Cant setup VLANS correctly; What am I missing?

Hi All,

At this point, basically long time listener, first time caller.

My desired setup is relatively simple, and I thought I had gathered enough information to implement it, but it continues to elude me.

My desired network setup (simplified) is as shown

Pretty straightforward. I have an ISP router (that will eventually be set to pure bridge mode once I get this all sorted out) and I would like to have 4 vlans/subnets, one each for Lab (MGMT), Home, Guest, and Web facing servers.

I am familiar and comfortable with linux, but I am unfamiliar with router technology and a beginner in OpenWRT, so I prefer to use Luci, but if it takes mucking about with uci to fix this, then please say so.

First off, a note about my router. OpenWRT Docs for it. It actually has 2 real physical network interfaces, eth0 (CPU) and eth1 (dedicated WAN port interface). This breaks from the example hardware used in the docs and other forum posts (single network interface, WAN on eth0.2, LAN on eth0.1, which is one reason why I have struggled to reach this point. I am using the latest OpenWRT (19.07)

Following the docs, and many other forum posts on this topic, I created 4 interfaces, one for each VLAN (eth0.VLAN_ID) with a Static IP (10.0.VLAN_ID.1) and DHCP enabled. I create dedicated firewall zones for each of these interfaces and setup WAN forwarding enabled for each. I then open firewall routes for DHCP and DNS traffic on each interface (Firewall Zone -> Device). I disable DHCP on the LAN interface.

This is the part where I get confused. The default on the router is all switch ports set as untagged VLAN 1. To me, the correct config for my goal would be to tag the CPU (eth0) with all VLANS, and then Port 4 (going to the Lab Switch) as tagged on all VLANs as well. Set Port 1 as untagged VLAN 1 (so that I can manage the router if need be) and setting Port 2 as untagged VLAN 2 for a Home AP and Port 3 as untagged VLAN 3 for a Guest AP.

When do this, I lose access to the router. From my host connected directly on Port 1, I cannot access Luci by static IP, and no DHCP lease is given. If I plugin to ports 2 or 3 directly, I get a DHCP lease successfully, and I still cannot access Luci (No surprise as it is locked to VLAN 1 according to the docs). I have to factory reset or flip the firmwares (bless for dual firmware) and reupload to a clean OpenWRT install to try all over again.

So, what am I missing? I feel there is some critical step absent from this setup which would magically solve all of my problems. I have tried additional things not listing here; the above describes the steps which I am confident are correct. It seems like there is something special about VLAN 1 which is causing these problems. My guess would be conflicting settings somewhere that I am unaware of, which prevents devices on VLAN 1 from working as I hope. Should I just config Port 1 as off and rely on the LAN interface to pick up my traffic?

I tried messing with the LAN interface settings. Removing bridging entirely; explicitly bridging across the eth0.1-4; bridging the eth0 device.

I tried tagging the CPU with all VLANS except VLAN 1. This seems to work, but if the CPU is not being tagged with VLAN 1, then VLAN 1 devices are effectively blocked from interacting with other VLANs' devices (right?)

Sorry for the wall of text, but I am just at my wits end. I have spent weeks reading forum post after forum post. Hours and hours banging my head against the wall for what should be simple! Any help is appreciated.

What you're looking for is possible and basically rather simple as well (there are multiple guest WLAN/ VLAN guides in the wiki, just don't configure the WLAN part if you just want the VLAN for the trunk port of your switch). However your choice of router complicates this slightly, as the current swconfig based drivers behave in a rather odd way and limit your abilities (quite) a bit, see IPQ40xx Switch Config "Strangeness" (swconfig) for details.

This is technically not quite correct, physically there is only a single CPU port - but the swconfig based switch driver presents that as two interfaces.

This is not really a hardware limitation, but an issue with the swconfig config drivers which should disappear once ipq40xx migrates over to the newer DSA switch framework.

1 Like

This is technically not quite correct, physically there is only a single CPU port - but the swconfig based switch driver presents that as two interfaces.

Oh jeez. Just my luck I got a router that is not only one level more confusing than a stock setup, but multiple layers more complex than a standard router. :frowning: I am scrolling through the thread you linked (which is a good read). It seems like the basic answer is "Dont Use Luci" and "Dont Use VLAN 1-2" because the drivers/hardware reserve them. Is that right? Do I need to wait for a patch or upgrade anything?

Esoterically (and please god in laymans terms I am not a networking engineer), what are the benefits of this architecture? Is it just an oddity that the OEM firmware corrects for expecting consumer use?

I see this post in that thread which gives a summary solution


This is a long-standing issue (with the swconfig driver), while a 'fix' for this has been committed in the past, it had to be reverted again due to (serious) performance regressions. While it should be fixed in the future using the DSA drivers, I don't see this happening for the current swconfig based ones (it was tried and failed badly).

You will have to try your luck here, just be aware of the oddities involved and that it is more complex than on most other devices (well, targets).


Thanks so much for your help. I would have NEVER figured this out or thought to look for hardware/low level issues. As a beginner homelabber, I was almost ready to throw in the towel and sell all my gear :sob:

Does anything else about my desired setup seem odd? I think I can manage to work with editing /etc/config/network myself to create the desired VLAN tagging. Should I just buy another router with hardware closer to the examples given in the OpenWRT docs? I bought an Archer C7v5 that I was gonna use as my guest WIFI AP. Given how cheap it was ($50) I bet it does not have complicated hardware/drivers. I havent taken it out of the box because it is not dual-firmware and I was terrified of bricking it.

That one should just work (single CPU port connected to the switch, separating WAN and the LAN ports), for the purpose of setting up VLANs it should be trivial - but your ea8300 (ipq4019) is considerably better / faster hardware (with the afforementioned caveat)…

Personally I'd give the ea8300 one more chance, taking its specialties into account, and in the knowledge that you can still switch to the c7-v5.


  • 4*717 MHz ARMv7 (cortex a7)
  • 256 MB flash
  • 256 MB RAM
  • 802.11ac/ wave2, tri-radio

archer c7 v5:

  • 1*750 MHz MIPS 74Kc
  • 16 MB flash
  • 128 MB RAM
  • 802.11ac/ wave1, dual-radio
1 Like

I was torn about this as well while suffering through attempt after attempt. It is a nice router I got from a family member for free (who didnt know what it was but knew I was into tech stuff) and I was elated to get such a $$$ router right as I was about to begin homelabbing. I will take all the knowledge in this thread and apply it tomorrow and update the thread solution accordingly.

The C7 was literally the cheapest router I could find at micro center that was also on the Table of Hardware.

Thanks so much!

When I first started use VLAN at first I made the mistake to set one LAN port on VLAN 1 to trunk mode in LuCi. It worked fine.
And then after a while I changed my mind and set it to not trunk mode again which resulted in a continous loop error when save and apply in LuCi and all hell broke lose.
Then I had to reset my router to be able to connect to it again and start all over.

Do you know is progress going good for DSA on IPQ4028? Can we expect this on OpenWRT 21.02 release, or we should have more patience?

Non working VLAN on WAN means I can't use clean OpenWRT, and I must stick to GL.iNet firmware which isn't good :confused:

21.02 will ship with swconfig drivers.

2 Likes there an ETA on 21.02 (or 21.03?)

Thanks again to @slh for all of his help in clarifying this issue.

For anyone who stumbles across this issue with this router until it is patched, I am copying the important bits here.

  1. Dont use VLAN 1 or 2
    Apparently there is some weirdness with the IPQ40xx hardware using those under the hood, and it confuses the router if you also try to use them. I was gonna use VLAN ID 1, 2, 3, 4; so I just changed to 10, 20, 30, 40.

  2. Dont use Luci to configure VLANS.
    You will have to directly SSH into the router and edit /etc/config/network directly. Add the following snippet for each VLAN you would like to create.

vim /etc/config/network
# file opens
# move the cursor to a blank space
# type in the config
# maybe cat /etc/config/network to test

The config

config switch_vlan
	option device 'switch0'
	option vlan 'VLAN_ID'
	option ports '0t 2 4t'

To apply these changes,

system network reload

The option ports line in the config will probably vary the most. You must have 0t so that the CPU interface can process these VLAN tracked packets. If you want to have a untagged port, then list the port number without the t. So in my example, I am tagging the CPU, adding port 2 as an untagged member (for management of the router), and tagging port 4 which trunks to my VLAN aware switch. To be extra positive that this works, I set the PVID of port 2 with this snipper

config switch_port
	option device 'switch0'
	option port '2'
	option pvid 'VLAN_ID'

Beyond that, setting up virtual interfaces can be done through Luci as normal, and as this process is well documented elsewhere, I will not do so in depth here. In short,

  1. Create new interface
  • Static address (Ex. 10.0.VLAN_ID.1)
  • New Firewall Zone (for true segmentation/no crosstalk)
  • Enable DHCP
  1. Set forwarding to WAN allowed for the new interface for internet access
  2. Setup firewall allow traffic rules for DHCP and DNS for each virtual interface
  • DNS: TCP/UDP, from Interface zone, into Device, port 53
  • DHCP: UDP, from Interface zone, into Device, port 67-68

Additionally, to setup access from the VLANs other than 1, enable "input" from that firewall zone. This is my resultant setup.

Firewall Zones




Are you willing to try to compile your own firmware ?
I did so for my fritzbox 4040 (ipq4018) and I can use VLAN 1,2,3,... on any port even when using Luci.
Start reading here please:


I tried to set VLAN like this, but this didn't worked.

Do you know what I did wrong?

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.