OpenWRT and VLAN

I use a NanoPi R2S as my back up router.  Another day, I was setting it up from scratch.  I set up VLANs on it as I did before, however, I couldn't get an IP from any of the newly created VLAN networks.  I have checked the VLAN set up over and over again, and compare it with setups found in YouTube videos.  Everything seems in order.  Then, I check my switch, and again everything seems right too.  I was puzzling for a few days.

Few days later, I looked at the settings again, still couldn't see anything wrong.  Then it dawned on me to check the firewall settings, and the problem was indeed an firewall issue.  I may be wrong, but I think the own default was

input -> accept

output -> accept

forward -> reject

where as the new default is 

input -> reject

output -> accept

forward -> reject

As I highlighted, the culprit for my problem is the change to the input default setting.

INPUT governs traffic originating from devices in the zone that has its final destination on the router. Examples for this would be DHCP requests or DNS lookups

With input set to reject, computers on the network cannot talk to the router, i.e. getting access to the DHCP etc.  Hence, my computer appeared as having problem to join the network.

Simply change the input to accept, the problem fixes.

Assign a different DNS for a host in OpenWRT

There are occasions which I would like to set a host to use a different DNS server than the general DNS server set for the network.  I can do this easily with OPNSense however I can't seem to find the option in OpenWRT.  Initially it thought this isn't possible.  As it turns out, this is only not possible with Luci but it is doable if you are comfortable to tweak the configuration file directly.

To assign a host to use a specific DNS server, you need to edit the /etc/config/dhcp file.  For example, if I want to set my smart TV to use DNSForge.de instead of the Google DNS on my network, I need to assign a static address to my tv, and tag it with the "tag" option.  Then set the "dhcp_option" to the tagged host as below:

 

config host option dns '1' option ip '10.0.0.200' option name 'tv' option mac 'FF:1A:6B:1A:9A:9B' option tag 'tv_dns' option leasetime '300' config tag 'tv_dns' list dhcp_option '6,176.9.93.198,176.9.1.117'

ref: https://forum.openwrt.org/t/configure-host-specific-dns-server-over-dhcp-option-6/71471/4

ref: https://zedt.eu/tech/linux/how-to-serve-custom-dhcp-configuration-with-openwrt-dnsmasq/

Install OpenWRT onto ER-X

I finally decided to replace the EdgeOS in my Ubiquiti EdgeRouter-X (ER-X) with the OpenWRT.  While I was flashing the ER-X with the OpenWRT, I came across few issues which I would like to share here.

Although the guide at https://openwrt.org/toh/ubiquiti/edgerouter_x_er-x_ka works, there are few points you may want to watch out.

1) Initially, I was flashing my ER-X with the openwrt-ramips-mt7621-ubnt-erx-initramfs-factory.tar using Chrome on my Linux machine.  However, I got an error while I was doing so.  I tried using Firefox on Linux, and I got the same error.  Eventually, I tried doing so on a Windows machine and it worked as it should be.

2) Although the guide says you can flash the ER-X with the latest OpenWRT image after you had flashed it with the factory.tar image, it seems you can't flash it with the latest 21.02.2 image with the new DSA setup right after.  I got an error complaining the new DSA feature.  However, the latest image from the 19.07 branch works.  Hence, you may want to flash the device from factory.tar, then 19.07 and finally with the latest image. (this is also mentioned on the guide, but it suggests using an image from 18.06 branch which seems a bit too old).

 

Apart from the two minor issues mentioned, the process works beautifully.  My ER-X is now running with a better supported OS and with more features, e.g. OpenVPN.