VLAN explained in 3 minutes

[@danieldewindt3919]

Nicely explained

[@OneMarcFifty]

Thank you ;-)

[@saipriyavarmap5296]

Hi there Marc,Sorry if i sound stupid, i have a portable lte wifi hotspot and a wired wan broadband connection at home.I am using dlink dwr116 with openwrt to access my isp's wan already.Is it possible to bridge the networks of both using openwrt so that i can have an uninterrupted wifi access on openwrt router? Any inputs will be much appreciated.

[@OneMarcFifty]

Simple bridging would not work as bridging two WAN connections would not automatically load balance or fail over. There is a package called MWAN3 for openwrt which does this on the ip layer. Alternatively you could use scripts on the router which check periodically if the interface is down and then change the routing table...

[@saipriyavarmap5296]

@@OneMarcFifty Hi Marc,Thank you for your valuble inputs.I just tried to look up for MWAN3 as you mentioned,the search returned with unkown package.However,I just skimmed through the documentation for mwan3 package and it all sounds 👽 stuff for my hospital pharmacist brain.I will try to read and comprehend as much as i can see if i can install it all by myself. Apart from that,i have a small doubt about bridging. Lets say if i managed to bridge both wans without installing MWAN3 (a wireless and a wired on openwrt) So,when i use the internet which one will be used taking load balancing failover etc out of the equation? both of them simultaneously? Thanks in Advance.Much appreciated for taking your time. Subbed. :)

[@OneMarcFifty]

If you bridge both then still both would have their own ip address and hence their own route. If you type ip route then you would see which interface would be preferred. If you down one then the other one would be taken. That behavior would be exactly as if you did not bridge because your interfaces most probably are set to Dhcp. But if you set them to e.g. unmanaged then they would not have an ip but no gateway neither. Trust me, bridging is not the way to go on Wan interfaces unless of course you would bond to a vpn - then you could bond the vpn interfaces on layer2. If you want to talk this through, feel free to join my discord server on sunday 9 AM or 6PM Berlin time ;-) there aren‘t too many people at the moment so probably plenty of time to talk through your use case. PS: thanks for subscribing 😉

[@OneMarcFifty]

Having said all this, I can see from the comments that there is a great interest in improving internet connection up time and availability. The way I have done this in the past was by using scripts and manual fail over. I will give it a thought how to bring things together (the VPN bonding, MWAN, scripts, etc.) and maybe deliver something around this in the form of a video. But it's going to take a month or two...

[@davebeckham5429]

Nice tutorial. Many thanks.

[@OneMarcFifty]

Thank you! I am glad you like it.

[@gustavoluiz2723]

I really like the videos you make and spend a lot of time watching them. This is because your explanations are very clear and constructive. But you can't be constructive on a short video (with a counter!) trying to explain something somewhat complex like VLANs. So please my friend, stick to your longer video profile. We have the time to watch it. I couldn't follow you on this rapid tour. Anyway, many thanks for the lots of lessions that I've learnt with you!

[@OneMarcFifty]

Thanks mate - yes, I’ve given up on the 3 minutes series a long time ago ;-)

[@JosiahLuscher]

Perfect!

[@chrima758]

Quick question: Does it make sense to use a chromecast in IOT zone?

[@OneMarcFifty]

Well - it depends - you would need to first evaluate if your devie needs internet access (if it doesn't then you can confine it in a zone that does not have access, e.g. the IOT zone) - but probably more importantly w/r to Chromecast you would want the device to be announced in other network segments so you might need something that mirrors mDNS and zeroconf accross the segments (Avahi and smcroute or the like)

[@Huckleberry_F]

Just curious why you limit your ip cams access to internet. Or it’s just your case so you want it to be accessible lan only? In my case I want it to be accessible outside as well.

[@FedorTroitsky]

You definitely don't want them to be accessible outside. This is a security measure. There are a lot of cases of hacked cameras. Use VPN to connect to your lan from outside, and connect to cameras this way.

[@Huckleberry_F]

Makes sense. But on the other hand - connecting each time to vpn when you want to quickly check your cameras might be a little bit tedious. Especially if there are other users. Definitely, it’s a choice of security vs comfort. I decided just to make a very strong point password which even I don’t know :)

[@MysterPotato70]

if lan can access iot, can iot access the lan?

[@OneMarcFifty]

No. The firewall distinguishes between existing connections and new connections. So an established connection from lan to iot can be answered but no new one can be made in the opposite direction.

[@MysterPotato70]

@@OneMarcFifty thanks for the reply! i have a question again if you dont mind me asking. is the archer c7 enough to be a router, firewall, and wap? or should i just use it as a router and firewall

[@OneMarcFifty]

@@MysterPotato70 I am using it for all of these, but please keep in mind that the Archer only has 1 CPU. If you want something more powerful, I am currently testing the D-Link DIR-2660 - if you're not in a hurry wait 2-3 weeks and I will make a comparison video ;-)

[@MysterPotato70]

Thanks @@OneMarcFifty!! I look forward to watching more of your videos.

[@wilyc0y0te]

Hi Marc, nice, clear video! I have a similar question about hardware... if you look up VLANs on KZbin, the hardware which is most frequently mentioned, is Ubiquiti. Their kit is nice, but expensive. Can you set this up with any decent router/mesh router, connected to a managed switch? Any hardware recommendations?

[@felkowsky]

wish i was smart enough to understand it....

[@OneMarcFifty]

Hi, in all honesty - that's probably not one of my best videos. I tried to squeeze a complex thing like VLANs into three minutes - have you watched my other videos on the matter ?

[@codmobile2012]

Why not just show 2 senarios instead of all this .

[@techydude]

lolwut? why bother having IOT devices if you don’t let them connect to the internet? so many of them don’t work well, or at all, if they don’t have an internet connection, and some don’t support direct connectivity from LAN clients (they go via the internet/cloud route). the whole point of having an IOT zone is to compartmentalise those devices with high risk of malware infection away from your LAN zone.

[@OneMarcFifty]

Thank you for your feedback. Well, it depends on what you have as IOT devices and what scenarios you want to cover. Malware/Ransomware mitigation through segregation is one aspect. I have roughly 20+ devices in my home that don't need internet access. They do need services from the internet of course, such as my word clock needs the current time - but it's getting that from the ntpd daemon on my router. My ESP8266 based tasmota devices which water my lawn don't need internet access - they need a middleware - which in my case is MQTT, running on my router. You are silently assuming that every IOT device is cloud-connected, but that's not necessarily the case. An important second aspect of this setup is privacy and keeping control of your own data.

[@techydude]

@@OneMarcFifty Fair enough, you're also catering to IOT devices of a... less than commercial origin, in which case local-hosting (MQTT, whatever) is a nice reality. Thanks for clarifying!

[@techydude]

@@OneMarcFifty Is there feature(s) in OpenWRT to allow / not-allow WAN/internet access based on, say, MAC-address?

[@OneMarcFifty]

Yes you can. In the traffic rules section there is an advanced tab where you can specify the source MAC address