Bridge Access Point with VLAN Tagging

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello, how can I set up a bridge access point with VLAN tagging? It's connected to my main router and properly configured. I tried creating an unmanaged interface with lan1.100 and checked it by setting it to DHCP, and that seemed to work. However, when I try to configure a wireless network, I can't connect.

2

The process very much depends on the specifics of your device, but it sounds like you may have a DSA based device, so you'll use the bridge-vlan approach.

When you create the associated network interface for the secondary network(s), you'll use unmanaged network interfaces for this purpose and then you'll link the SSID to that interface. Only the interface that is used to manage the AP should have an address (and it should be on a trusted network).

If you want specific guidance, let's see the config details:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Screenshot 2025-10-20 at 8.14.14 PM

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
3

The device has DSA, but I got a bit stumped trying to follow the Bridge AP wiki since there’s no guide for VLANs. I set everything up just like you mentioned, but I still can’t connect to the Wi-Fi. I already tested the VLAN itself, and its working fine.

{
        "kernel": "6.6.110",
        "system": "ARMv8 Processor rev 4",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.4",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.4",
        }
}



config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix '-'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        option vlan_filtering '1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.100.1'
        list dns '192.168.100.1'

config interface 'guest'
        option proto 'none'
        option device 'eth1.100'
        option type 'bridge'
4

The way you have it structured won't work.... but with some edits, it will:

Start by adding bridge-VLANs (here we assume port lan1 carries both networks, VLAN 1 untagged+PVID, VLAN 100 tagged):

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:u*'
        list ports 'lan2:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '100'
        list ports 'lan1:t'

Now, edit the lan network interface to use br-lan.1:

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.100.1'
        list dns '192.168.100.1'

And edit the guest interface to use br-lan.100 and also remove the bridge line:

config interface 'guest'
        option proto 'none'
        option device 'br-lan.100'

Reboot and it should work.

2 Likes
5

Thanks, that does the trick!

6

Glad it's working now.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile: