Hi there,
trying to introduce some VLANs to my not yet subnetted network. I am using VyOS 1.5 rolling.
My starting interface configuration is:
interfaces {
bridge br0 {
address 192.168.1.2/24
description "LAN bridge interface"
member {
interface eth2 {
}
interface eth3 {
}
interface eth4 {
}
interface eth5 {
}
}
}
ethernet eth0 {
address 192.168.2.151/24
description mgmt
}
ethernet eth1 {
address dhcp
description WAN
}
ethernet eth2 {
description LAN-DIRECT
}
ethernet eth3 {
description LAN
}
ethernet eth4 {
description LAN
}
ethernet eth5 {
description VM-LAN
}
loopback lo {
}
}
service {
dhcp-server {
listen-interface br0
shared-network-name vlan10 {
description Trust
subnet 192.168.1.0/24 {
lease 86400
option {
default-router 192.168.1.2
name-server 192.168.1.3
}
range scope1 {
start 192.168.1.150
stop 192.168.1.250
}
subnet-id 10
}
}
}
}
firewall {
global-options {
all-ping enable
broadcast-ping disable
ip-src-route disable
log-martians enable
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
group {
network-group inside-nets {
network 192.168.1.0/24
}
}
ipv4 {
name lan-local-v4 {
default-action drop
default-log
description "LAN to This Router IPv4"
rule 1 {
action accept
destination {
port 22
}
protocol tcp
source {
group {
network-group inside-nets
}
}
}
rule 2 {
action accept
description "explicit allow dhcp"
destination {
port 67-68
}
protocol udp
source {
port 67-68
}
}
rule 3 {
action accept
description "default allow from known nets to router"
destination {
address-mask 0.0.0.0
}
source {
group {
network-group inside-nets
}
}
}
}
name lan-wan-v4 {
default-action drop
default-log
description "LAN to WAN IPv4"
rule 1 {
action accept
}
}
name local-lan-v4 {
default-action drop
default-log
description "This Router to LAN IPv4"
rule 2 {
action accept
description "allow dhcp"
destination {
port 67-68
}
protocol udp
source {
port 67-68
}
}
rule 3 {
action accept
description "default allow from known nets to router"
destination {
address-mask 0.0.0.0
}
source {
group {
network-group inside-nets
}
}
}
}
name local-wan-v4 {
default-action drop
default-log
description "This Router to WAN IPv4"
rule 1 {
action accept
}
}
name wan-lan-v4 {
default-action drop
default-log
description "WAN to LAN IPv4"
rule 1 {
action accept
state established
state related
}
rule 2 {
action drop
state invalid
}
}
name wan-local-v4 {
default-action drop
default-log
description "WAN to This Router IPv4"
rule 1 {
action accept
state established
state related
}
rule 2 {
action drop
state invalid
}
rule 3 {
action accept
description "DHCPv4 replies"
destination {
port 67,68
}
protocol udp
source {
port 67,68
}
}
}
}
zone lan {
default-action drop
from local {
firewall {
name local-lan-v4
}
}
from wan {
firewall {
name wan-lan-v4
}
}
interface eth0
interface br0
}
zone local {
default-action drop
from lan {
firewall {
name lan-local-v4
}
}
from wan {
firewall {
name wan-local-v4
}
}
local-zone
}
zone wan {
default-action drop
from lan {
firewall {
name lan-wan-v4
}
}
from local {
firewall {
name local-wan-v4
}
}
interface eth1
}
}
I would now like to add a VLAN with ID 90 and subnet 192.168.90.0/24 with the following commands:
set interfaces bridge br0 enable-vlan
set interfaces bridge br0 stp
delete interfaces bridge br0 address '192.168.1.2/24'
set interfaces bridge br0 vif 10 address '192.168.1.2/24'
set interfaces bridge br0 vif 10 description 'Native VLAN (untagged)'
set interfaces bridge br0 vif 90 address 192.168.90.1/24
set interfaces bridge br0 vif 90 description 'Guest VLAN'
set interfaces bridge br0 member interface eth2 native-vlan '10'
set interfaces bridge br0 member interface eth3 native-vlan '10'
set interfaces bridge br0 member interface eth4 native-vlan '10'
set interfaces bridge br0 member interface eth5 native-vlan '10'
set interfaces bridge br0 member interface eth2 allowed-vlan '10-90'
set interfaces bridge br0 member interface eth3 allowed-vlan '10-90'
set interfaces bridge br0 member interface eth4 allowed-vlan '10-90'
set interfaces bridge br0 member interface eth5 allowed-vlan '10-90'
However, when commit-confirming the changes I lose connection to the router.
Physical network:
- VyOS router as VM with eth1-4 passed through
- eth0 bridged on hypervisor
- eth5 bridged on hypervisor to connect other VMs
- Router trunk-connected to switch
- 3 access points with different SSIDs which ultimately should tag the traffic (e.g., VLAN ID 90 for guests)
Any pointers to what is going wrong appreciated!