Best way to have separate guest network [SOLVED]

Hi everyone,

I have an Raspberry pi 4 with Openwrt, which acts as a main router, then I have an unmanaged switch and 2 access points for wifi (Xiaomi Mi 4AC).
What's the best way to get separate guest network on the access points? They're configured as dumb ap's.
I've been trying to create vlans but it breaks every time :frowning:

IMO, the best way to setup a guest network is using the main router... so you'll do the main setup here.

This may be an issue with how you're doing your configuration, or it could be related to...

You really need to be using a managed switch if you're going to be using VLANs. Hint: if you have a spare router with a built-in switch that can run OpenWrt, you can actually use the device as a managed switch

Assuming a few things:

  • you set up the main router with VLANs for the guest network
  • replace your switch with a managed one
  • the 4AC's are running OpenWrt

from there, you'll just setup a VLAN, bridge, and netowrk interface (with proto 'none'/unmanaged) and finally link it to a guest SSID.

If any of the assumptions above is not valid or not an option, you'll have to look at other ways.

1 Like

I don't have a managed switch, will it be possible to have vlans with dsa and tags with the unmanaged switch?

DSA, yes... unmanaged switch, no*

Unmanged switches are not designed for use with VLANs. As such, the behavior of tagged ethernet frames (802.1q VLANs) is not defined. In some cases it may work just fine, and in other cases it could cause serious network issues.

So, yes, you could try it... but I would highly recommend that you pick up a managed switch for this purpose -- they can be relatively inexpensive for the 5 or 8 port lower end devices.

1 Like

Thank you so much for your help :slight_smile:

You're welcome.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.