Config (VLAN) on EX-5601

MisterMeJ · June 27, 2026, 9:36am

Hey guys,

OpenWrt beginner here, so don't be to hard for me
If flashed 3 x T56 and now they are a EX5601-T0 ubootmod edition running on 25.12.4.
Stock wpad is changed to wpad-mbedtls on all 3 T56.

Previously i was running this on 24.XX but made the jump to 25.12.4, while the WIFI VLAN setup was pretty solid on 24.XX i don't experience the same on 25. This setup is already been trough many AI changes that i don't know what to do anymore before jumping back to 24.XX with my old setup and try to make the cabled vlan to work in that setup.

My setup is:
Fiber ISP (Odido) --> Main router (EX5601)
Main router LAN 1 --> AP Garage (EX5601)
Main router LAN 2 --> AP Zolder (EX5601)
Main router LAN 3 --> Server
Main router LAN4 --> TV

What i'm trying to achieve:
Main router handles eveything (Static IP's, Firewall, etc..)
VLAN for main network
VLAN for guests
VLAN for iot
VLAN for cameras (for somewhere in the future)

1 SSID with multiple passwords forwarding to the right VLAN
VLAN filtering on MAIN and on the (dumb) AP's (cabled)
Seamless roaming
Happy wife and kids

Current issues now:
WIFI network not stable, random devices have issues with connecting or getting an IP. Think this will be a AP issue, but not sure.
An OpenWrt 24.xx setup on a 25.xx firmware ?

Main router
network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option packet_steering '1'

config device
        option type '8021q'
        option ifname 'wan'
        option vid '300'
        option name 'wan.300'

config interface 'wan'
        option device 'wan.300'
        option proto 'dhcp'
        option peerdns '0'

config interface 'wan6'
        option device 'wan.300'
        option proto 'dhcpv6'
        option peerdns '0'

config device
        option type 'bridge'
        option name 'br-lan'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan3:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan1:t'
        list ports 'lan2:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '30'
        list ports 'lan1:t'
        list ports 'lan2:t'
        list ports 'lan4:u*'

config interface 'lan'
        option device 'br-lan.10'
        option proto 'static'
        option ipaddr '10.0.10.1'
        option netmask '255.255.255.0'

config interface 'guest'
        option device 'br-lan.20'
        option proto 'static'
        option ipaddr '10.0.20.1'
        option netmask '255.255.255.0'

config interface 'iot'
        option device 'br-lan.30'
        option proto 'static'
        option ipaddr '10.0.30.1'
        option netmask '255.255.255.0'

wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '6'
        option htmode 'HE20'
        option cell_density '0'
        option country 'NL'
        option legacy_rates '1'

config wifi-iface 'ssid_2g'
        option device 'radio0'
        option mode 'ap'
        option ssid 'SSID'
        option network 'lan'
        option encryption 'psk2'
        option ieee80211r '1'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option ieee80211k '1'
        option bss_transition '1'
        option mobility_domain 'AA11'
        option nas_identifier 'meterkast-2g'
        option r1_key_holder '000000000001'
        option ieee80211v '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '36'
        option htmode 'HE80'
        option cell_density '0'
        option country 'NL'

config wifi-iface 'ssid_5g'
        option device 'radio1'
        option mode 'ap'
        option ssid 'SSID'
        option network 'lan'
        option encryption 'psk2'
        option ieee80211r '1'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option ieee80211k '1'
        option bss_transition '1'
        option mobility_domain 'AA11'
        option nas_identifier 'meterkast-5g'
        option r1_key_holder '000000000001'
        option ieee80211v '1'
        option rrm_neighbor_report '1'
        option rrm_beacon_report '1'

config wifi-vlan 'vlan_lan'
        option name 'vl10'
        option network 'lan'
        option vid '10'

config wifi-vlan 'vlan_guest'
        option name 'vl20'
        option network 'guest'
        option vid '20'

config wifi-vlan 'vlan_iot'
        option name 'vl30'
        option network 'iot'
        option vid '30'

config wifi-station 'sta_lan'
        option key 'mainpassword'
        option vid '10'

config wifi-station 'sta_guest'
        option key 'guestpassword'
        option vid '20'

config wifi-station 'sta_iot'
        option key 'iotpassword
        option vid '30'

root@OpenWrt-Meterkast:~#

dhcp (10.0.10.40 is Adguard Home on server (LAN3)

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option noresolv '1'
        list server '10.0.10.40'
        list server '1.1.1.1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '6,10.0.10.40'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '100'
        option leasetime '4h'
        list dhcp_option '6,1.1.1.1,8.8.8.8'

config dhcp 'iot'
        option interface 'iot'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '6,10.0.10.40'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

AP
dnsmasq, odhcpd and firewall are disabled (startup)

network

config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'

config globals 'globals'
option packet_steering '1'

config device
option type 'bridge'
option name 'br-lan'
option vlan_filtering '1'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'

config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'wan:t'
list ports 'lan1:u*'
list ports 'lan2:u*'
list ports 'lan3:u*'
list ports 'lan4:u*'

config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'wan:t'

config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'wan:t'

config interface 'lan'
option device 'br-lan.10'
option proto 'static'
option ipaddr '10.0.10.3'
option netmask '255.255.255.0'
option gateway '10.0.10.1'
option dns '10.0.10.40'

config interface 'guest'
option device 'br-lan.20'
option proto 'none'

config interface 'iot'
option device 'br-lan.30'
option proto 'none'

wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '11'
        option htmode 'HE20'
        option cell_density '0'
        option country 'NL'
        option legacy_rates '1'
        option disabled '1'

config wifi-iface 'ssid_2g'
        option device 'radio0'
        option mode 'ap'
        option ssid 'SSID'
        option network 'lan'
        option encryption 'psk2'
        option ieee80211r '1'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option ieee80211k '1'
        option bss_transition '1'
        option mobility_domain 'AA11'
        option nas_identifier 'garage-2g'
        option r1_key_holder '000000000003'
        option ieee80211v '1'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '120'
        option htmode 'HE80'
        option cell_density '0'
        option country 'NL'
        option disabled '1'

config wifi-iface 'ssid_5g'
        option device 'radio1'
        option mode 'ap'
        option ssid 'SSID'
        option network 'lan'
        option encryption 'psk2'
        option ieee80211r '1'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option ieee80211k '1'
        option bss_transition '1'
        option mobility_domain 'AA11'
        option nas_identifier 'garage-5g'
        option r1_key_holder '000000000003'
        option ieee80211v '1'
        option rrm_neighbor_report '1'
        option rrm_beacon_report '1'
        option disabled '1'

config wifi-vlan 'vlan_lan'
        option name 'vl10'
        option network 'lan'
        option vid '10'

config wifi-vlan 'vlan_guest'
        option name 'vl20'
        option network 'guest'
        option vid '20'

config wifi-vlan 'vlan_iot'
        option name 'vl30'
        option network 'iot'
        option vid '30'

config wifi-station 'sta_lan'
        option key 'mainpassword
        option vid '10'

config wifi-station 'sta_guest'
        option key 'guestpassword'
        option vid '20'

config wifi-station 'sta_iot'
        option key 'iotpassword'
        option vid '30'

dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option authoritative '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'

config dhcp 'lan'
        option interface 'lan'
        option ignore '1'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'guest'
        option interface 'guest'
        option ignore '1'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'iot'
        option interface 'iot'
        option ignore '1'
        option start '100'
        option limit '150'
        option leasetime '12h'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

Any other files/config i forgot to share?

Thanks in advance!

MisterMeJ · June 28, 2026, 1:54pm

forgot to attach firewall
Stripped down so all the individual rules (devices) are not visible:

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option name 'Allow DNS Guest'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow DHCP Guest'
        option src 'guest'
        option dest_port '67'
        option target 'ACCEPT'
        list proto 'udp'

config rule
        option name 'Allow DNS IOT'
        option src 'iot'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow DHCP IOT'
        option src 'iot'
        option dest_port '67'
        option target 'ACCEPT'
        list proto 'udp'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'iot'

config rule
        option name 'IoT Allow LAN To IoT'
        option src 'lan'
        option dest 'iot'
        option target 'ACCEPT'

config rule
        option name 'mDNS Allow'
        option src_port '5353'
        list dest_ip '224.0.0.251'
        option dest_port '5353'
        option target 'ACCEPT'
        option src '*'

config rule
        option name 'IOT Block IOT to IOT'
        option src 'iot'
        option dest 'iot'
        option target 'REJECT'

config redirect
        option name 'Redirect IoT DNS to AdGuard'
        option src 'iot'
        option proto 'tcp udp'
        option src_dport '53'
        option dest 'lan'
        option dest_ip '10.0.10.40'
        option dest_port '53'
        option target 'DNAT'

config redirect
        option name 'Redirect LAN DNS to AdGuard'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '53'
        option dest 'lan'
        option dest_ip '10.0.10.40'
        option dest_port '53'
        option target 'DNAT'
        option enabled '0'

config forwarding
        option src 'iot'
        option dest 'wan'

config forwarding
        option src 'iot'
        option dest 'wan'

LongQT-sea · July 1, 2026, 8:11pm

Add this to wifi-iface section then /etc/init.d/network restart:

list hostapd_bss_options 'vlan_no_bridge=1'