I wanted to make a network with 3 separated VLANs


So I hooked up two routers TL-WR740n with Openwrt installed, and started experiments.

First router(10.140.X.1) works as a DHCP server, second (10.140.X.2)just as a client with second set of ports.

I made three vlans - each is linked to coresponding port number.

On port 4 all VLANs are tagged - it's used to connect two devices.

I want to completely separate VLANs. But when I'm on VLAN1(subnet 10.140.1.X) I can open a panel of router( from VLAN2(subnet 10.140.2.X).

Why? How can I block a interVLAN traffic?

I made a separate zones for each VLAN - and blocked forwarding from VLAN1 to VLAN2(just to try).

It doesn't help me - i still can open a router site having address, and being on VLAN1.

Thank You in advance!


Your addresses are in different subnets. That means that when 10.140.1.X has a packet for, it will consult its routing table and see a couple of routes, one stating that is directly connected and another for via Since isn't in, it's the second route that matches, so the packet goes to That's in the same VLAN.

Then, which is connected to both VLANs, forwards it to This is the expected behavior. If you want to prevent it, you add some firewall rules on to prohibit the communication, e.g. with iptables:

iptables -A FORWARD -s -d -j REJECT
iptables -A FORWARD -s -d -j REJECT

But wait, we still haven't even tested if your VLANs work. Sending from to tests if routing between subnets works. The way to test if your VLANs are actually isolated from each other is to configure a device with a static address in, plug it into the VLAN for and see if it can reach devices in the other VLAN with addresses in It shouldn't be able to if the VLANs are properly isolated.

  • Thank You, i set these rules, and it worked - vlans are isolated... But there's another problem, when I surf internet on one of vlans, in hour-two, i have a DNS problem on computer - no one website works, but when i enter an IP address of one webpage - it loads a site. When i unplug ethernet patchcord, and plug again, problem is gone, but till next "hangup". What can I do now? – Niko Aug 11 at 21:59
  • What does that client have configured as a DNS server? – zrm Aug 11 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.