802.11s - Simple VXLAN tunnel for VLAN trunk

For this to stay simple the VXLAN will lay over a IPv6 Link-Local layer 3.

The process involves setting up a mesh network and setting it a 1574 MTU, adding it a layer 3, setting up the VXLAN to use multicast address to auto discover VTEPs and using that VXLAN as a VLAN port.

You will only need to install luci-proto-vxlan package.

This is the most care needed part, the interface created for the mesh must be leave as unmanaged and as is very important to set the MTU. Failing to set the MTU will make the VXLAN to not work at all because IPv6 packets cannot be fragmented per spec. Notice that adding the unmanaged interface has two purposes, the first will make the mesh network IPv6 support default to be enabled for OpenWrt and the second one the VXLAN only accept interfaces and not direct devices.

In /etc/config/wireless let's add a mesh vif named mesh-vif and assign it to the mesh unmanaged interface. Set radio0 or the one you will use for your mesh network:

config wifi-iface 'wifinet_mesh'
	option device 'radio0'
	option mode 'mesh'
	option network 'mesh'
	option encryption 'sae'
	option mesh_id 'YourMesh'
	option mesh_fwding '1'
	option mesh_rssi_threshold '0'
	option key 'YourMeshPassword'
	option ifname 'mesh-vif'

In /etc/config/network let's set 1574 MTU for the mesh-vif and also define the unmanaged mesh interface:

config device
	option name 'mesh-vif'
	option mtu '1574'

config interface 'mesh'
	option proto 'none'
	option multipath 'off'

Is very possible that you won't get a IPv6 Local-Link address till you reboot or use sysctl to enable ipv6 support to the mesh-vif. Adding the unmanaged interface change the default to enable but only takes effect till rebooting or manually using sysctl. Reboot now or wait till you finish up all the configuration.

Doing this will make the mesh interface to do only what it should, we will disable INPUT from it, allow Neighbour Discovery Protocol needed for the nodes to discover others IPv6 Local-Link addresses and to allow the incoming VXLAN traffic from any device with a IPv6 Local-Link address in the mesh interface.

In /etc/config/firewall:

config zone
	option name 'mesh'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'mesh'

config rule
	option name 'Mesh-Allow-NDP'
	option src 'mesh'
	option family 'ipv6'
	list proto 'icmp'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option target 'ACCEPT'

config rule
	option name 'Mesh-Allow-VXLANv6'
	option src 'mesh'
	option family 'ipv6'
	list proto 'udp'
	list src_ip 'fe80::/10'
	option dest_port '4789'
	option target 'ACCEPT'

In /etc/config/network just add a vxmesh interface as:

config interface 'vxmesh'
	option proto 'vxlan6'
	option peer6addr 'ff02::cafe'
	option tunlink 'mesh'
	option multipath 'off'

You can put any IPv6 Link-Local multicast address so ff02::cafe is just because is simple, but remember that you must set the exact same address for all the nodes.

For a main lan 10 and guest lan 20 we will set in /etc/config/network:

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'vxmesh'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'vxmesh:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'vxmesh:t'

Now you could replace br-lan in your main lan with br-lan.10 and use br-lan.20 for a guest interface.