WRT54GL Linksys Routers

Introduction

Note that most of the below information is out of date, as the vlan trunking configuration can now be done completely via the web interface. Custom DHCP settings and iptables firewall rules can also be entered via the web interface now, so startup scripts are no longer needed.

Things I have done with a WRT54GL router running ddwrt custom firmware:

• Single router with 2 subnets each with seperate vlan, IP block, DHCP server, and firewall rules.
• VLAN trunking
• QoS traffic prioritization based on IP address
• WPA encrypted wireless point to multipoint bridging

Things I may implement in the future:

• Multiple wireless networks on the same router with different SSIDs and different vlan tags

WRT54GL port diagram

Useful Links

WRT54GL ports in a table

http://nuwiki.openwrt.org/toh/linksys/wrt54gl#switch.ports.for.vlans

VLAN Detached Networks (Separate Networks With Internet)

http://www.dd-wrt.com/wiki/index.php/VLAN_Detached_Networks_(Separate_Networks_With_Internet)

802.1q trunking instructions (old method)

http://www.geek-pages.com/articles/latest/802.1q_trunking_on_the_linksys_wrt54g/s/l_with_dd-wrt.html

Additional DNSmasq notes (for setting default gateway, etc)

http://www.dd-wrt.com/wiki/index.php/DNSMasq_as_DHCP_server
http://osdir.com/ml/network.dns.dnsmasq.general/2005-08/msg00046.html

Details

Custom IPTables Rules

To be pasted into Administration -> Commands

IPTables Rule to reject traffic from vlan3 to br0

The following rule will block traffic from vlan3 to the default bridge:

iptables -I FORWARD -i vlan3 -o br0 -j REJECT

IPTables Rules to isolate vlans (doesn't address bridging though)

iptables -I FORWARD -i vlan+ -o vlan+ -j DROP
iptables -I FORWARD -i vlan+ -o vlan1 -j ACCEPT
iptables -I FORWARD -i vlan1 -o vlan+ -j ACCEPT

Configuring multiple DHCP ranges

The instructions linked above suggest adding only the second range under services>Additional DNSMasq Options, however we ran into trouble when the number of connected clients got too large. The primary range as configured under setup>network setup uses the maximum number of clients to define the end of the range. This is a problem because your total maximum clients may be much larger when you combine multiple ranges or use subnets larger than /24. In order to work around this issue we did the following:

1. Disable DHCP under setup>network
2. Add statements to services>Additional DNSMasq Options to configure all of the DHCP ranges, including the primary one and the maximum number of clients.

dhcp-leasefile=/tmp/dnsmasq.leases
dhcp-lease-max=301
dhcp-option=3,192.168.1.1
dhcp-authoritative
dhcp-range=192.168.1.101,192.168.1.200,255.255.255.0,1440m
interface=vlan3
dhcp-range=wifi,192.168.2.50,192.168.2.250,255.255.255.0,60m
dhcp-option=wifi,3,192.168.2.1

You can check your work by viewing the config file on the router via ssh at /tmp/dnsmasq.conf before and after making the change.

One side effect of doing this is that you lose the ability to view DHCP status via the web interface. As a workaround you can view the leases at /tmp/dnsmasq.leases via ssh.

Configure an AP running DDWRT to do trunking

These steps assume you want to split out the wireless and the wired ports. Wired will be on vlan2 and wireless will be on vlan3 with both vlans trunked via the WAN port to a vlan aware switch. This router already has DHCP disabled and is not acting as a firewall, only an AP.

nvram set vlan0ports=
nvram set vlan2ports="0 1 2 3 4t"
nvram set vlan3ports="4t 5t"
nvram set vlan3hwname=et0
nvram commit
reboot

The last step is to configure your vlans in the web interface as follows:


The end result is that you can use the same router to connect wired and wireless devices while keeping them on separate vlans.

Adding a third vlan and network

These steps assume you already have two other vlans configured and you only want to trunk the new vlan up to another switch. Also, there are additional steps required if you wanted to enable DHCP service on the new network.

Add ports to the new vlan

nvram set vlan4ports="0t 5t"
nvram commit

Create a startup script to load firewall rules and configure the interface

echo '
#!/bin/ash
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
iptables -I FORWARD -i br0 -o vlan4 -j ACCEPT
iptables -I FORWARD -i vlan4 -o br0 -j ACCEPT
iptables -I FORWARD -i vlan4 -o vlan1 -j ACCEPT 
iptables -I INPUT -i vlan4 -j ACCEPT  
ip addr add x.x.x.x/yy brd + dev vlan4 
ifconfig vlan4 up
' > /jffs/etc/config/vlan4.startup  
chmod 750 /jffs/etc/config/vlan4.startup 

x.x.x.x/yy is the IP and mask you want to assign to the router on the new vlan.

Add the new vlan to the trunk port

In the web based DDWRT GUI add the additional vlan to your trunk port.