There are other ways to approach it, but yes, this is the most efficient and easiest method, and it is the preferred technique because it will make management of your network much easier.
Although this is not a hard requirement, typically the AP (i.e. the second router) will have an address only on the network that is used to manage the device, and the other network will be 'unmanaged' -- basically transparently passing through. The address that the device holds on the management network will be the one you use for administration (ssh or LuCI web interface). All devices on the management network will be able to reach the AP (be it via wifi or ethernet), and it is your choice if the devices on the other network can reach it or not (this will be controlled by the firewall in the main router).
It's not that it is impossible, but rather that it is not an optimal topology. In most cases, it's best for the main router to do the routing for the whole network.
Ok... let's start with the main router.
We'll begin in the network config file, and we're going to (temporarily) take one port from the main lan and assign it to the secondary network. The purpose here is to be able to verify the functionality... you can always reassign it once that's done.
To do this, we'll add bridge-VLANs:
config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
config bridge-vlan
option device 'br-lan'
option vlan '254'
list ports 'lan1:t'
list ports 'lan4:u*'
Next, edit the lan to use the device br-lan.2:
config interface 'lan'
option device 'br-lan.2'
option proto 'static'
option ipaddr '192.168.2.1'
option netmask '255.255.255.0'
option delegate '0'
add the network interface for the secondary network:
config interface 'lan254'
option device 'br-lan.254'
option proto 'static'
option ipaddr '192.168.254.1'
option netmask '255.255.255.0'
option delegate '0'
Next, in /etc/config/dhcp:
remove the lines marked with -:
I recommend changing the dhcp lease time to something more sensible -- 12h is the default:
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
Now add a DHCP server for the new network:
config dhcp 'lan254'
option interface 'lan254'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
The firewall comes next. This will allow access for the new network (192.168.254.0/24) to reach the router itself as well as the internet, and the original network (192.168.2.0/24), but the original network won't be able to reach the new network (this replicates your current configuration's permissions; all of this can be adjusted, but we'll start here). Add this:
config zone
option name 'lan254'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option family 'ipv4'
list network 'lan254'
config forwarding
option src 'lan254'
option dest 'wan'
config forwarding
option src 'lan254'
option dest 'lan'
You can now restart the main router. Plug in a computer into any of ports lan1-lan3 and you should get an address on the 192.168.2.0/24 network. Then plug that computer into port lan4 and you'll get an address in 192.168.254.0/24. Assuming that's working, you can move on to the AP.
- Reset the AP to defaults.
- Delete the wan and wan6 interfaces
- Edit
br-lan so it looks like this (adding the wan port):
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'
- Create bridge-VLANs (replicating the config you have now, lan1 will be the 192.168.2.0/24 network, lan2-4 will be 192.168.254.0/24):
config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'lan1:u*'
list ports 'wan:u*'
config bridge-vlan
option device 'br-lan'
option vlan '254'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u'
list ports 'wan:t'
- Edit the lan interface to look like this:
config interface 'lan'
option device 'br-lan.2'
option proto 'static'
option ipaddr '192.168.2.2'
option netmask '255.255.255.0'
- And create a new unmanaged interface like this:
config interface 'lan254'
option device 'br-lan.254'
option proto 'none'
- In the AP's
/etc/config/dhcp file, disable the dhcp server. It'll look like this:
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ignore '1'
- Reboot this device and plug in an ethernet cable between the wan port on the AP and port lan1 on the main router. This device should now have port lan1 as 192.168.2.0/24 and ports lan2-4 as 192.168.254.0/24.
- You can now setup your wifi SSID's against
lan and lan254 respectively.
Assuming that all is working, from here, we can make any changes that you want to the port allocations and allowances/restrictions for inter-network routing/firewall.
If anything doesn't work, post the complete configs for review.
