Hello, I've used openwrt as my main router for quite some time now and it works to the perfection. Recently, I started to use VLAN to have a somehow cleaner network infrastructure to separate my lan, from my dmz and from another "lan" network for IOT with access to wan disabled.

Today, I changed my ISP and upgraded my PC and my NAS to 2.5gbps and it led me to significant changes. The things to know first are :

So with all that, I thought about doing something like that:

The idea is to have one 192.168.1.0/24 network that would contain both LAN and DMZ (allowing LAN to contact DMZ without manually adding route on my LAN machines). The DMZ part would be differentiated by either a sub-range (192.168.1.192/26) or simply by the physical ports on my openwrt router.

The openwrt router would just bridge the ISP router to the DMZ adding some firewall rules in-between to limit the DMZ exchanges.

For the IOT part, I'd have a dedicated wlan interface on my router with its own dhcp server and no forwarding rules between zones. Then a VM would have a network interface with the appropriate VLAN to access these devices.

And then... I tried to implement all that. But it doesn't quite work :

So, do you have idea recommendation/improvement regarding my base design? Then, do you have an idea of what I have done wrong?

Network

Firewall

Wireless

DHCP