You have been provided, by your ISP, of public ip address, subnet mask and default-gateway, for the wan side ?

Cheers,

jonatha

Hi Ben Pin,

Thanks, I will try out radius server.

Anyway, are you the person who upload lots of video to Youtube regards on various type edge router x setup?

If yes, really love your video and learnt lots from there.

Regards,

Jovan Yeo

Thanks for the feedback.

The actual IP ISP addresses are not listed on the post.  

[
WAN BLOCK
Layer 3 IP info :
Link IP Address
Gateway
Layer 3 IP
Layer 3 subnet mask
;
LAN BLOCK
Usable IP info :
Usable IP Block
Usable IP Ranges
Usable Subnet Mask
;
and DNS info :
Primary DNS
Secondary DNS
].

Hi

I currently have a EdgeSwitch 8XP and an EdgeRouter X.

I have a VLAN interface against switch.020 (vlan20) and switch0 just left as standard set up on the edgerouter.

eth0 on the edgerouter is an uplink to an EdgeSwitch port 1 which has, the following set up.

Native vlan 1

Port 1 - TRUNK

Port 2 - U VLAN1 / E VLAN20

Port 3 - E VLAN1 / U VLAN20

Port 4 - U VLAN1 / E VLAN20

Port 5 - U VLAN1 / E VLAN20

Port 6 - U VLAN1 / E VLAN20

Port 7 - U VLAN1 / E VLAN20

Port 8 - U VLAN1 / E VLAN20

Port 3 has a device connected which should be using VLAN20 only and all other ports are working fine on the native vlan.

This all seems to work fine.

However on the edgerouter x i also want to set the swich0 up to have port 4 to be also VLAN20 only.

Now currently the option on the edgerouter for switch0 is not VLAN aware, but if i enable it what should i put in the PVID and VID for each port?

The trunk port to the edgeswitch (eth0) should that have a blank PVID and VID of 1,20?

and then eth1, eth2 and eth3 as PVID blank and VID as blank?

and then eth4 as PVID 20 and blank VID?

I am unsure of the config i should be using on switch0 of the edgerouter to get this working?

Do you need routing between the native VLAN and the VLAN 20 ?

Cheers,

jonatha

Can you post the config ?

---

 wrote:

---

 wrote:

I was somewhat surprised to see this release today, and was hoping I could use it. Hopefully this feedback can assist .

 

Unfortunately I have to go back to v1.10.8 due to significant performance degradation with all of the 2.0 software versions. I've got a very simple configuration, no complexities. 1Gbps Fibre WAN connection, on eth5. and a /24 LAN on switch0.8.

 

HWNAT is enabled.

 

Running iPerf to an endpoint to a few hops away across the WAN connection.

• v1.10.8 - 914Mbps down, 902 up (maxes out the WAN connection).
• v2.0.0 betas & release - 426Mbps down, 151Mbps up.

 

---

Same issue with the ER12 with edgeos 1.10.8 I am maxing all ports at 945Mbps then install 2.0 firmware all my ports drop down to 600Mbps. This firmware needs more work there is no way this should be a release version.

---

Samething happened to me, pretty much out of the box setup after upgrading an ER12 to 2.0.0 and I noticed a hit to my speeds between 1.10.8 and 2.0.0. I was gonna try to reset to defaults on 2.0.0 to see if that changed anything but didn't do it I just reverted back to 1.10.8 for now and waited to see if anyone else had the same problem.

It appeared to be a lucky shot.

When placing my other phones there only 1 was able to connect.

Turning off the NAT on the masquerade LAN source rule of the EdgeMax where the 3CX server is solved that problem.

But then my external mails are not coming in for some reason...

----------------
Running configuration
----------------
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group ROUTER {
            address 192.168.0.1
            address 172.31.0.1
            description ROUTER
        }
        network-group DMZ {
            description DMZ
            network 172.31.0.0/24
        }
        network-group LAN {
            description LAN
            network 192.168.0.0/24
            network 192.168.1.0/24
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name DMZ_IN {
        default-action accept
        description "DMZ In"
        rule 10 {
            action accept
            description "Allow Ping"
            destination {
                group {
                    network-group LAN
                }
            }
            disable
            log disable
            protocol icmp
            source {
                group {
                    network-group DMZ
                }
            }
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
        rule 20 {
            action accept
            description "Allow Shares"
            destination {
                group {
                    network-group LAN
                }
            }
            disable
            log disable
            protocol tcp
            source {
                group {
                    network-group DMZ
                }
                port 445
            }
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
        rule 30 {
            action accept
            description "Allow Web Server"
            destination {
            }
            disable
            log disable
            protocol tcp
            source {
                group {
                    network-group DMZ
                }
                port 80,443
            }
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
        rule 40 {
            action drop
            description "BLOCK ALL"
            destination {
                group {
                    network-group LAN
                }
            }
            log disable
            protocol all
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
    }
    name DMZ_LOCAL {
        default-action drop
        description "DMZ to Router"
        rule 10 {
            action accept
            description "Allow Pings"
            destination {
                group {
                    address-group ROUTER
                }
            }
            log disable
            protocol icmp
            source {
                group {
                    network-group DMZ
                }
            }
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
        rule 20 {
            action accept
            description "Allow DNS"
            destination {
                group {
                    address-group ROUTER
                }
                port 53
            }
            log disable
            protocol tcp_udp
            source {
                group {
                    network-group DMZ
                }
            }
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
        rule 21 {
            action accept
            description "Allow DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
            source {
                port 68
            }
            state {
                established enable
                invalid enable
                new enable
                related enable
            }
        }
    }
    name DMZ_OUT {
        default-action accept
        description "DMZ Out"
    }
    name WAN_IN {
        default-action drop
        description "WAN to internal"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                related enable
            }
        }
        rule 30 {
            action drop
            description "Drop invalid state"
            log disable
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to router"
        rule 10 {
            action accept
            description "Allow established/related"
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
        rule 30 {
            action accept
            description ike
            destination {
                port 500
            }
            log disable
            protocol udp
        }
        rule 40 {
            action accept
            description esp
            log disable
            protocol esp
        }
        rule 50 {
            action accept
            description nat-t
            destination {
                port 4500
            }
            log disable
            protocol udp
        }
        rule 60 {
            action accept
            description l2tp
            destination {
                port 1701
            }
            ipsec {
                match-ipsec
            }
            log disable
            protocol udp
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        description Uplink
        duplex auto
        speed auto
    }
    ethernet eth1 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth2 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth3 {
        description Local
        duplex auto
        speed auto
    }
    ethernet eth4 {
        address dhcp
        description Internet
        dhcp-options {
            client-option "send dhcp-client-identifier "xxx@xxx|xxx";"
            default-route update
            default-route-distance 210
            name-server update
        }
        duplex auto
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        address 192.168.0.1/24
        description Switch
        mtu 1500
        switch-port {
            interface eth0 {
            }
            interface eth1 {
            }
            interface eth2 {
            }
            interface eth3 {
            }
            vlan-aware disable
        }
        vif 20 {
            address 172.31.0.1/24
            description DMZ
            firewall {
                in {
                    name DMZ_IN
                }
                local {
                    name DMZ_LOCAL
                }
                out {
                    name DMZ_OUT
                }
            }
            mtu 1500
        }
    }
}
port-forward {
    auto-firewall disable
    hairpin-nat disable
    wan-interface eth4
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name LAN {
            authoritative enable
            subnet 192.168.0.0/24 {
                default-router 192.168.0.1
                dns-server 192.168.0.1
                domain-name home.lan
                lease 86400
                start 192.168.0.2 {
                    stop 192.168.0.249
                }
            }
        }
        shared-network-name VLAN20_DMZ {
            authoritative disable
            subnet 172.31.0.0/24 {
                default-router 172.31.0.1
                dns-server 172.31.0.1
                lease 86400
                start 172.31.0.2 {
                    stop 172.31.0.254
                }
            }
        }
        static-arp disable
        use-dnsmasq enable
    }
    dns {
        dynamic {
            interface eth4 {
                service custom-noip {
                    host-name xxx.xxx.xxx
                    login xxx@xxx.xxx
                    password xxxxxxxxx
                    protocol noip
                }
            }
        }
        forwarding {
            cache-size 1000
            listen-on switch0
            options listen-address=192.168.0.1
        }
    }
    gui {
        http-port 80
        https-port 443
        older-ciphers enable
    }
    nat {
        rule 5010 {
            description "masquerade for WAN"
            log disable
            outbound-interface eth4
            protocol all
            source {
                group {
                }
            }
            type masquerade
        }
    }
    ubnt-discover {
        disable
    }
    unms {
        disable
    }
}
system {
    domain-name home.lan
    host-name router
    ip {
        override-hostname-ip 192.168.0.1
    }
    login {
        user xxxxxx {
            authentication {
                encrypted-password xxxxx
            }
            level admin
        }
    }
    name-server 127.0.0.1
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        hwnat enable
        ipsec disable
        ipv4 {
        }
        ipv6 {
        }
    }
    options {
        reboot-on-panic true
    }
    static-host-mapping {
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone Europe/London
    traffic-analysis {
        dpi disable
        export disable
    }
}
vpn {
    ipsec {
        auto-firewall-nat-exclude disable
        ipsec-interfaces {
            interface eth4
        }
    }
    l2tp {
        remote-access {
            authentication {
                local-users {
                    username xxxxxx {
                        password xxxxx
                    }
                }
                mode local
            }
            client-ip-pool {
                start 192.168.1.1
                stop 192.168.1.254
            }
            dhcp-interface eth4
            dns-servers {
                server-1 192.168.0.1
            }
            idle 1800
            ipsec-settings {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret xxxxx
                }
                ike-lifetime 3600
                lifetime 3600
            }
            mtu 1492
        }
    }
}

So I updated to v2.0.0 today on my EdgeRouter Lite (ERLite-3), and run into some issues.

First the router never came online after the update. After almost half an hour it still wasn't responding. I decided to power cycle the unit and 10 minutes later still nothing. I hooked up the console cable and power cycled it again expecting to see an error somewhere, but it booted this time. I rebooted it successfully three times while logging the console output, and then it started having issues again.

I clicked reboot in the web UI, and the serial output in code block no 2 down below happened. As can be seen I tried the reset command but that did not work. Power cycling the unit again however did.

There is some weirdness going on during boot though with services starting and stopping multiple times in a row, as can be seen in code block no 1 below.

The first time I hooked up to the console I got a bunch of SquashFS errors, failing to read blocks and such. That has not happened again.

Is the internal USB flashdrive giving up again? Or are these issues with the upgrade? I had no problems before the upgrade, but that's no guarantee that the flashdrive is good.

At this point it seems to boot fine if I power cycle, but I can't reboot from software.

Code block no 1

[K         Stopping System Logging Service...
[[0;32m  OK  [0m] Stopped System Logging Service.
         Starting System Logging Service...
[[0;32m  OK  [0m] Started System Logging Service.
         Starting Network Time Service...
[[0;32m  OK  [0m] Started Network Time Service.
         Stopping System Logging Service...
[[0;32m  OK  [0m] Stopped System Logging Service.
         Starting System Logging Service...
[[0;32m  OK  [0m] Started System Logging Service.

...


[K[ [0;31m*[0;1;31m*[0m[0;31m*  [0m] A start job is running for UBNT Routing Daemons (1min 50s / no limit)[K         Stopping Network Time Service...
[[0;32m  OK  [0m] Stopped Network Time Service.
         Starting Network Time Service...
[[0;32m  OK  [0m] Started Network Time Service.
         Stopping Network Time Service...
[[0;32m  OK  [0m] Stopped Network Time Service.
         Starting Network Time Service...
[[0;32m  OK  [0m] Started Network Time Service.

...

[K[ [0;31m*[0;1;31m*[0m[0;31m*  [0m] A start job is running for UBNT Routing Daemons (2min 2s / no limit)[K         Stopping System Logging Service...
[[0;32m  OK  [0m] Stopped System Logging Service.
         Starting System Logging Service...
[[0;32m  OK  [0m] Started System Logging Service.
         Starting GUI Telnet Daemon...
[[0;32m  OK  [0m] Started GUI Telnet Daemon.
         Starting Lighttpd Daemon...
[[0;32m  OK  [0m] Started Lighttpd Daemon.
         Starting EdgeOS DHCP Server...
[[0;32m  OK  [0m] Started EdgeOS DHCP Server.
         Starting dnsmasq - A lightweight DHCP and caching DNS server...
[[0;32m  OK  [0m] Started dnsmasq - A lightweight DHCP and caching DNS server.
         Stopping dnsmasq - A lightweight DHCP and caching DNS server...
[[0;32m  OK  [0m] Stopped dnsmasq - A lightweight DHCP and caching DNS server.
         Starting dnsmasq - A lightweight DHCP and caching DNS server...
[[0;32m  OK  [0m] Started dnsmasq - A lightweight DHCP and caching DNS server.
         Starting Simple Network Management Protocol (SNMP) Daemon....
[[0;32m  OK  [0m] Started Simple Network Management Protocol (SNMP) Daemon..

Code block no 2

[[0;32m  OK  [0m] Stopped EdgeOS IMI manager.
         Stopping UBNT daemon...
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/8, error -145
usb 1-1: device descriptor read/8, error -145
usb 1-1: device descriptor read/8, error -145
usb 1-1: device descriptor read/8, error -145
blk_update_request: I/O error, dev sda, sector 1871168
Aborting journal on device sda2-8.
JBD2: Error -5 detected when updating journal superblock for sda2-8.
[[0;32m  OK  [0m] Stopped UBNT daemon.
[[0;32m  OK  [0m] Stopped target Network (Pre).
EXT4-fs error (device sda2): ext4_find_entry:1469: inode #76349: comm scsi_id: reading directory lblock 0
         Stopping Netplug Services...
[[0;32m  OK  [0m] Stopped Netplug Services.
[[0;32m  OK  [0m] Stopped target Basic System.
[[0;32m  OK  [0m] Stopped target Sockets.
[[0;32m  OK  [0m] Closed UUID daemon activation socket.
[[0;32m  OK  [0m] Closed Syslog Socket.
[[0;32m  OK  [0m] Closed Avahi mDNS/DNS-SD Stack Activation Socket.
[[0;32m  OK  [0m] Closed D-Bus System Message Bus Socket.
[[0;32m  OK  [0m] Stopped target Paths.
[[0;32m  OK  [0m] Stopped target Slices.
[[0;32m  OK  [0m] Removed slice User and Session Slice.
[[0;32m  OK  [0m] Stopped target System Initialization.
[[0;32m  OK  [0m] Stopped Apply Kernel Variables.
[[0;32m  OK  [0m] Stopped Load Kernel Modules.
[[0;32m  OK  [0m] Stopped target Encrypted Volumes.
[[0;32m  OK  [0m] Stopped Forward Password Requests to Wall Directory Watch.
[[0;32m  OK  [0m] Stopped Dispatch Password Requests to Console Directory Watch.
[[0;32m  OK  [0m] Stopped target Swap.
         Stopping Load/Save Random Seed...
         Stopping Update UTMP about System Boot/Shutdown...EXT4-fs error (device sda2): ext4_journal_check_start:56: Detected aborted journal

EXT4-fs (sda2): Remounting filesystem read-only
[[0;32m  OK  [0m] Stopped Load/Save Random Seed.
[[0;32m  OK  [0m] Stopped Update UTMP about System Boot/Shutdown.
[[0;32m  OK  [0m] Stopped Create Volatile Files and Directories.
[[0;32m  OK  [0m] Stopped target Local File Systems.
         Unmounting /tmp...
         Unmounting /lib/init/rw...
         Unmounting /root.dev...
         Unmounting /opt/vyatta/config/tmp/n…bdaa5518af24357959b67f45294e5c7...
         Unmounting /run/shm...
[[0;32m  OK  [0m] Stopped Flush Journal to Persistent Storage.
         Unmounting /var/log...
[[0;32m  OK  [0m] Unmounted /tmp.
[[0;32m  OK  [0m] Unmounted /lib/init/rw.
[[0;1;31mFAILED[0m] Failed unmounting /root.dev.
[[0;32m  OK  [0m] Unmounted /opt/vyatta/config/tmp/ne…_2bdaa5518af24357959b67f45294e5c7.
[[0;32m  OK  [0m] Unmounted /run/shm.
[[0;32m  OK  [0m] Unmounted /var/log.
         Unmounting /opt/vyatta/config...
[[0;32m  OK  [0m] Unmounted /opt/vyatta/config.
[[0;32m  OK  [0m] Reached target Unmount All Filesystems.
[[0;32m  OK  [0m] Stopped target Local File Systems (Pre).
[[0;32m  OK  [0m] Stopped Create Static Device Nodes in /dev.
[[0;32m  OK  [0m] Stopped Remount Root and Kernel File Systems.
[[0;32m  OK  [0m] Reached target Shutdown.
watchdog: watchdog0: watchdog did not stop!
EXT4-fs error (device sda2): ext4_remount:4918: Abort forced by user
EXT4-fs error (device sda2): ext4_remount:4918: Abort forced by user
EXT4-fs error (device sda2): ext4_find_entry:1469: inode #76321: comm systemd-shutdow: reading directory lblock 0
EXT4-fs error (device sda2): ext4_remount:4918: Abort forced by user
EXT4-fs error (device sda2): ext4_remount:4918: Abort forced by user
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/64, error -145
usb 1-1: device descriptor read/8, error -145
usb 1-1: device descriptor read/8, error -145
usb 1-1: device descriptor read/8, error -145
usb 1-1: device descriptor read/8, error -145
usb usb1-port1: unable to enumerate USB device
reboot: Restarting system

Looking for valid bootloader image....
Jumping to start of image at address 0xbfc80000


U-Boot 1.1.1 (UBNT Build Version: e102_002_20738) (Oct 26 2018 - 09:19:29)

BIST check passed.
UBNT_E100 r1:2, r2:14, f:4/71, serial #: DC9FDB80354F
MPR 13-00000-00
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
ERROR: Unable to allocate linux reserved memory (addr: 0x100000, size: 0x8000000).
Flash:  4 MB
Net:   octeth0, octeth1, octeth2

USB:   (port 0) scanning bus for devices... #### ERROR: USB control polling timed out!
#### ERROR: Unable to close pipe handle (control): 0

      USB device not responding, giving up (status=80000000)
1 USB Devices found
       scanning bus for storage devices...
No device found. Not initialized?
leds_init 206
 0 
** Partition 1 not valid on device 0 **

** Unable to use usb 0:1 for fatload **
reading 

** Unable to read  
argv[2]: coremask=0x3
argv[3]: root=/dev/sda2
argv[4]: rootdelay=15
argv[5]: rw
argv[6]: rootsqimg=squashfs.img
argv[7]: rootsqwdir=w
argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)
## No elf image at address 0x07d00000
Octeon ubnt_e100# reset


Looking for valid bootloader image....
Jumping to start of image at address 0xbfc80000


U-Boot 1.1.1 (UBNT Build Version: e102_002_20738) (Oct 26 2018 - 09:19:29)

BIST check passed.
UBNT_E100 r1:2, r2:14, f:4/71, serial #: DC9FDB80354F
MPR 13-00000-00
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
ERROR: Unable to allocate linux reserved memory (addr: 0x100000, size: 0x8000000).
Flash:  4 MB
Net:   octeth0, octeth1, octeth2

USB:   (port 0) scanning bus for devices... #### ERROR: USB control polling timed out!
#### ERROR: Unable to close pipe handle (control): 0

      USB device not responding, giving up (status=80000000)
1 USB Devices found
       scanning bus for storage devices...
No device found. Not initialized?
leds_init 206
 0 
** Partition 1 not valid on device 0 **

** Unable to use usb 0:1 for fatload **
reading 

** Unable to read  
argv[2]: coremask=0x3
argv[3]: root=/dev/sda2
argv[4]: rootdelay=15
argv[5]: rw
argv[6]: rootsqimg=squashfs.img
argv[7]: rootsqwdir=w
argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)
## No elf image at address 0x07d00000
Octeon ubnt_e100# reset


Looking for valid bootloader image....
Jumping to start of image at address 0xbfc80000

Currently running ER-L which replaced a SonicWall.  In the past I was able to cast from my device to my FireStick w/o any issues, but recently i've noticed i can't do it natively w/o installing a 3rd party product on the FireStick.  I believe this worked fine until I replaced the SonicWall w/ the ER-L, but it might have stopped working when i took out my ISP router.  This is all on the same vlan so not crossing a L3 boundary of any type (in fact on the same SSID as well, using AC-Lites).  

Is there a setting I'd need to change to get this work work?

Sorry, also realised that WAN is port 4 on edgerouter so VLAN20 should be assigned to port 3.

I think I have it working now.

An extra source rule for

destination port : 5060

destination ip : 192.168.0.52

translation (no masquerade) port :

port : 5060

ip : 192.168.0.52

nat disabled

and putting it in above the LAN (2) and WAN (3) LAN order

 Do you have hardware offload enabled when you run your tests? 

Ok, firstly, make a backup, then, create a temporary management interface, connect to eth1, open an SSH session, and issue

configure
delete interfaces switch switch0 switch-port interface eth1
commit
set interfaces ethernet eth1 address 10.20.20.1/24
commit

Now, set on a laptop a fixed ip address like 10.20.20.2/24, connect to eth1 and again SSH, on 10.20.20.1, and issue

configure
delete interfaces switch switch0 address
commit
set interfaces switch switch0 vif 1 address 192.168.0.1/24
commit
sudo service dhcpd restart
set interfaces switch switch0 switch-port interface eth0 vlan pvid 1
set interfaces switch switch0 switch-port interface eth0 vlan vid 20
set interfaces switch switch0 switch-port interface eth2 vlan pvid 1
set interfaces switch switch0 switch-port interface eth3 vlan pvid 20
set interfaces switch switch0 switch-port vlan-aware enable
commit

Set the laptop to dhcp, and connect to eth2, you should get an ip address in the 192.168.0.0/24 nework, open an SSH session on 192.168.1.1, and issue

configure
delete interfaces ethernet eth1 address
commit
set interfaces switch switch0 switch-port interface eth1 vlan pvid 1
commit
delete service dns forwarding listen-on switch0
set service dns forwarding listen-on switch0.1
set service dns forwarding listen-on switch0.20
commit

In this way, the  VLAN 1 is carried untagged on eth0, and is untagged as well on eth1 and eth2, while the VLAN 20 is carried as tagged on eth0, and native/untagged on eh3.

Test, if ok, issue save.

Cheers,

jonatha