the structured informative videos. In my house I am dependant on Powerline adapters. I can use a dedicated router as DHCP server, but I can't seem to find any resources on how I can extend vlans to Powerline adapters. I am currently using avmfritz Powerline and also Devolo powerline adapters lying around. If would be great if this were possible. Thanks
Oh - great point - I have never tested this. I'll need to dig them out in order to try.
Hi there im think in getting for me 3 xiaomi ax3600 and flash openwrt and then use you good videos to make a mesh ap from all of them. U think is a good idea?
As I said in another comment - to me it looks like the AX3600 is not supported by OpenWrt- please make sure you read up on the Forums.
@@OneMarcFifty is not fully suported but is working allmost anything and is the better router for the price in openwrt
I have bought the Belkin RT3200 and installed OPENWRT and now looking for 2 Access points. Which one is the best to buy to make access points? TP-LINK Archer C7 or the XIAOMI MI A4 Gigabit edition? Please help!!!
Please see my answer to your identical question on another video
Can you also make video series explaining vpn protocols and other networking videos? 🌻🌻🌻
Hi Swole, I actually do have a couple of those on my channel - have you checked them out ?
I deployed the mesh here at home, the main one is a redmi AC 1200 router and the node is a xiaomi 4a gigabit, working perfectly, but as they are at an approximate distance of 80 meters, the bandwidth that arrives at the node is ~1, 2 megabit download and 2 megabit upload with my total bandwidth of 20 megabit, and it runs CZcams, Netflix, Prime Video with a good image on a 43'' tv, I'll keep testing.
Hi Emerson, that's really low. Are you using the 2.4 GHz for the mesh (higher reach)? You might want to use directional antennas to improve the reach
@@OneMarcFifty Yes I am using a 2.4Ghz band, the signal is around -80 ~ -90 dbm and really the directional antennas can help to lower these numbers, thanks for the suggestion.
Hi guys, in this video we use gretap for VLAN tunneling. If anyone wants to test batman-adv ahead of the next video, then you may want to have a look at my recent pull request here github.com/openwrt/luci/pull/5698 and test it already.
Please visit my channel page: czcams.com/users/onemarcfifty
Want to talk to me? Join my Discord Server: discord.com/invite/DXnfBUG
Hello, but with this solution, the connection between the routers must be cable, right? Can it be done wirelessly?
Hi - this solution is 100% wireless. You can use an Ethernet backbone or Wireless mesh.
Great video! I'm left with two questions:
1) To bind the GRETAP tunnel to something other than LAN, would we maybe create a br-trunk device, add a dummy device, say dummy0 to bind the GRETAP alias @trunk and add the 802.11s mesh to that bridge, then segment the br-trunk device to create our lan, guest, and iot vlans? I think to do this there must be an interface (maybe called MESH) to name in the 802.11s mesh settings under the wireless tab, since the GRETAP tunnel needs a pair of IP interfaces to bridge. Is this correct?
2) What if we have three or more routers in the mesh? I assume we need to configure two separate gre trunk tunnels (one with the gateway router and router #2, and the other with the gateway router and router #3 as endpoints).
Actually, I think you answered the second question at around 16:08.
Plus - if you saw the latest video you might want to use batman for that ;-)
I have mesh metwork.. What if i want to add vlan to only 1 LAN port for my sip phone. And another VLAN for camera LAN port Is it possible to do the same instate of wifi??
Hi Ahmed, yes that would work exactly the same way. Just bridge the desired port with the desired VLAN
Tried this with 3200 and Xiaomi 4a gigabit router and D-Link 2695 all running 21.02 and up but the mesh kept dropping. Tried tweaking it but still no luck 🤞 instead switched to wds for now. If you have any suggestions please let me know. Thank you
Does the whole mesh drop or only the tunnel inside with the guest network ?
Hi, I am using a Archer C7 v5 as well, but my guest network only started working, when forcing the DHCP server (Interfaces -> GUEST -> DHCP -> advanced) for this IP range. Otherwise it would not give the devices a correct IP.
Many thanks for sharing this ;-)
Is this still valid for 23.xx openwrt?
Wow, thank you for making this video! I had no idea that OpenWRT could do tunnels!
I am confused about one thing, and that is the alias "@bridge.4" used as a PORT. The OpenWRT documentation only shows an alias "@" as being for a bridged interface. But in this video it looks like you used "@bridge" without creating a bridged interface first. I'm a little confused what this is doing under the hood, if you could help me understand this, I would be very grateful!
Hi Brian, basically this does the same like just typing in eth0.10 or eth1.99 - it creates the device ;-)
I am using your setup, almost. main router = c7 and second = xiaomi mi4a, openwrt 21.02. Following the previous tutorial, got the mesh up and running fine on wifi. Great. Then I thought I'd get fancy and follow this next tutorial and tunnel in a guest wifi. Everything worked Except I never got an ip address assigned to the guest interface on the second router. guest-wifi shows up in wifi analyser on my phone.
Question - is this tunnel in addition to the mesh wifi we/you created in the previous video of the series, or a replacement of? When I look at the video of your wifi setup, I don't see the mesh-lan wifi we set up before?
Also for anyone looking, when I tried to download software onto the secondary router I kept getting the "famous wget 4 error" saying I couldn't download. It was because the secondary router had no DNS lookup. So Interfaces->LAN->Adv->use custom dns 8.8.8.8
Thanks for setting me on the path to openwrt
Now this sounds to me like the 2nd AP is not really in dumb AP mode or - there might be leftovers of the firewall - have you switched off firewall and DNSmasq on the 2nd AP ? to answer your question: This tunnel is in addition to the first video. I might have called the mesh differently though. The idea is to tunnel an additional VLAN through the mesh.
Thanks for yet another awesome video. Looking forward to part 3.
I am also hoping in future videos you can tackle manageability challenges. The off-the-shelf mesh systems offer a central manageability and monitoring option. There's something called OpenWISP that supposedly can provide similar features. However with the limited videos I've found on it, I'm mostly lost in making any progress with it.
A second request I have is for some insights into the use of ethernet backhaul on-demand. Suppose I set up wireless mesh in this way, but use it really as fall-back, when the nodes are actually not connected over Ethernet. As it stands per this setup, if I connect a node to a router via ethernet cable, would there be 2 connections (wired and wireless) between the router and the node, and would it cause loop?
Thanks again.
Short answer to the second question. Networking is about redundant routes. So this can be done. But you need to engage a link state routing protocol like OSPF on the routers, so less preferable routes like the meshed ones are only taken, when the wired ones go down. I wouldn't take this road, though. Since a simple to fix problem with your wired routes will get invisible, without permanent monitoring. No good idea for home network, where you usually use kid alerts for monitoring ;-)
I like the term "kids alert" - very true ;-) I might quote you once I do my monitoring and alerting episode ;-) To answer the very first question - yes, I need to take a closer look at Openwisp as well - ansible is another option of course.
You can also try RADIUSdesk. (Similar to OpenWisp but it might be easier)
It has a sub project called MESHdesk which makes these types of setups a snap.
It uses Batman-Adv for the mesh and also now support WiFi g/a/n/ac/ax hardware.
FULLY Open Source on Github.
There is also a list of exiting new features which should start to come through in the next couple of months.
How I can get eoip tunnel for Tp-Link cpe 220 v3
A typo: 8:40 on the description 🧐👌
Thanks mate - I fixed it ;-)
Thanks for this video on GRE. Adding a tunnel device is certainly working, however, a second mesh device is much easier set up wise. What would be the cons of adding another mesh network?
Yes that would work as well.
I think one of the confusing things about OpenWRT is the "Use Default Gateway" option. From what I understand, when checked it is not USING a route but instead it is CREATING a route. Perhaps it should be "Create default route for this interface's gateway IP address", but the way it is currently worded one might think that if they didn't check it that the interface would not have access the internet.
I believe you could also think of it as being a mechanism to take a DHCP address and dynamically add it to the routing table for 0.0.0.0/0. Perhaps it shouldn't be visible under any interface type other than DHCP/DHCPv6/SLAAC.
You are right - the correct wording should be "Use this Interface as a default gateway"
Sir please make a video for load balancing in openwrt.. Thanks
Hi Rana, what type of load balancing are you thinking of? Two routers and if one goes down then the other one will take over? Or rather load balancing two connections on one router?
Hi Rana, what type of load balancing are you thinking of? Two routers and if one goes down then the other one will take over? Or rather load balancing two connections on one router?
Balancing two wan connections on a single router, preferably a wired wan with wireless one, or 2 wired wan connections.
Oh OK - great use case - I had been thinking about doing something with MWAN3 and balancing an LTE connection with DSL or the like…
That will be great sir 👍
I just hope I have enough memory on my router to do this
Is it possible to build diy VOIP for free?
Do you mean something to do phone calls over the internet or in the house from one participant to another or do you rather mean calling "regular" phone numbers? The first can be done easily as long as both participants hava a network / interrnet connection. For the second option you would always need a service provider that routes you into the phone network or - of course - you could use your existing phone line. Whether this is free or not depends on the provider.
Vxlan should also work
Hi Bernd - absolutely - this Wikipedia Article mentions at lest 3 more ;-) openwrt.org/docs/guide-user/network/tunneling_interface_protocols I'm sure you could even use PPPoE ;-)
I just can’t understand why we need VLANs in a regular home network 😖 Gods, give me mind!
Security. I don’t want my cameras being able to access the internet
Define regular ;-) - if you have one access point then you don’t need VLANs. They are used to replicate segregated networks in this video, i.e. if you want to have multiple SSIDs on multiple access points.
I need it because if someone goes to your house and want some internet, then just scan a QR code or pass an easy password for guest, then you don't have to worry about a malware that infiltrate to your network as well as limit the traffic for guest wifi.
for the same reason we need VLANs in any network, to isolate some devices from others
Can be many reasons. e.g. u can assign a subnet with only 2 IPs to prevent hacking. Can prevent your fridge or TV from flooding or sniffing your network. Prevent your guests from sniffing your passwords etc... Prevent certain subnets from going out to the internet such as CCTV. and many more.