Project #35 - Adding VLANS to the FLINT1 and FLINT2 routers

I have finally come to the point where I need to setup VLANs on the FLINT routers in my network.  I have noted for some time that people have problems with setting up VLANs on GL-iNet routers in general.  I mainly want to do this so that I can have some vlans that are outside of my normal Edgerouter-12 controlled space.  This would also enable me to get more into the fine tuning of these routers.  I can see having a couple of guest vlans on each router which would connect over iBGP.  I am currently reading a book on the ins and outs of GL-iNet that might give me some better information on how to do this, however at the moment it seems to be more of a word salad than a how to book.

I also need to be careful to document the entire process so that I can reproduce it.  To that end I will document the process in the RedNotebook app.  I intend on noting differences between the FLINT1 and FLINT2 setups. The main changes should be limited to one or two vlans on each router:

• On FLINT1 I will add two VLANs; Guest1 and Arbitrary1 that will not have access to the basic vlan
• On FLINT2 I will add two VLANs; Guest2 and Arbitrary2 that will not have access to the basic vlan
• The setup should be able to be altered to accommodate iBGP or VXLAN in the future (or any other items I might want to experiment with)

Update: I am placing this project on hold for the moment until I have more time.

State of the Network in June 2025

I just recently changed my connections between the living room and the back bedroom.  Now I have a flat cable going between the FLINT 1 router in the living room to a switch in the back bedroom where I have connected both the PiHole Raspberry Pi and the switch originally in the living room to my rack.  In this way, I now do not have any vlans accessible in the living room.  I basically decided that all of my activities should be done in the back bedroom where I have my rack equipment.  I also now have the TCL TV connected directly to the FLINT 1 router.  I may still try to do a BGP from the FLINT 2 router in the back bedroom to the FLINT 1 router in the living room, but I have plenty of time to tinker before that happens. I do have some thoughts about how I might change things in the future:

• Complete the task of setting up a Certificate Authority in the HomeLab
• Add VLANs to the FLINT2 router
• Arrange the power so that the FLINT2 router can remain on if I shutdown the Rack
• Alter the way that I connect my laptop to the network so that it remains connected at all times on the correct VLAN
• Implement the PiHole to give out DNS and DHCP IPs within the HomeLab
• Work up some 3D printed components to stage the remaining Raspberry Pis external to the Rack, but still be present within the HomeLab
• Work up the use of my STREAM deck to issue MQTT messages for HomeLab control
• Spin up a file server on the HomeLab
• Finish setting up the Raspberry Pi display/controller; connected via Tailscale

Added a new 802.11ax Router to the Apartment

So I have purchased a new router, the Gl-iNet FLINT (GL-AX1800).  The reason that I did this was to optimize the connection between my HomeLab equipment and the apartment WiFi end point.  The FLINT is located 17 and a half feet from the end point and has 4 external antenna.  In addition, the FLINT is based on OpenWRT, which the SLATE was also based on.  Right now, being a new product, the software load is not quite up to the current edition of OpenWRT, but the beta test versions are promising.  I have downloaded the latest Beta and will be updating this router prior to the full software release.  The reason is to be able to setup vlans so that I can also plug in my TV and DVD player without interfering with the HomeLab connection.

After setting up the router in the space in the living room, I am measuring a speed of 400Mbps/400Mbps to the end point when setup as a repeater.  This is the kind of speed gain that I am hoping for.  The WiFi connection is continuing to reset itself and I need to know why.  I have noticed that the main indication of failure is that the DNS is no longer able to work through the connection and that the Weather Station is no longer pushing out information.

Update: so now the FLINT router has crapped out, possibly because I did some setting I shouldn’t have.  I have updated to the latest v4.1.0 beta without any custom values and now it works.  Go figure.

Update2: the problem with the WiFi connection stopping appears to be related to a DNS issue.  I can still ping IPs but just can't use DNS names.  Is this some setting somewhere?

Alteration to the Network Input to/from the Rack

 I have been contemplating how to provide an interface into the rack that would allow me to provide an interface to the RPis and the Proxmox server on the rack.  So far I have had an interface to the Edgerouter-12 (ER-12) through a SLATE router.  However, I found out that the rule set that is being used here in the retirement community doesn’t allow me to access ports on the SLATE unless I am connected to their portal vlan.  I decided to start some experiments to find out what I can actually do with the network.  Be aware that all IP addresses within the retirement community are RFC1918 private addresses.

I had previously connected the SLATE router to the ER-12 through two AV2000 Ethernet over power interfaces, each with two Ethernet ports apiece.  So it was SLATE LAN -> AV2000 -> AV2000 -> ER-12 WAN.  The SLATE was connected into the resident vlan which does not allow conversation between hosts on the resident vlan.  However, I have been able to connect between a host on the resident vlan and a host on the portal vlan.  I decided to put an RPi connected to the portal vlan, but also connected to a vlan within the rack.  That way, I can connect my laptop, or iPhone/iPad to any port on the RPi.  To do this, I decided to implement a trunk line between the two AV2000s.

I resurrected one of the managed switches from the tubs that I brought to the community and configured a trunk port and an untagged port to a vlan (vlan32) specifically for traffic between the SLATE and the ER-12.  I configured the same vlan (vlan32) on my M4100-26G switch along with a trunk port that had the same setup as the trunk port on the managed switch from my tub stores.  By connecting these up I now have the following:  SLATE LAN (vlan32) -> managed switch -[T]-> AV2000 -> AV2000 -[T]-> M4100-26G -[vlan32]-> ER-12 WAN (vlan32).

Since I can get to the managed switch within the rack from the Admin vlan, I was able to set other vlans so that I can add an RPi Gateway (ServerNet vlan/portal vlan).  This allows me to setup a firewall with open ports to the ServerNet vlan from the portal vlan which is wifi facing.  Next up is the configuration of the RPi Gateway.

Changed out the WiFi hookup in the Apartment

I did some measurements of the 802.11ac signal levels in my apartment.  When I am up close to the Cisco endpoint, I am measuring around -41 dBm, which is a pretty high level signal (-30 dBm being the theoretical maximum).  But when I measured the level in the back bedroom it came up as -78 dBm.  A level of -70 dBm is about minimum for not dropping packets.  So I am below that and that is why I have been having issues with the 802.11ac not having enough speed at 11 o'clock at night when everyone is streaming their stuff.  The reason for the drop in signal level is due to the construction of the apartment.  The apartment is basically a firebox, made to withstand fire from the outside, including the positive pressure in the hallways to keep fires at bay.  The walls inside the apartment have steel studs and the plasterboard is almost the consistency of concrete.  Both of these material types are bound to have an effect on RF transmission from the endpoint.

I decided to move the GL-iNet SLATE to the living room (around -44 dBm).  I am now connecting the SLATE to the rack by the use of some TP-Link AV2000 power adapters.  In that way I should be able to have an increase in speed of the network connection.  I discovered that the Signal and Noise levels, from the SLATE itself, are Signal = -35 dBm and Noise = -70 dBm.  That indicates that my -78 dBm measured in the back part of the apartment was way below the noise level, which means my packets were probably suffering from re-transmission.  No wonder I was seeing a slowdown of the connections to the outside.

HomeLabUpdate #01 - Initial Rack Setup

 As I came into the Apartment, I had setup the rack to have (from top to bottom):

• 24 port patch panel
• Ubiquiti Edgerouter-12 Router
• Short shelf for KVM and regular switch/ER-X
  
• Netgear M4100-26g Switch
  
• Panel with 4 Raspberry Pi 4s (RPiInject, RPiCICD, RPiLDAP, RPiPlex)
  
• Panel with 4 Raspberry Pi 3Bs (RPiSecure, RPiPower3, RPiPower2, RPiPower1)
• Shelf for containing WDMyCloud drives
• Open area (2U) TBD on contents
  
• Proxmox Server (2U case)
• APC UPS (1U)

I had left 6 Ethernet cables connected, numbered #8-1 through #8-6.  When I got to the apartment, I added the GL-iNet SLATE router (in Repeater mode, without second SSID) as the input to the apartment's wifi system.  My printer is connected to the wifi system and I have connected the HA-IOT server to the back of my Acer Monitor with connections through the 4-way KVM switch.