Provision Ethernet Port as pure "client" port?

Router
1

I did some searching but wasn’t able to find an answer.

Just bought an MT3000 and was able to successfully configure it for use as a travel router - repeater mode, configured VPN, configured WiFi to match my home SSID to allow for easy connections, etc.

I was able to test it and everything worked great.

I was wondering if there was a way to configure an Ethernet port so that the unit would receive a DHCP address so I could update the firmware on the unit easily if needed before my travels.

Today - I guess I could connect the “Wan” side to my wifi network - but then I'd have to configure rules to allow connectivity to the WAN port / IP - and then remember to remove that config so that I didn’t have that IP / interface exposed while I was traveling.

And certainly if there’s another way to accomplish what I'm looking to do - I'd be happy to hear about that.

Thanks in advance!

3

Just connect a ethernet cable from your home router via one of its LAN ports, connect the other end to the Beryl’s WAN port. From the Beryl connect another ethernet cable for the Beryl's LAN to your computers LAN and then load your Beryl admin IP usually http://192.168.8.1 if you haven't changed it.

Because your SSID name is the same as your home SSID it is hard to tell which connection you are using and who is handling DHCP (when both your home router and the Beryl are running) so it's hard to connect via WiFi and upgrade. What I do and it might be better for your you too is just change the SSID on the travel router..maybe just append a -P for example on both the 2.4 and 5ghz SSID name. Then just connect all your devices to the (-P)ortable travel router SSID and your devices will save them anyway.

By doing that you gain two more ways to upgrade when on your local home router. One is you can keep the ethernet plugged to WAN and then connect to the new SSID to upgrade (your computer might not have ethernet if it's a laptop for example), the Beryl will automatically handle the DHCP for your connected device and then use the WAN connection via the ethernet cable.

If you don't have any spare LAN ports on your home router or want a wire free alternative you can leave the Beryl without a LAN and WAN cable, connect to the new (-P) SSID of the Beryl and inside the Beryl admin panel you can connect to you home network like you would if you were connecting to a hotels WiFi and do the upgrades that way too. The Beryl will automatically do the DHCP when you are connecting without any conflicts / directly to it via either the ethernet cable or the SSID (as long as the SSID is slightly different or you fully disabled your home SSID to prevent conflicts - not really advisable so just change the Beryl's SSID for easy maintenance) if you must keep the SSID the same then the only real way to upgrade would be the two cable approach but in my opinion having multiple easy approaches by just changing the SSID is a better setup going forward.

4

Or just do it by accessing your Beryl (when it is connected to the net by any means) via the GoodCloud service. Done :+1:

5

I'm confused about this.

Are you saying this does not work by default with repeater mode on and vpn?

For both functions the dhcp from the travel router must be intact for the ethernet ports.

So this means you get a web ui to your travel router if you visit the gateway 192.168.8.1

Or are you asking to turn one of your ethernet ports into a wan port to access your travel router from wan?

If that the case for upgrading a firmware I don't recommend this on a travel router + you may be complicate things here lets summarize:

First you need to go luci and go to network and then interfaces, you click on the tab devices, and remove the port you want, then create a new bridge in where you put the wan device, and the now removed lan device, click on the interface tab again edit wan interface and then change device to your new made br-wan bridge...

Second this why I said you make it complicated, now you also need to open wan to access your device.

When I think it is better to skip the wan conversion to a lan port, and just open access via a acl rule wan to 'this device' aka your travel router.

Then you can just visit the external ip just as a client on your upstream network, and when traveling you disable this rule, this is why I'm kind of against it because you may forget to toggle the ACL rule but it isn't a big config change, optionally you could set the source mac address of your management device to restrict the rule on all devices from wan to travel router.

Other than this I don't see a better solution to magically disable a rule :slight_smile:

If GL has no source mac implemented, the ACL variant is also in luci named 'traffic rules' inside the network -> firewall menu, it has this option there under advanced settings when inside the rule creation.

1 Like
6

so i normally hate to reply to my own post - but i did a bunch of reading - and i think i found a way to do what i want to do. but would certainly appreciate advice from people who know way more than i do as to whether there are any issues / concerns with my plan.

  • Use LUCI to remove LAN2 from br-lan
  • create a new bridge device
    • add LAN2
  • create new interface
    • configure the protocol for DHCP
    • assign the bridge device above
  • create a new firewall zone and configure:
    • input and output = accept
    • forward = reject
    • masquerading and MSS clamping = disabled

at that point - i think should be able to connect LAN2 to my existing network here at home and the MT3000 should receive a DHCP address on my local lan - and allow one of my existing clients to connect via HTTPS and upload firmware from that client to the MT3000 (since it wouldn’t have internet access).

any concerns / issues with my plan?

if i did the above - will the config survive firmware upgrades? i’m currently running 4.9 beta (for Amnezia support) - in the case the firmware selection might change the answer.

thanks!

7

thanks very much @xize11!

pretty much my thinking - i was looking for a simple solution where the MT3000 could receive a DHCP address from my local LAN - and be reachable that way.

Like maybe create a new network / vlan (not sure what the MT3000 would call it) and assign an ethernet port to that network - and configure it so that it would receive a DHCP address.

thanks!

8

that’s an interesting idea, @Lastimosa.

i had read some reddit threads (older ones) where people had asked about good cloud - and the consensus seemed to be that it was very difficult to use. do you find that?

also - any security concerns with the device being connected / registered to the good cloud service?

thanks!

9

thanks for the detailed response @j2zero!

i was hoping for a very simple solution - like configuring one of the LAN ports just to receive a DHCP address by plugging it into my network switch. in that way - it would have an IP address that my other devices / clients could reach, without having to setup rules on the MT3000 to allow connectivity to the outside / WAN port.

10

This will not give you the lan ip from upstream.

Basically lan2 needs to be bridged with the wan port with a new bridge and then no interface creation is needed, the device on the wan interface needs to be changed into br-wan.

I think this will be the easiest solution.

A other solution is using vlans indeed this is something I use at home, what you are looking for here is some kind of dumbap setup but a little bit differently than that.

Basically you need to tag the vlan from upstream and in luci create a dhcp client with the default gateway unchecked this is inside the advanced tab inside the interface creation, do this so that it is not seen as a wan type interface so that other interfaces want to pass through traffic as gateway traffic.

If dhcp works set the protocol to unmanaged so that you also can access L2 such as chromecasts and other things for a more pure switch port.

11

You could also just change the gl router lan subnet to be the same as your home lan subnet but with an address outside of your home’s DHCP pool range and plug a lan port to your home switch. That way you could reach the Admin panel from any machine connected to either your home router or the gl router.

For example let’s say your home subnet is 192.168.1.0/24 with router ip 192.168.1.1 and DHCP pool range 192.168.50 - 192.168.150, change gl router lan ip to 192.168.1.254 and DHCP start address 192.168.1.151 end address 10.168.1.250.

Just be sure that you don’t have static ips configured outside of the dhcp range on each router that falls in the dhcp range of the other.

12

GoodCloud has been generally working well and is super easy to use in my experience. The company has a good track record when it comes to security issues so far but you would obviously need to do your risk assessments. Hope this helps.

13

you guys have been a huge help - and some of the information you provided got me thinking - and I think I have a very simple / easy solution now.

my Mac mini is using WiFi - which leaves me with an ethernet port open. I am planning on just connecting my mini’s ethernet port directly to the LAN port on the MT3000 - and assigning a fixed IP address on the mini putting me in the MT3000 LAN subnet.

I know that the MT3000 won’t have internet access - but I'd just download firmware to my mini - and then upload it to the MT3000 as needed.

unless anyone tells me this won’t work (or is a bad idea for some reason) - I think I'm all fixed.

again - thanks to you all for some great info - and for helping me come up with a simple solution.

14

Will work a hundred percent for a local firmware upgrade from file, you don’t even need to assign a static ip on your Mac mini if dhcp is enabled on the MT3000 LAN.

Just be aware that, as you’re using the same SSID/passwd on your MT3000 as your home router, some of your machines including the Mac Mini may prefer to connect to the MT3000 wifi when it is up rather than your home wifi, making those machines lose internet connection…

1 Like