How to isolate a single LAN port to a different subnet?

[seud0nym]

I am trying to move a single LAN port (in this case eth3) to a different subnet, similar to the way that the Guest Wi-Fi runs on a different subnet.

The problem I am encountering is that there seems to be a routing issue. I can see from the logs that the router receives the DHCPREQUEST and sends the DHCPOFFER, but it never arrives back at the client. I have used iptables TRACE to ensure that it is not being blocked by a firewall rule.

I applied the changes by duplicating what the Guest network does.

Here are my config files:

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option default_ps '0'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '64'
	option ip6hint '0'
	option force_link '1'
	option rpfilter '1'
	list pppoerelay ''
	option ipaddr '192.168.145.1'
	option ifname 'eth0 eth1 eth2'

config switch
	option name 'bcmsw'
	option reset '1'
	option enable_vlan '0'

config interface 'Guest1'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '1'
	option netmask '255.255.255.128'
	option ipaddr '192.168.2.126'
	option ifname 'wl0_1'
	option force_link '1'
	option rpfilter '1'

config interface 'Guest1_5GHz'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '2'
	option netmask '255.255.255.128'
	option ipaddr '192.168.2.254'
	option ifname 'wl1_1'
	option force_link '1'
	option rpfilter '1'

config interface 'ppp'
	option proto 'pppoe'
	option metric '10'
	option username 'newdsluser@bigpond.com'
	option password 'new2dsl'
	option keepalive '4,20'
	option iface6rd '0'
	option graceful_restart '1'
	option auto '0'
	option ifname 'atm_8_35'

config interface 'ipoe'
	option proto 'dhcp'
	option metric '1'
	option reqopts '1 3 6 43 51 58 59'
	option release '1'
	option iface6rd '0'
	option vendorid 'technicolor'
	option auto '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option defaultreqopts '0'
	option reqopts '23 17'
	option reqaddress 'force'
	option noslaaconly '1'
	option iface_464xlat '0'
	option forceprefix '1'
	option soltimeout '240'
	option ifname 'eth4'

config interface 'wwan'
	option enabled '0'
	option proto 'mobiled'
	option session_id '0'
	option profile '1'
	option iface_464xlat '1'

config device 'eth4'
	option name 'eth4'
	option mtu '1500'
	option mtu6 '1500'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config device 'atm_8_35'
	option name 'atm_8_35'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config device 'ptm0'
	option name 'ptm0'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config ppp_placeholder
	option uciname 'pppoe-wan'

config config 'config'

config interface 'lan2'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '3'
	option netmask '255.255.255.0'
	option ipaddr '192.168.3.1'
	option force_link '1'
	option rpfilter '1'
	option ipv6 '1'
	option ifname 'eth3'

config interface 'wan'
	option reqopts '1 3 6 43 51 58 59'
	option iface6rd '0'
	option vendorid 'technicolor'
	option metric '1'
	option release '1'
	option proto 'dhcp'
	option ifname 'eth4'

/etc/config/dhcp

config dnsmasq 'main'
	option disabled '0'
	option nonwildcard '1'
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '0'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option strictorder '1'
	option dhcpscript '/lib/dnsmasq/dhcp-event.sh'
	option domain 'modem'
	list interface 'lan'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	list dhcp_option_force 'tag:cpewan-id,vi-encap:3561,6,"DJA0230TLS"'
	list dhcp_option_force 'tag:cpewan-id,vi-encap:3561,5,"CPXXXXXXXXX"'
	list dhcp_option_force 'tag:cpewan-id,vi-encap:3561,4,"101331"'
	list address '/fwstore.bdms.telstra.net/0.0.0.0'
	list address '/fwstore.bdms.telstra.net/::'
	list hostname 'DJA0230'
	list hostname 'telstra.wifi'

config dnsmasq 'guest'
	option disabled '0'
	option nonwildcard '1'
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '0'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option strictorder '1'
	option dhcpscript '/lib/dnsmasq/dhcp-event.sh'
	option domain 'modem'
	option add_local_fqdn '0'
	list hostname 'mymodem'
	list hostname 'mygateway'
	list hostname 'telstra'
	list interface 'Guest1'
	list interface 'Guest1_5GHz'
	list notinterface 'loopback'

config odhcpd 'odhcpd'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'lan'
	option instance 'main'
	option interface 'lan'
	option start '2'
	option limit '253'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'

config dhcp 'Guest1_private'
	option instance 'guest'
	option interface 'Guest1'
	option start '1'
	option limit '125'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'

config dhcp 'Guest1_5GHz_private'
	option instance 'guest'
	option interface 'Guest1_5GHz'
	option start '129'
	option limit '125'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'ppp'
	option interface 'ppp'
	option ignore '1'

config dhcp 'ipoe'
	option interface 'ipoe'
	option ignore '1'

config dhcp 'wwan'
	option interface 'wwan'
	option ignore '1'

config dhcp 'wan6'
	option interface 'wan6'
	option ignore '1'

config opassthrud 'opassthrud'
	option passthruscript '/lib/dhcpopassthrud/dnsmasq.sh'
	option options_needed '0'

config dnsmasq 'lan2'
	option disabled '0'
	option nonwildcard '1'
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '0'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option strictorder '1'
	option dhcpscript '/lib/dnsmasq/dhcp-event.sh'
	option domain 'modem'
	option add_local_fqdn '0'
	list hostname 'DJA0230'
	list interface 'lan2'
	list notinterface 'loopback'

config dhcp 'lan2_private'
	option instance 'lan2'
	option interface 'lan2'
	option start '2'
	option limit '253'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'
	option dhcpv4 'server'

To simplify the firewall settings, I just added the new lan2 interface to the Guest1 firewall zone, as that does what I want:

config zone
	option name 'Guest1'
	list network 'Guest1'
	list network 'lan2'
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	option wan '0'

Output of various commands:

root@DJA0230:~# ip -4 -o a
1: lo    inet 127.0.0.1/8 scope host lo\       valid_lft forever preferred_lft forever
12: eth4    inet 10.20.30.110/24 brd 10.20.30.255 scope global eth4\       valid_lft forever preferred_lft forever
16: eth3    inet 192.168.3.1/24 brd 192.168.3.255 scope global eth3\       valid_lft forever preferred_lft forever
23: wl0_1    inet 192.168.2.126/25 brd 192.168.2.127 scope global wl0_1\       valid_lft forever preferred_lft forever
24: wl1_1    inet 192.168.2.254/25 brd 192.168.2.255 scope global wl1_1\       valid_lft forever preferred_lft forever
26: br-lan    inet 192.168.145.1/24 brd 192.168.145.255 scope global br-lan\       valid_lft forever preferred_lft forever
root@DJA0230:~# ip -4 route
default via 10.20.30.1 dev eth4 proto static src 10.20.30.110 metric 1
10.20.30.0/24 dev eth4 proto static scope link metric 1
192.168.2.0/25 dev wl0_1 proto kernel scope link src 192.168.2.126
192.168.2.128/25 dev wl1_1 proto kernel scope link src 192.168.2.254
192.168.3.0/24 dev eth3 proto kernel scope link src 192.168.3.1
192.168.145.0/24 dev br-lan proto kernel scope link src 192.168.145.1
239.0.0.0/8 dev br-lan scope link
root@DJA0230:~#

I am hoping I have just missed something simple...

Thanks.

[LuKePicci]

You goal is fine and doable. There is a major big issue in your configs on your switch configuration.

The main point is that eth0-eth3 are not distinct adapters but they are DSA mappings to RJ45 switch ports.

Not sure if the official Openwrt DSA drivers (not available in tch firmwares) behave differently, but here with your current config the host connected to RJ45 LAN port mapped to eth3 is able to send packets to every other host connected on other switch ports since they all belong to the same VLAN. All you said so far in configs is that packets arriving at the switch from that RJ45 port and exiting the switch from the CPU port and showing up into eth3 device will be considered as being related to lan2 interface. You need to enable VLAN on the switch and set the first three ports as part of a different VLAN then the fourth. AFAIR you must set the switch to tag packets going to the CPU even if DSA is used. But that never had much sense to me (maybe DSA driver limitation/bug by bcm? ).

[seud0nym]

So does that mean I need to do something like the answer in this post:
#132 (comment)

[seud0nym]

I have tried the config below, and it is worse than before: the DHCPDISCOVER doesn't reach dnsmasq at all. At least the other way it was just the return DHCPOFFER that was lost.

EDIT: I have added a new switch stanza as follows:

config switch 'bcmsw_ext'
        option name 'bcmsw_ext'
        option reset '1'
        option type 'bcmsw'
        option unit '1'
        option enable_vlan '1'

and changed the device options in the switch_vlan stanzas to match, and the DHCPDISCOVER messages now arrive and the DHCPOFFER gets sent, but it still doesn't arrive back at the requesting client. The VLAN configuration has made no difference at all.

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option default_ps '0'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '64'
	option ip6hint '0'
	option force_link '1'
	option rpfilter '1'
	list pppoerelay ''
	option ipaddr '192.168.145.1'
	option ifname 'eth0_1 eth1_1 eth2_1'

config switch
	option name 'bcmsw'
	option reset '1'
	option enable_vlan '1'

config switch 'bcmsw_ext'
        option name 'bcmsw_ext'
        option reset '1'
        option type 'bcmsw'
        option unit '1'
        option enable_vlan '1'

config device 'eth0_1'
	option type '8021q'
	option ifname 'eth0'
	option name 'eth0_1'
	option vid '1'

config device 'eth1_1'
	option type '8021q'
	option ifname 'eth1'
	option name 'eth1_1'
	option vid '1'

config device 'eth2_1'
	option type '8021q'
	option ifname 'eth2'
	option name 'eth2_1'
	option vid '1'

config device 'eth3_103'
	option type '8021q'
	option ifname 'eth3'
	option name 'eth3_103'
	option vid '103'

config switch_vlan
	option device 'bcmsw_ext'
	option vlan '1'
	option ports '0* 1* 2* 8t'

config switch_vlan
	option device 'bcmsw_ext'
	option vlan '103'
	option ports '3* 8t'

config interface 'Guest1'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '1'
	option netmask '255.255.255.128'
	option ipaddr '192.168.2.126'
	option ifname 'wl0_1'
	option force_link '1'
	option rpfilter '1'

config interface 'Guest1_5GHz'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '2'
	option netmask '255.255.255.128'
	option ipaddr '192.168.2.254'
	option ifname 'wl1_1'
	option force_link '1'
	option rpfilter '1'

config interface 'ppp'
	option proto 'pppoe'
	option metric '10'
	option username 'newdsluser@bigpond.com'
	option password 'new2dsl'
	option keepalive '4,20'
	option iface6rd '0'
	option graceful_restart '1'
	option auto '0'
	option ifname 'atm_8_35'

config interface 'ipoe'
	option proto 'dhcp'
	option metric '1'
	option reqopts '1 3 6 43 51 58 59'
	option release '1'
	option iface6rd '0'
	option vendorid 'technicolor'
	option auto '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option defaultreqopts '0'
	option reqopts '23 17'
	option reqaddress 'force'
	option noslaaconly '1'
	option iface_464xlat '0'
	option forceprefix '1'
	option soltimeout '240'
	option ifname 'eth4'

config interface 'wwan'
	option enabled '0'
	option proto 'mobiled'
	option session_id '0'
	option profile '1'
	option iface_464xlat '1'

config device 'eth4'
	option name 'eth4'
	option mtu '1500'
	option mtu6 '1500'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config device 'atm_8_35'
	option name 'atm_8_35'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config device 'ptm0'
	option name 'ptm0'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config ppp_placeholder
	option uciname 'pppoe-wan'

config config 'config'

config interface 'lan2'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '3'
	option netmask '255.255.255.0'
	option ipaddr '192.168.103.1'
	option force_link '1'
	option rpfilter '1'
	option ipv6 '1'
	option ifname 'eth3_103'

config interface 'wan'
	option reqopts '1 3 6 43 51 58 59'
	option iface6rd '0'
	option vendorid 'technicolor'
	option metric '1'
	option release '1'
	option proto 'dhcp'
	option ifname 'eth4'

[ac1176]

Edit: below seems to only apply for DJA0231 firmware 18.3.c. See next post if using firmware 20.3.c.

Just coming back around to this rather old post, but I've managed to get eth3 working on its own dedicated VLAN using a similar Technicolor DJA0231 modem/router. This may also work on the DJA0230 that @seud0nym looked like he was trying to use, but I don't have a unit here to try it on. Beforehand I was having similar issues with the eth3 refusing to hand out a DHCP lease to a connected device on VLAN 103. eth0 - eth2 on VLAN were working OK.

1. Under the config interface 'lan' section of /etc/config/network, the router doesn't seem to acknowledge the entry option ifname 'eth0_1 eth1_1 eth2_1' when assigning ethernet ports to the interface. The correct notation is to revert to option ifname 'eth0.1 eth1.1 eth2.1'. The same fix would also be required under config interface 'lan', ie change option ifname 'eth3_103' to option ifname 'eth3.103'.
2. The above also makes defining each of the eth devices redundant, as you're now referring directly to the ethernet ports in each of the bridges. So the following sections can be deleted outright:

config device 'eth0_1'
	option type '8021q'
	option ifname 'eth0'
	option name 'eth0_1'
	option vid '1'

config device 'eth1_1'
	option type '8021q'
	option ifname 'eth1'
	option name 'eth1_1'
	option vid '1'

config device 'eth2_1'
	option type '8021q'
	option ifname 'eth2'
	option name 'eth2_1'
	option vid '1'

config device 'eth3_103'
	option type '8021q'
	option ifname 'eth3'
	option name 'eth3_103'
	option vid '103'

3. Enabling VLANs under config switch 'bcmsw' caused issues for me when attempting to log in to the web GUI (complained that my username/password was incorrect and wouldn't let me back in). I found it was best to leave VLAN disabled here. So option enable_vlan '1' should be option enable_vlan '0'. The only spot it should be enabled is under config switch 'bcmsw_ext'.
4. There is an error in the posted dhcp config under each of the config dnsmasq 'main', config dnsmasq 'guest' and (more critically) config dnsmasq 'lan2' sections. Each one contains option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto' which points to an invalid file path. The correct entry for each one should be option resolvfile '/tmp/resolv.conf.auto'.

Long story short, the following configs get things working on my DJA0231. As per the original requirements of @seud0nym, eth0 - eth2 remain operational as normal LAN access ports at 192.168.145.1 and eth3 is segregated from the others as 192.168.103.1. Both networks freely hand out DHCP leases correctly.

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option default_ps '0'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '64'
	option ip6hint '0'
	option force_link '1'
	option rpfilter '1'
	list pppoerelay ''
	option ipaddr '192.168.145.1'
	option ifname 'eth0.1 eth1.1 eth2.1'

config switch
	option name 'bcmsw'
	option reset '1'
	option enable_vlan '0'

config switch 'bcmsw_ext'
        option name 'bcmsw_ext'
        option reset '1'
        option type 'bcmsw'
        option unit '1'
        option enable_vlan '1'

config switch_vlan
	option device 'bcmsw_ext'
	option vlan '1'
	option ports '0* 1* 2* 8t'

config switch_vlan
	option device 'bcmsw_ext'
	option vlan '103'
	option ports '3* 8t'

config interface 'Guest1'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '1'
	option netmask '255.255.255.128'
	option ipaddr '192.168.2.126'
	option ifname 'wl0_1'
	option force_link '1'
	option rpfilter '1'

config interface 'Guest1_5GHz'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '2'
	option netmask '255.255.255.128'
	option ipaddr '192.168.2.254'
	option ifname 'wl1_1'
	option force_link '1'
	option rpfilter '1'

config interface 'ppp'
	option proto 'pppoe'
	option metric '10'
	option username 'newdsluser@bigpond.com'
	option password 'new2dsl'
	option keepalive '4,20'
	option iface6rd '0'
	option graceful_restart '1'
	option auto '0'
	option ifname 'atm_8_35'

config interface 'ipoe'
	option proto 'dhcp'
	option metric '1'
	option reqopts '1 3 6 43 51 58 59'
	option release '1'
	option iface6rd '0'
	option vendorid 'technicolor'
	option auto '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option defaultreqopts '0'
	option reqopts '23 17'
	option reqaddress 'force'
	option noslaaconly '1'
	option iface_464xlat '0'
	option forceprefix '1'
	option soltimeout '240'
	option ifname 'eth4'

config interface 'wwan'
	option enabled '0'
	option proto 'mobiled'
	option session_id '0'
	option profile '1'
	option iface_464xlat '1'

config device 'eth4'
	option name 'eth4'
	option mtu '1500'
	option mtu6 '1500'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config device 'atm_8_35'
	option name 'atm_8_35'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config device 'ptm0'
	option name 'ptm0'
	option neighreachabletime '1200000'
	option neighgcstaletime '2400'

config ppp_placeholder
	option uciname 'pppoe-wan'

config config 'config'

config interface 'lan2'
	option proto 'static'
	option ip6assign '64'
	option ip6hint '3'
	option netmask '255.255.255.0'
	option ipaddr '192.168.103.1'
	option force_link '1'
	option rpfilter '1'
	option ipv6 '1'
	option ifname 'eth3.103'

config interface 'wan'
	option reqopts '1 3 6 43 51 58 59'
	option iface6rd '0'
	option vendorid 'technicolor'
	option metric '1'
	option release '1'
	option proto 'dhcp'
	option ifname 'eth4'

/etc/config/dhcp:

config dnsmasq 'main'
	option disabled '0'
	option nonwildcard '1'
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '0'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option strictorder '1'
	option dhcpscript '/lib/dnsmasq/dhcp-event.sh'
	option domain 'modem'
	list interface 'lan'
	option resolvfile '/tmp/resolv.conf.auto'
	list dhcp_option_force 'tag:cpewan-id,vi-encap:3561,6,"DJA0230TLS"'
	list dhcp_option_force 'tag:cpewan-id,vi-encap:3561,5,"CPXXXXXXXXX"'
	list dhcp_option_force 'tag:cpewan-id,vi-encap:3561,4,"101331"'
	list address '/fwstore.bdms.telstra.net/0.0.0.0'
	list address '/fwstore.bdms.telstra.net/::'
	list hostname 'DJA0230'
	list hostname 'telstra.wifi'

config dnsmasq 'guest'
	option disabled '0'
	option nonwildcard '1'
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '0'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option strictorder '1'
	option dhcpscript '/lib/dnsmasq/dhcp-event.sh'
	option domain 'modem'
	option add_local_fqdn '0'
	list hostname 'mymodem'
	list hostname 'mygateway'
	list hostname 'telstra'
	list interface 'Guest1'
	list interface 'Guest1_5GHz'
	list notinterface 'loopback'

config odhcpd 'odhcpd'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'lan'
	option instance 'main'
	option interface 'lan'
	option start '2'
	option limit '253'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'

config dhcp 'Guest1_private'
	option instance 'guest'
	option interface 'Guest1'
	option start '1'
	option limit '125'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'

config dhcp 'Guest1_5GHz_private'
	option instance 'guest'
	option interface 'Guest1_5GHz'
	option start '129'
	option limit '125'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'ppp'
	option interface 'ppp'
	option ignore '1'

config dhcp 'ipoe'
	option interface 'ipoe'
	option ignore '1'

config dhcp 'wwan'
	option interface 'wwan'
	option ignore '1'

config dhcp 'wan6'
	option interface 'wan6'
	option ignore '1'

config opassthrud 'opassthrud'
	option passthruscript '/lib/dhcpopassthrud/dnsmasq.sh'
	option options_needed '0'

config dnsmasq 'lan2'
	option disabled '0'
	option nonwildcard '1'
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '0'
	option rebind_localhost '1'
	option local '/lan/'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option strictorder '1'
	option dhcpscript '/lib/dnsmasq/dhcp-event.sh'
	option domain 'modem'
	option add_local_fqdn '0'
	list hostname 'DJA0230'
	list interface 'lan2'
	list notinterface 'loopback'

config dhcp 'lan2_private'
	option instance 'lan2'
	option interface 'lan2'
	option start '2'
	option limit '253'
	option leasetime '1d'
	option force '1'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '0'
	option ra_mininterval '200'
	option ra_maxinterval '600'
	option ra_lifetime '1800'
	option ra_hoplimit '64'
	option dhcpv4 'server'

You'll also need a firewall rule to allow the new VLAN103 `lan2` to do anything useful. The original suggestion of attaching it to the pre-existing Guest1 rule will work if you're happy with how that one normally behaves:

/etc/config/firewall:

config zone
	option name 'Guest1'
	list network 'Guest1'
	**list network 'lan2'**
	option input 'DROP'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'
	option wan '0'

Although, there's obviously nothing stopping you creating your own firewall rules in the router to limit how network traffic on lan2 is controlled.

[ac1176]

Update: the above mods to the network and dhcp config files seem to only apply for DJA0231 firmware version 18.1.c.xxx. Just tried the same configs on a firmware 20.3.c.0389 unit and it didn't work, so there must be some slight differences in the way the two firmwares implement and handle the VLANs across different ethernet interfaces.

The good news is is that it still seems possible to do it on the newer 20.3.c.xxxx firmware. The better news is is that it seems to be completely doable from within the web GUI interface rather than through command line manipulation of the UCI configs. When I was originally experimenting with this on the older 18.3.c firmware, the GUI didn't generate a working config for me, which is how I ended up down the command line rabbit hole. The more recent firmware seems to have fixed this.

1. Log in to the router and bring up the 'Advanced' settings view. Click on the 'LAN' tile.
2. Click on the 'VLAN Filtering' tab and select the 'User VLANs Enabled' button. Save changes to apply
3. Edit the VLAN ID 1 row and set LAN port 4 to 'Off'. Leave ports 1-3 as 'Untagged'. Click the blue tickbox to apply settings.
4. Click the 'Add VLAN' button to insert a new row. Give the new row a VLAN ID of 103. Leave ports 1-3 set to 'Off' and set port 4 to 'Untagged'. Click the small '+' button to save the new VLAN row to the list.
5. Click in the 'Interfaces' tab. and add a new LAN interface using the small 'Add...' link on the left of the window. In the 'Add LAN Interface' popup set the Interface Name to 'lan2', set Device IPv4 Address to 192.168.103.1 and click the 'IPv6 Enabled on Boot' button. Leave everything else as default.
6. In the newly created 'lan2' interface section, set 'DHCPv4 Server' to enabled. Under the 'Port Assignment' section, tick the box in the VLAN ID 103 row underneath the 4th ethernet port to link the VLAN with the interface. Everything else can remain as default. Save changes to apply. Close the 'Local Network' window to return to the main GUI page.

That should be it. Ethernet ports 1-3 will now be accessible on the regular LAN subnet and port 4 will be isolated from the others on VLAN 103 as 'lan2'. The GUI even auto-creates a new set of firewall rules to cover the lan2 network with similar policies as the Guest networks, so you don't need to fiddle with them unless you're after something specific.

[seud0nym]

You should clarify that you are using tch-gui-unhide, rather than the stock GUI or tch-nginx-gui.

Using tch-gui-unhide should work on both 18.1.c and 20.3.c firmware. If it doesn't, you could raise an issue, but to be honest my response to an issue on 18.1.c firmware on a DJA0231 would be just to upgrade to 20.3.c. I consider tch-gui-unhide to be stable (since further firmware upgrades are unlikely) so it would have to be a significant issue for me to look at it.

[ac1176]

You should clarify that you are using tch-gui-unhide, rather than the stock GUI or tch-nginx-gui.

Yes, that is correct. Although the information may be relevant/adaptable to other users who might be attempting to do something similar using uci on their (non-Telstra) Technicolor units.

Using tch-gui-unhide should work on both 18.1.c and 20.3.c firmware. If it doesn't, you could raise an issue, but to be honest my response to an issue on 18.1.c firmware on a DJA0231 would be just to upgrade to 20.3.c. I consider tch-gui-unhide to be stable (since further firmware upgrades are unlikely) so it would have to be a significant issue for me to look at it.

Indeed, I was initially going to raise it as an issue over at your repo, but it looked like creation of new issues was locked out; I was unable to kick one off. But I agree with you - now I know 20.3.c seems to 'fix' the creation/usage of local VLANs the logical solution would be to disregard 18.3.c and upgrade to a newer version as a first step to putting these units into service.