IT-LINUXMAKER, OpenSource, Tutorials

Setting up VLAN on WRT1200ACv2 and OpenWRT

Unfortunately, the Linksys WRT1200ACv2 router is poorly documented in relation to OpenWRT, so I'm publishing the procedure for initializing VLANs (virtual LAN interfaces) here, especially since it's a bit tricky. I currently have "OpenWRT 23.05.0" installed on the router. DD-WRT was no longer an option for me, as there had been virtually no changes since 2010, and OpenWRT offers significantly more flexibility than OpenWRT.

I also have the LuCI web GUI installed, allowing administration via a web browser.

It is also important to know that we are not dealing with an Atheros or Broadcom chip, both of which are very well documented, but rather the switch is a Marvell 88E6176 chip.

Structure and distribution of ports in Marvell 88E6176

The diagram documents how the switch ports are mapped to the external ports (LAN and WAN). This will be important later when configuring the switch with VLANs. Additionally, the CPU also has two ports (CPU ports) that are mapped to the Ethernet interfaces eth0 (SW port 5) and eth1 (SW port 6).
The two WLAN interfaces wlan0 (2.4 GHz) and wlan1 (5.0 GHz) are not included in this diagram, as they are configured separately in OpenWRT.

Security measures before a network configuration

First, it's very important to back up the current configuration via LuCI "System=>Backup/Flash Firmware." It's also useful to know how to access the original firmware if it hasn't been replaced. This also happened to me when I had OpenWRT installed twice. However, the LinkSys firmware could be flashed again without any problems.
This is because when the firmware is flashed, the new firmware is written to a second partition and set to "bootable." The original firmware is therefore not overwritten, but exists parallel to the new firmware on one of the two partitions.

To get to the previous firmware (Linksys) use this procedure:
Download the original firmware for WRT1200ACv2 only. This firmware is then flashed as usual.

Changing the boot partition and thus the firmware

Turn the device (tested on the WRT1200ACv2) off using the power button and then turn it back on. As soon as the power LED starts flashing, immediately turn the device off again using the power button. Do this three times. The fourth time you turn it on, you'll boot into the other partition as normal.

This gives you a working fallback and, if the network configuration hangs, you can repeat the installation and install the previous configuration.

Setting up VLANs

Setting up VLANs on Linksys WRT1200ACv2, WRT1200AC v1 / WRT1900AC v2 / WRT1900ACS v1, and with OpenWrt Chaos Calmer 15.05.1 doesn't work via the LuCI web GUI!
I've read in various places how people ask about the "Switch" menu item under the "Network" menu, which doesn't exist directly after installation. I can't find a switch to enable it either. This menu item only appears when the VLAN is manually configured in the network file. However, I advise against using the switch function within LuCI!

LuCI creates a jumble of switch and VLAN configurations. It does automatically detect VLANs when defining physical interface connections, and it will attempt to label all VLANs with "eth0.1, eth0.2, eth0.3, etc." In reality, however, a distinction must be made between eth0.X and eth1.X. LuCI is currently unable to do this.

It's important to know that the Internet WAN is on the eth0 interface, and the internal LAN is on eth1. How the switch ports are mapped to the physical LAN ports on the rear of the device can be seen here.
LAN port 4 corresponds to switch port 0, etc. Very important, something I didn't understand for a long time: the two switch ports "5t" and "6t" are "tagged," which the CPU connects with 5 to eth0 and 6 to eth1. This is very important later for configuring individual VLANs, because everything that flows over the WAN, i.e., eth0, is bound to "6t," and most other VLANs are all connected to eth1.X and thus bound to "5t."

It's also important to note that, as I've read, a small VID isn't used for the WAN interface eth0. Eth0.100 with "vid '100'" has proven to be effective. Apparently, the VIDs could interfere with each other.

Scenario: Each LAN port corresponds to a single VLAN

/etc/config/network

config switch
       option name 'switch0'
       option reset '1'
       option enable_vlan '1'

#WAN Port
config switch_vlan
       option device 'switch0'
       option vlan '1'
       option vid '100'
       option ports '4 5t'

#Port 1
config switch_vlan
       option device 'switch0'
       option vlan '2'
       option vid '2'
       option ports '3 6t'

#Port 2
config switch_vlan
       option device 'switch0'
       option vlan '3'
       option vid '3'
       option ports '2 6t'

#Port 3
config switch_vlan
       option device 'switch0'
       option vlan '4'
       option vid '4'
       option ports '1 6t'

#Port 4
config switch_vlan
       option device 'switch0'
       option vlan '5'
       option vid '5'
       option ports '0 6t'

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option 'Euere Werte'

#WAN on the wan port
config interface 'wan'
        option ifname 'eth0.100'
        option _orig_bridge 'false'
        option proto 'pppoe'
        option username 'xxxxxxxxxxxxxxxxxxxxxxxx'
        option password 'xxxxxxxxxx'

#LAN on switch port 1
config interface 'lan'
        option force_link '1'
        option proto 'static'
        option ifname 'eth1.2'
        option ipaddr '192.168.0.1'
        option netmask '255.255.255.0'
        option gateway '217.0.117.92'                            
        option dns '217.0.43.129'

#LAN on switch port 2
config interface 'lan2'
        option proto 'static'
        option ifname 'eth1.3'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option gateway '217.0.117.92'                            
        option dns '217.0.43.129'

Since I have a DSL modem in front of the router, the router handles the ISP registration. Therefore, it also handles the WAN configuration and the gateway and DNS information for the other interfaces.

Szenario 1,2 - 3 - 4

Here is a working configuration for the scenario
LAN-Port 1 & 2: 192.168.0.0/24
LAN-Port 3: 192.168.10.0/24
LAN-Port 4: 192.168.20.0/24

/etc/config/network

config switch
       option name 'switch0'
       option reset '1'
       option enable_vlan '1'

config switch_vlan
       option device 'switch0'
       option vlan '1'
       option vid '100'
       option ports '4 5t'

config switch_vlan
       option device 'switch0'
       option vlan '2'
       option vid '2'
       option ports '3 2 6t'

config switch_vlan
       option device 'switch0'
       option vlan '3'
       option vid '3'
       option ports '1 6t'

config switch_vlan
       option device 'switch0'
       option vlan '4'
       option vid '4'
       option ports '0 6t'

config interface 'loopback'
       option ifname 'lo'
       option proto 'static'
       option ipaddr '127.0.0.1'
       option netmask '255.0.0.0'

config globals 'globals'
       option ula_prefix 'fdaa:abc8:799c::/48'

config interface 'wan'
        option ifname 'eth0.100'
        option _orig_bridge 'false'
        option proto 'pppoe'
        option username 'XXXXXXXXXXXXXXXXXXXXXXX'
        option password 'YYYYYYYYYYYY'

config interface 'lan0'
        option force_link '1'
        option proto 'static'
        option ifname 'eth1.2'
        option ipaddr '192.168.0.1'
        option netmask '255.255.255.0'
        option type 'bridge'

config interface 'lan10'
        option proto 'static'
        option ifname 'eth1.3'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option gateway '217.0.117.92'
        option dns '217.0.43.129'

config interface 'lan20'
        option proto 'static'
        option ifname 'eth1.4'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'                           
        option gateway '217.0.117.92'                             
        option dns '217.0.43.129'

Es dürfte selbsterklärend sein, dass die IP-Adressen, DNS- und Gateway-Einträge individuell angepasst werden sollten.

 


IT-LINUXMAKER, OpenSource, IT-Support, IT-Consulting

© IT-LINUXMAKER 2025