Networks#

Network → Networks, at /networks. A network is a VLAN with its own subnet: the router's address on it, a DHCP server handing out addresses, the router answering DNS there, and an access policy saying what its devices may reach. The page creates, changes and deletes all of that as one thing. It is part of Wheelhouse; there is nothing to install.

Nothing on the page applies itself. Saving adds the network to the pending changes, and the Commit Bar applies them.

The list#

Every VLAN on the router is listed, including one made on Interfaces or years ago at the console: it appears with whatever it has, and opening it lets you give it the rest.

Column	What it shows
Network	the VLAN's description
VLAN	the VLAN ID and the interface that carries it
Router address	the router's own address on the network, with its prefix length
DHCP	the range the DHCP server hands out, or Off
DNS	whether the router answers DNS queries from the network
Access	Full access, Internet only, Isolated, Not set, or Custom rules

Not set means no access policy of this page's: the firewall's own rules decide what the network reaches. On a router whose firewall drops what it does not name, that is nothing at all. Custom rules means firewall rules written elsewhere name the VLAN.

Four kinds of VLAN are not networks and are not listed: one that takes its own address from DHCP (an ISP's tagged uplink), one that carries a PPPoE session, one that is a port of a bridge or a bond, and a QinQ VLAN. They stay on Interfaces.

Adding a network#

Add network opens the editor with a new network in it.

Field	What it takes
Name	what the network is called; it becomes the VLAN's description
Parent interface	the Ethernet port, bond or bridge that carries the VLAN. A port that belongs to a bond or bridge is not offered: its tagged traffic arrives on the bond or bridge
VLAN ID	1 to 4094, and not one already used on that parent. On a bridge, not 1: that is the bridge's own untagged traffic
Router address	the router's address on the network with its prefix length, `192.0.2.1/24`. It may not overlap any other interface's subnet or any DHCP scope
DNS from the router	on by default: the router resolves names for devices on the network
DHCP server	on by default
Range start, Range end	the addresses handed out. For a new network they follow the router address — .100 to .199 of its /24 — until you type your own
Lease time	in hours; 24 by default
Domain name	optional; handed to devices with their address
DNS servers	the DNS servers handed out. Empty means the router's own address on the network, which needs DNS from the router on
Policy	Full access, Internet only or Isolated — see below

The router checks the network as you type. A value it would refuse is named under its field in plain words — VLAN 20 is already in use on eth0 by “Guest”. Choose another VLAN ID. — and Add network stays disabled until the network can be added. Anything worth knowing before you save appears under Before you save: a static route that overlaps the subnet, no source NAT for it, a firewall rule that is checked first.

Access policies#

Policy	What devices on the network can reach
Full access	the internet, the router and every other network, as on the LAN
Internet only	the internet and the router's DHCP, DNS and time service; not another local network and not the router's management. Other networks can still reach them, which is what an IoT network wants
Isolated	the router's DHCP and DNS and nothing else; other networks can still reach them

Checked on the lab router from a device on the network:

From a device on the network	Full access	Internet only	Isolated
Get an address by DHCP	yes	yes	yes
Resolve a name through the router	yes	yes	yes
Ping the router, or SSH to it	yes	no	no
Reach the router's LAN address	yes	no	no
Reach another local network	yes	no	no
Reach the internet	yes	yes	no

"Local networks" are the private address ranges — 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 — with 100.64.0.0/10 (carrier-grade NAT and Tailscale) and link-local 169.254.0.0/16. A range rather than a list of the router's own subnets, so a network added later, a VPN or a subnet behind a static route is covered without anybody remembering it.

A device elsewhere can still start a connection into an internet-only or isolated network: the replies are accepted by the firewall's state policy before any network's rules are read. A camera network can be isolated and still be watched from the LAN.

The policy covers IPv4. When the VLAN also has an IPv6 address, the editor says its IPv6 traffic is not filtered by the policy.

What the router is given#

For readers of the Firewall page. Each network with a policy has two rule sets: NET-<NAME> for traffic it sends on to anywhere else, and NET-<NAME>-LOCAL for traffic to the router itself, where <NAME> is the network's name in capitals, NET-IOT for “IoT”. One rule in the forward filter and one in the input filter jump to them for traffic arriving on the VLAN, at the lowest rule numbers free, ahead of every rule already there. They match one interface, so no other network's traffic changes, and a later rule that accepts more — the lab's accept ICMP from anywhere — cannot widen what the policy allows. Internet only uses a network group, NET-LOCAL-NETWORKS, holding the ranges above.

A rule you add yourself to a network's rule set, at a number other than 10, 20 or 30, is left alone when the policy changes; a lower number is read first, which is how an exception for one device works. In Advanced mode the editor shows the rule sets and rule numbers of the network, and the commands a change will stage.

On a bridge#

A network whose parent is a bridge needs three things the page adds with it: VLANs turned on for the bridge, the VLAN allowed on every port of the bridge, and — when the firewall drops traffic with no connection state, as the installer's ruleset does — the router's own VLAN frames on bridges exempted from that. Without the exemption the router's replies to the first ARP request never leave the bridge, and nothing on the network can reach it. The editor says when it adds either of the last two.

Changing a network#

Open the network from the list. Every field can be changed, and the editor plans only what changed: renaming changes the description and nothing else.

A network found with the search palette (⌘K) opens in the same editor. So does a link that names the network's VLAN interface: /networks?network=eth0.20.

A new router address moves the DHCP scope to the new subnet. Reservations in it are removed, because their addresses are outside the new subnet; the editor says how many.
A new VLAN ID or parent makes a new VLAN with every setting of the old one — an MTU, an IPv6 address — and moves the firewall rules to it. Settings elsewhere that name the old interface, a NAT rule or a QoS policy, are listed in the warnings to change.
A new policy rewrites the network's rule sets.
DNS or DHCP off removes the network's entries from the DNS forwarder or its scope from the DHCP server.

Reservations are made on the DHCP page; the editor shows how many a network has.

Deleting a network#

Delete network, pressed twice, removes everything the network owns and nothing else: the VLAN, its DHCP scope, the DNS forwarder's address and allowed range for it, its rule sets and the rules that jump to them, and its place on a bridge's ports. The group of local ranges goes when no other network uses it. When the network was the last one the DHCP server or the DNS forwarder served, that service is turned off too, and the pending changes say so.

In the Commit Bar#

A network is several objects in several parts of the configuration, and the Commit Bar lists one line per object: the VLAN under Interfaces, the DHCP scope, the DNS forwarder, and under Networks the network's rule sets — Set the access policy of network IOT: Internet only — the local ranges and the bridge exemption. Removing one line takes only that part back out; to take back the whole network, remove each of its lines, or discard.