Requesting help setting up vlans on the Flint 2 with a Dual Wan setup

chessset5 · July 30, 2025, 7:02am

I have been trying to set this up for a few days now and I feel like I have been getting nowhere. I have a sneaking suspicion that it is because I have a dual wan setup.

Attached are my diagrams for my network. I am trying to make 4 vlans.

One for lan, which I have assigned vlan 1, (br-lan.1)
One for guest, which I have assigned vlan 9, (br-lan.9)
One for iot, vlan x, (br-lan.x)
and One for my security system, vlan y, (br-lan.y)

where x and y are vlan id's numerically larger than 9.

I am not sure why but I cannot get my traffic to exit to the internet without having it travel through a VPN first.

I can get to the router from the internet via TailScale, I can get to the router from my network via br-lan.1, but I can't for the life of me get from br-lan.1 to the internet unless I whitelist the domain/public ip in the VPN dashboard.

The only real difference between my setup and all the other examples I can find online is that my setup has a dual wan configuration. One for redundancy and two for increased download speeds.

I do not want to use Vanilla OpenWRT and use the GLiNet OpenWRT if possible. Mostly because my VPN setup is quite complex and I really don't want to mimic the setup in Vanilla when GLiNet makes it so simple in their GUI.

I would really like it if I can make this work. If anyone can help me, it would be greatly appreciated. My network diagrams are posted below.

I can change the colors and contrast if needed.

Thank you in advance for any help anyone provides.
Please let me know if there is anything else I can provide to help get a better understanding of my network.

bruce · July 31, 2025, 9:48am

Hi,

Please check the firewall of the corresponding VLAN interface.

It shouldn't be a problem caused by dual WAN.

If possible, you can share your Flint 2 Main and Dump VLAN configuration for us to check.

chessset5 · August 1, 2025, 5:41am

Are these the config's you are referring to?
etc/config/{firewall/network/dhcp}?

Please let me know if there is a specific command you would like me to run or what files to share. I know how to use a terminal and use ssh/sftp, but I am not very familiar with OpenWRT/GLiNET or advanced networking.

etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option input 'DROP'
	list network 'wan'
	list network 'wan6'
	list network 'wwan'
	list network 'secondwan'
	option masq6 '1'

config forwarding
	option src 'lan'
	option dest 'wan'
	option enabled '0'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled 'false'

config include
	option path '/etc/firewall.user'

config zone
	option name 'guest'
	option forward 'REJECT'
	option output 'ACCEPT'
	option input 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'
	option enabled '0'

config rule
	option name 'Allow-DHCP'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '67-68'

config rule
	option name 'Allow-DNS'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'tcp udp'
	option dest_port '53'

config include 'nat6'
	option path '/etc/firewall.nat6'
	option reload '1'

config rule 'process_mark'
	option name 'process_mark'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 65533'
	option target 'MARK'
	option set_xmark '0x8000/0xc000'

config rule 'process_mark_dns'
	option name 'process_mark_dns'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 453'
	option target 'MARK'
	option set_xmark '0x8000/0xc000'

config rule 'process_mark_stubby'
	option name 'process_mark_stubby'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 410'
	option target 'MARK'
	option set_xmark '0x8000/0xc000'

config rule 'process_explict_vpn'
	option name 'process_explict_vpn'
	option dest '*'
	option proto 'all'
	option extra '-m owner --gid-owner 20000'
	option target 'MARK'
	option set_xmark '0x20000/0x20000'

config rule 'wan_in_conn_mark'
	option name 'wan_in_conn_mark'
	option src 'wan'
	option dest '*'
	option proto 'tcp udp icmp'
	option set_xmark '0x8000/0xc000'
	option target 'MARK'
	option extra '-m mark --mark 0x0/0x3f00 -j CONNMARK --set-xmark 0x8000/0xc000'
	option enabled '1'

config rule 'lan_in_conn_mark_restore'
	option name 'lan_in_conn_mark_restore'
	option src 'lan'
	option dest '*'
	option proto 'tcp udp icmp'
	option set_xmark '0x8000/0xc000'
	option target 'MARK'
	option extra '-m connmark --mark 0x8000/0xc000 -j CONNMARK --restore-mark --nfmask 0xc000 --ctmask 0xc000'
	option enabled '1'

config rule 'out_conn_mark_restore'
	option name 'out_conn_mark_restore'
	option dest '*'
	option proto 'tcp udp icmp'
	option set_xmark '0x8000/0xc000'
	option target 'MARK'
	option extra '-m connmark --mark 0x8000/0xc000 -j CONNMARK --restore-mark --nfmask 0xc000 --ctmask 0xc000'
	option enabled '1'

config include 'swap_wan_in_conn_mark'
	option type 'script'
	option reload '1'
	option path '/etc/firewall.swap_wan_in_conn_mark.sh'
	option enabled '1'

config include 'vpn_client_deal_leak'
	option type 'script'
	option reload '1'
	option path '/etc/firewall.vpn_client_deal_leak.sh'
	option enabled '1'

config include 'glblock'
	option type 'script'
	option path '/usr/bin/gl_block.sh'
	option reload '1'

config include 'vpn_server_policy'
	option type 'script'
	option path '/etc/firewall.vpn_server_policy.sh'
	option reload '1'
	option enabled '1'

config forwarding 'ovpnserver2wgclient'
	option src 'ovpnserver'
	option dest 'wgclient'
	option enabled '0'

config forwarding 'ovpnserver2ovpnclient'
	option src 'ovpnserver'
	option dest 'ovpnclient'
	option enabled '0'

config rule 'ovpnserver_allow'
	option name 'ovpnserver_allow'
	option target 'ACCEPT'
	option src 'wan'
	option proto 'udp'
	option family 'ipv4'
	option dest_port '1194'
	option enabled '1'

config zone 'ovpnserver'
	option name 'ovpnserver'
	option output 'ACCEPT'
	option mtu_fix '1'
	option masq '1'
	option masq6 '1'
	option enabled '1'
	option input 'ACCEPT'
	list network 'ovpnserver'
	option forward 'REJECT'

config forwarding 'ovpnserver2wan'
	option src 'ovpnserver'
	option dest 'wan'
	option enabled '1'

config forwarding 'lan2ovpnserver'
	option src 'lan'
	option dest 'ovpnserver'
	option enabled '1'

config forwarding 'ovpnserver2lan'
	option src 'ovpnserver'
	option dest 'lan'
	option enabled '1'

config zone 'wgclient'
	option name 'wgclient'
	option forward 'DROP'
	option output 'ACCEPT'
	option mtu_fix '1'
	option enabled '1'
	option input 'DROP'
	option masq '1'
	option masq6 '1'
	list network 'wgclient'

config forwarding 'wgclient2wan'
	option src 'wgclient'
	option dest 'wan'
	option enabled '1'

config forwarding 'lan2wgclient'
	option src 'lan'
	option dest 'wgclient'
	option enabled '1'

config forwarding 'guest2wgclient'
	option src 'guest'
	option dest 'wgclient'
	option enabled '1'

config redirect 'dns_vpn'
	option name 'dns for vpn'
	option src 'lan'
	option src_dport '53'
	option dest 'lan'
	option dest_port '1653'
	option mark '!0x8000/0xc000'
	list proto 'tcp'
	list proto 'udp'
	option extra '-m addrtype --dst-type LOCAL'
	option family 'any'
	option enabled '0'

config redirect 'dns_vpn_guest'
	option name 'dns for vpn guest'
	option src 'guest'
	option src_dport '53'
	option dest 'guest'
	option dest_port '1653'
	option mark '!0x8000/0xc000'
	list proto 'tcp'
	list proto 'udp'
	option extra '-m addrtype --dst-type LOCAL'
	option family 'any'
	option enabled '0'

config zone
	option name 'iot'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config zone
	option name 'security'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'security'

config forwarding
	option src 'iot'
	option dest 'wan'
	option enabled '1'

config forwarding
	option src 'lan'
	option dest 'iot'
	option enabled '1'

config forwarding
	option src 'security'
	option dest 'wan'
	option enabled '1'

config forwarding
	option src 'lan'
	option dest 'security'
	option enabled '1'

config forwarding
	option src 'ovpnserver'
	option dest 'security'

config forwarding
	option src 'ovpnserver'
	option dest 'iot'

config rule
	option name 'allow-dhcp'
	list proto 'udp'
	option src 'iot'
	option target 'ACCEPT'
	option src_port '67-68'

config rule
	option name 'allow-dhcp'
	list proto 'udp'
	option src 'security'
	option src_port '67-68'
	option target 'ACCEPT'

config rule
	option name 'allow-dns'
	option src 'iot'
	option src_port '53'
	option target 'ACCEPT'

config rule
	option name 'allow-dns'
	option src 'security'
	option src_port '53'
	option target 'ACCEPT'

config rule 'sambasharewan'
	option src 'wan'
	option dest_port '137 138 139 445'
	option dest_proto 'tcpudp'
	option target 'DROP'

config rule 'sambasharelan'
	option src 'lan'
	option dest_port '137 138 139 445'
	option dest_proto 'tcpudp'
	option target 'ACCEPT'

config rule 'glnas_ser'
	option src 'wan'
	option dest_port '6000-6002'
	option dest_proto 'tcp'
	option target 'DROP'

config rule 'webdav_wan'
	option src 'wan'
	option dest_port '6008'
	option dest_proto 'tcp'
	option target 'DROP'

config rule 'glipv6_guest_dhcp'
	option name 'Allow-DHCP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'udp'
	option dest_port '546:547'
	option family 'ipv6'

config rule 'glipv6_guest_icmp'
	option name 'Allow-ICMP-IPV6'
	option src 'guest'
	option target 'ACCEPT'
	option proto 'icmp'
	option dest_port '58'
	option family 'ipv6'

etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd35:db6a:a2c5::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	option macaddr 'xx:xx:xx:xx:xx:xx'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'lan5'
	option bridge_empty '1'
	option vlan_filtering '0'

config device
	option name 'lan1'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan2'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan3'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan4'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config device
	option name 'lan5'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'lan'
	option proto 'static'
	option ipaddr '192.168.8.1'
	option netmask '255.255.255.0'
	option isolate '0'
	option ip6assign '64'
	option ip6hint '0000'
	option ip6ifaceid '::1'
	list ip6class 'local'
	option device 'br-lan'

config device
	option name 'eth1'
	option macaddr 'xx:xx:xx:xx:xx:xx'

config interface 'wan'
	option device 'eth1'
	option proto 'dhcp'
	option force_link '0'
	option classlessroute '0'
	option metric '10'
	option ipv6 '1'

config interface 'wan6'
	option proto 'dhcpv6'
	option device '@wan'
	option disabled '0'

config interface 'guest'
	option type 'bridge'
	option multicast_querier '1'
	option igmp_snooping '0'
	option isolate '0'
	option bridge_empty '1'
	option disabled '1'
	option proto 'static'
	option ipaddr '192.168.9.1'
	option netmask '255.255.255.0'
	option device 'br-lan.9'

config rule 'policy_relay_lo_rt_lan'
	option lookup '16800'
	option in 'loopback'
	option priority '1'

config interface 'tethering6'
	option device '@tethering'
	option proto 'dhcpv6'
	option disabled '0'

config interface 'wwan6'
	option device '@wwan'
	option proto 'dhcpv6'
	option disabled '0'

config interface 'wwan'
	option proto 'dhcp'
	option classlessroute '0'
	option metric '20'

config interface 'secondwan'
	option proto 'dhcp'
	option metric '15'
	option force_link '0'
	option classlessroute '0'
	option device 'lan1'
	option ipv6 '1'

config interface 'secondwan6'
	option proto 'dhcpv6'
	option device '@secondwan'
	option metric '15'
	option disabled '0'

config rule 'policy_direct_rt'
	option lookup 'main'
	option suppress_prefixlength '0'
	option priority '1100'

config rule 'policy_default_rt_vpn'
	option mark '0x8000/0xc000'
	option lookup '8000'
	option priority '1101'
	option invert '1'

config rule6 'policy_direct_rt6'
	option lookup 'main'
	option suppress_prefixlength '0'
	option priority '1100'

config rule6 'policy_default_rt_vpn6'
	option mark '0x8000/0xc000'
	option lookup '8000'
	option priority '1101'
	option invert '1'

config rule 'policy_default_rt_vpn_ts'
	option lookup 'main'
	option priority '1099'
	option mark '0x80000/0xc0000'
	option invert '0'

config interface 'ovpnserver'
	option proto 'ovpnserver'
	option disabled '0'

config interface 'wgclient'
	option proto 'wgclient'
	option config 'peer_1000'
	option disabled '0'

config interface 'security'
	option device 'br-lan.xx'
	option auto '0'
	option proto 'static'
	option ipaddr '192.168.xx.1'
	option netmask '255.255.255.0'

config interface 'iot'
	option auto '0'
	option proto 'static'
	option device 'br-lan.yy'
	option ipaddr '192.168.yy.1'
	option netmask '255.255.255.0'

config bridge-vlan
	option device 'br-lan'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan5:u*'
	option vlan '1'

config bridge-vlan
	option device 'br-lan'
	option vlan '9'
	list ports 'lan2:t'

config bridge-vlan
	option device 'br-lan'
	option vlan 'yy'
	list ports 'lan2:t'

config bridge-vlan
	option device 'br-lan'
	option vlan 'xx'
	list ports 'lan2:t'
	list ports 'lan4:u*'

etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option rebind_protection '0'
	option domain 'ts.net lan'
	list server '127.0.0.1#5453'
	option noresolv '1'
	option localuse '1'
	option filter_aaaa '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'
	option ra_default '1'
	list dns 'fd35:db6a:a2c5:0000:0000:0000:0000:0001'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'guest'
	option interface 'guest'
	option leasetime '12h'
	option start '85'
	option limit '85'
	option force '1'
	list dns 'fd35:db6a:a2c5:0001:0000:0000:0000:0001'
	option ra_management '1'
	option ra_default '1'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ra 'hybrid'
	option dhcpv6 'hybrid'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config domain
	option name 'console.gl-inet.com'
	option ip '192.168.8.1'

config domain
	option name 'console.gl-inet.com'
	option ip '::ffff:192.168.8.1'

config dhcp 'secondwan'
	option interface 'secondwan'
	option ignore '1'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'ArcherAX3000'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'Archer_A7'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'Archer_A7'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'LaserJet Pro MFP M148fdw'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'HP Color LaserJet CP1518ni'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'PowerHog'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'Ezbo'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.2'
	option tag 'GL-MT6000'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.xx'
	option tag 'Office Moca'

config dhcp 'security'
	option interface 'security'
	option leasetime '12h'
	option start '85'
	option limit '85'
	option force '1'
	list ra_flags 'none'

config dhcp 'iot'
	option interface 'iot'
	option leasetime '12h'
	option start '85'
	option limit '85'
	option force '1'
	list ra_flags 'none'

config host
	option mac 'xx:xx:xx:xx:xx:xx'
	option ip '192.168.8.3'

chessset5 · August 3, 2025, 12:48am

I have made a discovery, on the VPN Dashboard, I have a VPN client enabled for Proxy mode with Based on the Target Domain or IP. When I turn off the VPN client, my custom VLANs can now reach the internet.

But I do want to have those VPN client rules works still even when my VLANs are up. Is that possible with the GLiNet firmware 4.7.7?

Is there something in the configuration that I should set or interface I should have traffic route through to make this work?

system · November 1, 2025, 12:49am

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.