Quick primer to VLANs

[xiaofan]

Some nice tutorial about pfSense VLAN

1) with cheap TP-Link TL-SG108E


2) with Unifi switch

 

[xiaofan]

Just followed the following two videos to configure my MikroTik hAP ac² router to have VLAN based guest wifi and Port based VLAN. It is a bit tedious but still not that complicated.

Final results:
default 2.4GHz and 5GHz wifi, eth2, eth3 -- LAN, 192.168.88.1
guest_wifi_2G4 and eth4 -- VLAN60, 192.168.60.1
guest_wifi_5G and eth5 -- VLAN80, 192.168.80.1

 

[xiaofan]

For older version of OpenWRT (19.07 and earlier), you can follow the following tutorials for VLAN.

 

[xiaofan]

Just followed the following two videos to configure my MikroTik hAP ac² router to have VLAN based guest wifi and Port based VLAN. It is a bit tedious but still not that complicated.

Final results:
default 2.4GHz and 5GHz wifi, eth2, eth3 -- LAN, 192.168.88.1
guest_wifi_2G4 and eth4 -- VLAN60, 192.168.60.1
guest_wifi_5G and eth5 -- VLAN80, 192.168.80.1

Learned a bit more with the following article, to set up vlan trunk port (eth2) to pass the VLAN info the the previously configured TP-Link TL-SG108E.
http://wiki.tuturutu.eu/doku.php/networking/mikrotik/wireless_vlan
Final results:
default 2.4GHz and 5GHz wifi, eth3 -- LAN, 192.168.88.x (MikroTik default configuration)
guest_wifi_2G4 and eth4 -- VLAN60, 192.168.60.x
guest_wifi_5G and eth5 -- VLAN80, 192.168.80.x
eth2 -- trunk port to pass VLAN 60, 80 and 99 to the TP-Link TL-SG108E.
dumb access point connected to VLAN 60 access port of TL-SG108E -- VLAN60, 192.168.60.x
dumb access point connected to VLAN 80 access port of TL-SG108E -- VLAN80, 192.168.80.x
dumb access point connected to VLAN 99 access port of TL-SG108E -- VLAN99, 192.168.99.x

It is said that bridge VLAN filtering is a better method. I will take a look at that one later
https://help.mikrotik.com/docs/display/ROS/Bridge+VLAN+Table

 

[TanKianW]

Learned a bit more with the following article, to set up vlan trunk port (eth2) to pass the VLAN info the the previously configured TP-Link TL-SG108E.
http://wiki.tuturutu.eu/doku.php/networking/mikrotik/wireless_vlan
Final results:
default 2.4GHz and 5GHz wifi, eth3 -- LAN, 192.168.88.x (MikroTik default configuration)
guest_wifi_2G4 and eth4 -- VLAN60, 192.168.60.x (using the first video as the guide)
guest_wifi_5G and eth5 -- VLAN80, 192.168.80.x (using the second video as the guide)
eth2 -- trunk port to pass VLAN 60, 80 and 99 to the TP-Link TL-SG108E.
dumb access point connected to VLAN 60 access port of TL-SG108E -- VLAN60, 192.168.60.x
dumb access point connected to VLAN 80 access port of TL-SG108E -- VLAN80, 192.168.80.x
dumb access point connected to VLAN 99 access port of TL-SG108E -- VLAN99, 192.168.99.x

It is said that bridge VLAN filtering is a better method. I will take a look at that one later
https://help.mikrotik.com/docs/display/ROS/Bridge+VLAN+Table

Yes. Bridged method is the "newer" and better method. I am also using the bridged VLAN method for all my MikroTik appliances.

There are 3 ways of configuring it. You can choose to (1) use the "Interface" method which is software, (2) use the "switch" method which is hardware, (3) use the "Bridge" method that will use hardware automatically and software as secondary.

*Tips: If you are deploying multiple managed switches in your network, setting the root port, root bridge and RSTP will also help to optimize your overall home network. You can read more here:

https://wiki.mikrotik.com/wiki/Manual:Spanning_Tree_Protocol

 

[xiaofan]

Ref: https://forums.hardwarezone.com.sg/...using-openwrt-routers-and-singtel-tv.6681637/

I have never tried to try using OpenWRT with Singtel TV box. Previously I was using Linksys WRT1900AC Stock FW which has the pre-defined Singtel Vlan profile, now I am using Asus RT-AX82U which again has the Singtel VLAN profile as well.

I did have a few failed attempts to get Singtel TV box to work with either pfSense or OpenWRT directly without an external VLAN capable switch.

The easier way is to use VLAN capable switch like TP-Link TL-SG105E or TL-SG108E after the SIngtel ONT, before the OpenWRT or pfSense router.
Ref: https://forums.hardwarezone.com.sg/...properly-singtel-asus-rt-ax86u.6564040/page-3

OpenWRT old successful story without using an external VLAN capable switch: I tried it but without success -- Internet works fine but not Singtel TV. I tend to believe it no longer works.
https://klseet.com/networking/singtel/singtel-tl-wr1043v18-openwrt
That being said, I think there is a chance that OpenWRT itself will work on those routers with built-in switch, even though there may be a difficulty with VLAN priority.

pfSense old successful story: I doubt it works now. pfSense itself does not seem to support things like PVID or VLAN priority.
https://jefferytay.medium.com/adven...1-setting-up-internet-and-mio-tv-8474af46edcc
I am pretty sure the following two setup will work but I have not tried it. I am not so sure if anyone has tried it.
1) pfSense + TL-SG105E or TL-SG108E (or other managed switch)
2) OpenWRT + TL-SG105E or TL-SG108E (or other managed switch).

 

[xiaofan]

A lot of us has questions how to get the following to work.
Singtel ONR + 3rd party router in AP mode (not Netgear Orbi, not Linksys E9450) + Singtel TV box

There is a nice solution by hairymonster here. No VLAN capable switch is needed, just need the router to support IGMP snooping.
https://forums.hardwarezone.com.sg/...tel-tv-onr-ac86u-ax23-singtel-tv-box.6681949/

​

 

[xiaofan]

Nice post.
https://forums.hardwarezone.com.sg/...fiber-network.4173602/page-140#post-144272046

Hope to benefit the public . I dont understand the HDB Kuku planning of having SINGLE LAN Port at the living hall design .

This was my tested setup that does not sacrifice a good router to put inside a DB Closet.

Vlan setup with single trunk
https://ibb.co/f0mC1Mq
This design is only using Single Lan Cable to route traffics from ONT to Router and back to the DB Panel to the rest of LAN points at DB.. Via Vlan group control , one can share a single LAN Trunk to route internal traffics as well as external traffics to share a Single LAN Cable.



Doing so , one can enjoy to use the good router at living hall to control more devices near TV console with multiple media devices with flexible choices of LAN/Wireless without sacrificing the distance path loss issue facing by wireless devices.

Connection
SW2. Managed Switch's Ports connection at DB. with the following connection .
P1. Trucking to Living hall lan point
P2.ONT
P4-7 -Vlan_internal , to link to LAN points to all the rooms .


SW1 - > Managed Network Switch -2(SW2) at living Hall.
Legend P1=> Port 1
P1: Linked to the SW1 Port 1
P2: Router with Vlan Profile , Vlan ID should follow Telco settng .
P3: -> Generic router without Vlan profile SW2-Ports connections
P4 -> Vlan_internal , Router LAN port rerouted back to the same switch to extend the LAN Ports capacity( number of ports increased) .
P5-P8 , Vlan_Internal


SW Configuration with the managed switch SW1 and SW2.
Users need to buy 2 Managed switch and configure a vlan grouping .

Vlan ID :10
SW2:
P1-2, tagged, Port-3 untagged
SW1
P1 & P2 tagged, P3-untag

VlanID:20
SW2 Port 1 tagged, Port8 -untagged
P1-2, tagged, P8:untag

SW1 (living hall )
P1, tagged, P8:untag

Vlan100
SW2
P1 tagged , P4-7 untagged

SW1
P1 tagged. P4-7 untagged

SW1
PVID Setting(VID)
Port1: 1
Port2: 10
Port4-7: 100
Port 8: Optional IPTV

SW2 PVID Setting
Port 1:1 //Single Lan trunk
Port 2: 10 // For singtel router
Port 3:
Port 4-7: 100
Port 8: 20 // for Singtel IPTV

 

[CoolRock]

good thread, support.

 

[TanKianW]

Same concept video tutorial. For those who wants to move their mesh router out from the DB.​

 

[sacredrays]

Nice post.
https://forums.hardwarezone.com.sg/...fiber-network.4173602/page-140#post-144272046

actually now that i think about it, can this method can work for those on singtel ont with singtel tv going for those mesh system with 2 ports as main router?

 

[xiaofan]

actually now that i think about it, can this method can work for those on singtel ont with singtel tv going for those mesh system with 2 ports as main router?

Yes it should work.

 

[xiaofan]

Sometimes you do not need VLAN to sort out issues though.

For example, if there is only one LAN port in the living room, it can be a big issue for Singtel ONR users if the ONR is located in the DB box and the 3rd party AP (non Netgear and not Linksys E9450) and the Singtel TV box are in the living room, since the TV box can not be connected to the 3rd party AP.

Singtel ONR -- 3rd party router/AP -- Singtel TV Box (not working).

The initial thought is to use managed switch to sort out the issue (not proven), but there is a creative solution from hairymonster here -- to use the AP as a IGMP enabled dumb switch/AP.
Ref: https://forums.hardwarezone.com.sg/...tel-tv-onr-ac86u-ax23-singtel-tv-box.6681949/

 

[sacredrays]

Sometimes you do not need VLAN to sort out issues though.

For example, if there is only one LAN port in the living room, it can be a big issue for Singtel ONR users if the ONR is located in the DB box and the 3rd party AP (non Netgear and not Linksys E9450) and the Singtel TV box are in the living room, since the TV box can not be connected to the 3rd party AP.

Singtel ONR -- 3rd party router/AP -- Singtel TV Box (not working).

The initial thought is to use managed switch to sort out the issue (not proven), but there is a creative solution from hairymonster here -- to use the AP as a IGMP enabled dumb switch/AP.
Ref: https://forums.hardwarezone.com.sg/...tel-tv-onr-ac86u-ax23-singtel-tv-box.6681949/

yes, as long the 3rd party router (in AP mode)/ unmanaged switch supports igmp snooping, can work for singtel tv.

 

[xiaofan]

Asus router VLAN setup with Merlin FW

https://github.com/RMerl/asuswrt-merlin.ng/blob/master/release/src/router/vlanctl/unitTest/vlantesthttps://www.snbforums.com/threads/guest-vlans-over-the-network-on-asus-ac5300.29460/#post-270059https://www.snbforums.com/threads/rt-86u-vlanctl-ethctl-usage-puzzle.54375/

 

[xiaofan]

Some discussions here for those who have only one LAN port in the living room, but do not want to put the good wireless router in the DB box and yet want the other rooms to have functional LAN ports. There is a good method to use two VLAN switches (one in DB box and the other in the living room) to deal with this situation.
https://forums.hardwarezone.com.sg/...nect-your-home-fiber-network.4173602/page-162

++++++++++++++++++++

wait guys.... are we saying that there is a separate solution (3rd solution) to the hdb issue?
usually we will either do 2 routers or 1 router and pull another lan cable method.

but with the above diagram, we are saying that all we need is 1 router, 2 switches, and the router can be placed in the middle of the room and without the need to pull extra lan cable?

Yes. There are three solutions for the BTO flats, for users who want to put the more powerful wireless router in a more central location than the DB Box, yet would still like to have functional LAN ports in the rooms.

1) Put the main router in the DB box and the the wireless AP in the central location.

For average users, this is the preferred solution (especially if your DB box does not block WiFi badly). You can also put a wired router in the DB box (eg: Singtel ONR, better wired router, or wireless router with wireless disabled).

Power users tend to go this way as well, with things like Uniquity Unifi routers (like UDM Pro, UDM Pro SE, etc), MikroTik, or PC based router running OpenWRT/pfSense/OPNsense.

2) Put the main router in the central location and a dumb switch in the DB box (terms and conditions below).

If you have two LAN ports in the living room (or the other rooms), then this is the cheaper solution. This is also applicable if you are willing to pull a new cable to the location where you intend to put the main wireless router, you can put a cheap dumb switch in the DB box.

ONT in DB box --> patch panel -- living room LAN port 1 --> main wireless router --> living room LAN port 2 --> patch panel in DB box --> Dumb switch in DB box (eg: TP-Link TL-SG105 or TL-SG108 dumb switch) --> Room LAN ports

3) Put the main router in the central location with the help of two managed switches, one in DB box and one in the central location

If you are not willing to pull a new cable, then you can use the above-mentioned method, using two managed switch.

a) ONT in DB box --> Managed switch 1 (eg: TP-Link TL-SG108E smart switch)
b) Managed switch LAN Ports (VLAN ID 100) --> patch panel -- Room LAN ports
c) Managed switch 1 trunk port --> patch panel --> Living room LAN port --> Managed switch 2 trunk port (in the Living room, eg, another TL-SG108E, or TL-SG105E smart switch)
d) Managed switch 2 WAN port (VLAN ID 10) --> main wireless router WAN port (in the living room)
e) One of the main wireless router LAN ports --> one of the Managed switch 2 LAN port (VLAN ID 100)
f) If you are using Singtel ONT and Singtel TV box, just need to have one more VLAN ID 20 for the Singtel TV boxes.

Picture done by HMAN. Please refer to the link mentioned in Post #28.

 

[TanKianW]

Though a bit more advanced and technical, I really like the way VLANs are explained in these MikroTik tutorials, which also cover some technical aspects of VLANs and some enterprise (ISP) features like Q-in-Q. Feel free to watch if you are trying to become a VLAN junkie! Once you learn and understand the basics, it should be much easier to understand networking. For someone taking CCNA (took mine aeons ago), this should be the minimum. Recommend playing around with network simulators like EVE-ng too.





Some VLAN/Subnet basics:

​

 

[xiaofan]

Today I reviewed the OpenWRT VLAN setup video and I was able to configure VLAN under OpenWRT 22.03, using thing TL-SG108E smart switch and Huawei AX3 Quad Core wireless AP.


Still I have not very good understanding of VLAN. Maybe I should use the MikroTik hAP AC2 and the above-mentioned MikroTik video tutorial to learn more.

 

[xiaofan]

Two more advanced features of high-end Asus routers which may help users who want to achieve home network separation mentioned in the first post of this thread.

1) VLAN -- GT-AX11000 Pro, GT-AX6000, ROG Rapture GT-AXE16000, RT-AX86U Pro, RT-AX88U Pro, ZenWiFi Pro ET12, ZenWIFI Pro XT12
https://www.asus.com/support/FAQ/1049415/

2) Guest Network Pro -- GT-AX11000 Pro, GT-AX6000, ROG Rapture GT-AXE16000, RT-AX86U Pro, RT-AX88U Pro, ZenWiFi Pro ET12, ZenWIFI Pro XT12
https://www.asus.com/support/FAQ/1049414/

 

[xiaofan]

More introduction to VLAN:







(more advanced topic)