write the configuration files for openwrt for 4 virtual networks on the 4 ports of the internal switch. allow only traffic to port 1 for vlan 1. allow only traffic to port 2 for vlan 2. allow only traffic to port 4 for vlan 4.

To configure OpenWrt for 4 virtual networks (VLANs) on the 4 ports of the internal switch, you'll need to edit the network configuration file (usually found in `/etc/config/network`) and potentially the firewall configuration (in `/etc/config/firewall`) to secure the specified VLANs.

Below are the sample configuration snippets for your requirements:

### /etc/config/network

```bash
config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '0t 1'
    option vid '1'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '0t 2'
    option vid '2'

config switch_vlan
    option device 'switch0'
    option vlan '3'
    option ports '0t 3'
    option vid '3'

config switch_vlan
    option device 'switch0'
    option vlan '4'
    option ports '0t 4'
    option vid '4'

config interface 'vlan1'
    option ifname 'eth0.1'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    
config interface 'vlan2'
    option ifname 'eth0.2'
    option proto 'static'
    option ipaddr '192.168.2.1'
    option netmask '255.255.255.0'
    
config interface 'vlan3'
    option ifname 'eth0.3'
    option proto 'static'
    option ipaddr '192.168.3.1'
    option netmask '255.255.255.0'
    
config interface 'vlan4'
    option ifname 'eth0.4'
    option proto 'static'
    option ipaddr '192.168.4.1'
    option netmask '255.255.255.0'
```

### /etc/config/firewall

To restrict the traffic according to your specifications, you can modify the firewall settings. Here is an example firewall configuration that allows only the specified VLAN traffic:

```bash
config default
    option input    'ACCEPT'
    option output   'ACCEPT'
    option forwarding 'REJECT'

# Allow VLAN 1 on port 1
config rule
    option src 'vlan1'
    option target 'ACCEPT'

# Allow VLAN 2 on port 2
config rule
    option src 'vlan2'
    option target 'ACCEPT'

# Allow VLAN 4 on port 4
config rule
    option src 'vlan4'
    option target 'ACCEPT'
    
# Block all other traffic
config rule
    option src '*'
    option target 'REJECT'
```

### Notes:
1. Make sure your internal switch supports these configurations. The example above assumes you are using a common architecture that supports VLAN tagging on switch ports.
2. Replace `eth0` with the correct interface name if your setup differs.
3. Be careful with firewall rules, as they can disrupt existing connections if not configured correctly.
4. After making these changes, restart your network/configuration for them to take effect:
   ```bash
   /etc/init.d/network restart
   /etc/init.d/firewall restart
   ```

Always backup current configurations before making changes and double-check based on the specific hardware and firmware version you are using.

Update (2024-11-13):
To configure OpenWrt with four virtual networks (VLANs) on an internal switch, and to create firewall rules using `nftables` to restrict traffic to specific ports, you will need to modify a few configuration files in OpenWrt. Below is a step-by-step guide, including the necessary configuration files.

### Step 1: Configure VLANs 

You will configure the VLANs in the network configuration file. The VLANs will be assigned to specific ports on the internal switch.

Edit `/etc/config/network`:

```bash
config switch 'switch0'
    option name 'switch0'
    option reset '1'
    option enable '1'

config switch_vlan 'vlan1'
    option device 'switch0'
    option vlan '1'
    option ports '0'
    
config switch_vlan 'vlan2'
    option device 'switch0'
    option vlan '2'
    option ports '1'
    
config switch_vlan 'vlan3'
    option device 'switch0'
    option vlan '3'
    option ports '2'
    
config switch_vlan 'vlan4'
    option device 'switch0'
    option vlan '4'
    option ports '3'
```

### Step 2: Configure Interfaces

Now, you’ll configure the interfaces file to define the VLAN interfaces.

Edit `/etc/config/network` and add the following to define interfaces for each VLAN:

```bash
config interface 'vlan1'
    option proto 'static'
    option ifname 'eth0.1'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'

config interface 'vlan2'
    option proto 'static'
    option ifname 'eth0.2'
    option ipaddr '192.168.2.1'
    option netmask '255.255.255.0'

config interface 'vlan3'
    option proto 'static'
    option ifname 'eth0.3'
    option ipaddr '192.168.3.1'
    option netmask '255.255.255.0'

config interface 'vlan4'
    option proto 'static'
    option ifname 'eth0.4'
    option ipaddr '192.168.4.1'
    option netmask '255.255.255.0'
```

### Step 3: Configure Firewall with nftables

You will create a firewall configuration using `nftables`. First, make sure `nftables` is installed:

```bash
opkg update
opkg install nftables
```

Edit `/etc/nftables.conf` to include the firewall rules:

```bash
#!/usr/sbin/nft -f

table inet filter {
    chain input {
        type filter hook input priority filter; policy accept;

        # Allow established and related connections
        tcp flags & (syn|fin|rst|psy) != syn ct state established,related accept

        # Drop all other traffic by default
        reject with icmp type admin-prohibited
    }

    chain forward {
        type filter hook forward priority filter; policy drop;  # Default policy drop

        # Traffic from VLAN 1
        iifname "eth0.1" oifname "eth0.1" accept
        iifname "eth0.1" oifname "eth0.2" drop
        iifname "eth0.1" oifname "eth0.3" drop
        iifname "eth0.1" oifname "eth0.4" drop
        
        # Traffic from VLAN 2
        iifname "eth0.2" oifname "eth0.1" drop
        iifname "eth0.2" oifname "eth0.2" accept
        iifname "eth0.2" oifname "eth0.3" drop
        iifname "eth0.2" oifname "eth0.4" drop

        # Traffic from VLAN 3
        iifname "eth0.3" oifname "eth0.1" drop
        iifname "eth0.3" oifname "eth0.2" drop
        iifname "eth0.3" oifname "eth0.3" accept
        iifname "eth0.3" oifname "eth0.4" drop
        
        # Traffic from VLAN 4
        iifname "eth0.4" oifname "eth0.1" drop
        iifname "eth0.4" oifname "eth0.2" drop
        iifname "eth0.4" oifname "eth0.3" drop
        iifname "eth0.4" oifname "eth0.4" accept
    }
}
```

### Step 4: Start and Enable nftables

Enable `nftables` to start on boot and load the configuration:

```bash
/etc/init.d/nftables enable
/etc/init.d/nftables start
nft -f /etc/nftables.conf
```

### Step 5: Finalizing, Testing, and Reboot

Finally, save your changes and reboot the router to apply all the changes:

```bash
reboot
```

### Testing

After rebooting, test each VLAN's connectivity using ping or by connecting devices to different ports. Each VLAN should only be able to communicate within its own VLAN and not with others, as per the firewall rules you set. Remember, you can modify the IP addresses to match your specific network requirements. 

### Note

Always ensure to backup your current configuration before making significant changes. Also, verify which Ethernet ports correspond to which VLANs as they can vary based on the router model. Adjust the `option ports` values accordingly based on your router's switch port mapping.

Update (2024-11-13):
To configure OpenWRT with four virtual networks (VLANs) using the internal switch and applying strict traffic control as you specified, you'll need to modify a few configuration files. Below are the necessary configurations to achieve this setup:

1. **Network Configuration**: First, we'll set up the VLANs in the `/etc/config/network` file.

```shell
config switch
    option name 'switch0'
    option reset '1'
    option enable '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '6t 1'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '6t 2'

config switch_vlan
    option device 'switch0'
    option vlan '3'
    option ports '6t 3'

config switch_vlan
    option device 'switch0'
    option vlan '4'
    option ports '6t 4'
```

This configuration sets up four VLANs on the internal switch, with port 6 being tagged for the CPU (uplink).

2. **Interface Configuration**: Next, we need to create the interfaces for these VLANs. This goes into `/etc/config/network` as well.

```shell
config interface 'vlan1'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option type 'bridge'

config interface 'vlan2'
    option proto 'static'
    option ipaddr '192.168.2.1'
    option netmask '255.255.255.0'
    option type 'bridge'

config interface 'vlan3'
    option proto 'static'
    option ipaddr '192.168.3.1'
    option netmask '255.255.255.0'
    option type 'bridge'

config interface 'vlan4'
    option proto 'static'
    option ipaddr '192.168.4.1'
    option netmask '255.255.255.0'
    option type 'bridge'
```

3. **Firewall Configuration**: Now, we configure the firewall settings using nftables. You need to modify the `/etc/config/firewall` file to restrict traffic accordingly.

```shell
config rule
    option src 'vlan1'
    option dest 'lan'
    option family 'ipv4'
    option target 'DROP'

config rule
    option src 'vlan2'
    option dest 'lan'
    option family 'ipv4'
    option target 'DROP'

config rule
    option src 'vlan3'
    option dest 'lan'
    option family 'ipv4'
    option target 'DROP'

config rule
    option src 'vlan4'
    option dest 'lan'
    option family 'ipv4'
    option target 'DROP'

config rule
    option src 'vlan1'
    option dest 'vlan1'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option src 'vlan2'
    option dest 'vlan2'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option src 'vlan3'
    option dest 'vlan3'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option src 'vlan4'
    option dest 'vlan4'
    option family 'ipv4'
    option target 'ACCEPT'
```

4. **Enable Nftables**: Ensure that nftables is set as the firewall backend in `/etc/config/firewall`.

```shell
config global
    option nfilter '1'
```

5. **Reboot or Restart Services**: After making all these changes, you will need to restart the network and firewall services or reboot the OpenWRT device for the changes to take effect.

```shell
/etc/init.d/network restart
/etc/init.d/firewall restart
```

### Summary:

1. **VLAN configuration** is set for ports with only CPU access on port 6.
2. **Nftables** are configured to allow traffic only between VLAN and their respective interfaces.
3. **Static IPs** are assigned to each VLAN.

Make sure to adjust the IP addresses to fit your network plan. Additionally, ensure the nftables package is installed and enabled on your OpenWRT system, as this is necessary to utilize the firewall rules specified.

Update (2024-11-13):
Certainly! Below is a sample configuration for OpenWRT that sets up 4 VLANs on the 4 ports of the internal switch, with specific traffic restrictions according to your specifications. Additionally, we'll employ `nftables` for the firewall configuration. 

### Step 1: Configure VLANs on the Switch

First, you need to configure your `/etc/config/network` file to set up an internal switch with VLANs.

```sh
config switch 'switch0'
        option name 'switch0'
        option reset '1'
        option enable '1'

config switch_vlan 'vlan1'
        option device 'switch0'
        option vlan '1'
        option ports '0t 1'

config switch_vlan 'vlan2'
        option device 'switch0'
        option vlan '2'
        option ports '0t 2'

config switch_vlan 'vlan3'
        option device 'switch0'
        option vlan '3'
        option ports '0t 3'

config switch_vlan 'vlan4'
        option device 'switch0'
        option vlan '4'
        option ports '0t 4'
```

### Step 2: Configure Network Interfaces

Next, configure the network interfaces in `/etc/config/network` to set up virtual interfaces for each VLAN.

```sh
config interface 'vlan1'
        option ifname 'swp1'
        option proto 'none'

config interface 'vlan2'
        option ifname 'swp2'
        option proto 'none'

config interface 'vlan3'
        option ifname 'swp3'
        option proto 'none'

config interface 'vlan4'
        option ifname 'swp4'
        option proto 'none'
```

### Step 3: Enable CPU Port

Ensure that the CPU port (typically port 6) is configured correctly in the switch, which generally does not require additional configuration as it's already tied to all VLANs.

### Step 4: Nftables Firewall Configuration

Now, configure the firewall rules using `nftables`. Create or edit the file `/etc/nftables.conf`.

```sh
#!/usr/sbin/nft -f

table inet filter {
    chain input {
        type filter hook input priority 0; policy accept;

        # Allow established and related connections
        ip saddr { 0.0.0.0/0 } ct state established,related accept
        # Reject everything else
        reject with icmp type admin-prohibited
    }

    chain forward {
		type filter hook forward priority 0; policy drop;

		# Allow VLAN 1 (port 1)
		ip saddr { 192.168.1.0/24 } ip daddr { 192.168.1.0/24 } accept

		# Allow VLAN 2 (port 2)
		ip saddr { 192.168.2.0/24 } ip daddr { 192.168.2.0/24 } accept

		# Allow VLAN 4 (port 4)
		ip saddr { 192.168.4.0/24 } ip daddr { 192.168.4.0/24 } accept

		# Drop all other traffic
		drop
    }

    chain output {
		type filter hook output priority 0; policy accept;
    }
}
```

### Step 5: Enable Nftables

Ensure that `nftables` starts on boot and apply the rules:

```sh
/etc/init.d/nftables enable
/etc/init.d/nftables restart
```

### Step 6: Verify Configuration

You can verify your configurations by checking the running status of the network and the firewall:

```sh
ip -d link show
nft list ruleset
```

This setup will allow only the desired traffic through the corresponding VLANs while blocking all other traffic as specified. Adapt the IP addresses and subnets according to your actual network design needs.