Add a network (VLAN)#

You will end up with a new network: a VLAN on one of the router's ports, the router's address on it, a DHCP server handing out addresses, the router answering DNS, and a policy deciding what its devices may reach. All of it is one entry on the Networks page.

Before you start#

• The operator role and a licence.
• A VLAN ID the switch on the other end also uses, on a port configured as a trunk that carries it tagged.
• A subnet for the network that no other interface on the router uses, such as 192.0.2.0/24.

Step 1 — Describe the network#

Network → Networks → Add network.

1. Name: what the network is for, such as IoT.
2. Parent interface: the port, bond or bridge the switch trunk is on.
3. VLAN ID: the ID the switch tags it with.
4. Router address: the router's address on the network with its prefix length, 192.0.2.1/24. The DHCP range fills itself in from it.

Step 2 — Its services#

DNS from the router and DHCP server are on. Change the range, the lease time or the domain name if you want to; leave DNS servers empty to hand out the router's own address.

Step 3 — What it may reach#

Choose a Policy:

• Full access — like the LAN: the internet, the router and every other network.
• Internet only — the internet and the router's DHCP, DNS and time service, nothing local and not the router's management. Right for smart devices and guests: the LAN can still reach them.
• Isolated — the router's DHCP and DNS only. Right for cameras that should never talk to the internet; a recorder on the LAN can still reach them.

The router checks the network as you fill it in. Anything it would refuse is named under its field, and anything worth knowing appears under Before you save. When Add network is enabled, press it, then Apply changes in the Commit Bar.

Check it worked#

The network is there. It is on the Networks list with its range and policy, and the VLAN is a row on Interfaces with its link state.

A device on the VLAN gets an address. It appears among the leases on DHCP.

It reaches what the policy says, and nothing else. From a device on an internet-only network a website loads and a LAN address does not answer.

The switch agrees. Diagnostics → Neighbours shows what LLDP neighbours announce, including their VLANs, which finds a trunk port that was never configured as one — See what the switch says it is.

Only the VLAN#

To make the tagged interface and nothing else — a VLAN that becomes a bridge port, or one a device on it addresses itself — use Network → Interfaces → Add interface, type VLAN. It is listed on Networks too, with Not set as its policy, and can be finished there later.

Undoing it#

Open the network and press Delete network twice. The VLAN goes with its DHCP scope, its DNS entries and its policy, and nothing else of the router's changes.

See also#

• Networks — every field and policy in detail.
• Bridge two ports
• Find printers and speakers across VLANs
• Interfaces