Configure a bridged AP with VLANs (via router)

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

I’m looking for some help setting up a new WAP, running OpenWRT, on my network.

Local network is as follows:

WAN ¬
++ pfSense (DHCP, VLANs)
++ Managed Switch
++ WAPs

The AP is an Zyxel NWA50AX Pro. I have flashed with OpenWRT, and then set up exactly as this guide: https://openwrt.org/docs/guide-user/network/wifi/wifiextenders/bridgedap.

As above, I want pfSense to do all routing etc. I have some existing APs on the network (long term) and everything should be set up correctly here.

I have tried to set up the sub-interfaces, bridges and wireless SSIDs on the Zyxel as per various guides on the forum but I’m not getting issued with an IP. I think I’ve just confused myself on which interface to use (eth0, br-lan, lan)..

I will post my configs in the correct format but first I have a question over which release I should be on. The hardware guides suggests the supported release is 24.10.5, and this is what I have flashed. Is this correct or should I upgrade to 25.12, before supplying configs?

Thanks in advance

2

Yes, please upgrade to the latest stable release (currently 25.12.4) so that you're starting at a fully supported and current version.

Because your device has just a single ethernet port (and no built-in switch), you can create new bridges with eth0.x dotted notation and then unmanged interfaces.

For example:

config device
        option name 'br-guest'
        option type 'bridge'
        list ports 'eth0.5'

config interface 'guest'
        option device 'br-guest'
        option proto 'none'
3

Thank you. I'll upgrade in the next few days, configure as per your instructions and post back with the results.

4

I have now upgraded the devices to 25.12.4.

I have adjusted the interfaces to eth0.# but it's still not connecting.

Looking at the network config, I'd assume there are unnecessary sections listed but I’m hoping you’ll be able to advise better. As said previously, I originally set this up using the bridged-AP guide.

Here are the configs:

cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'xxx::/48'
        option packet_steering '1'
        option dhcp_default_duid 'xxx'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.10.2'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option broadcast '192.168.10.255'
        option gateway '192.168.10.1'
        list dns '192.168.10.1'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '20'
        option name 'eth0.20'

config interface 'vlan20'
        option proto 'none'
        option device 'eth0.20'
        option multipath 'off'
        option type 'bridge'

cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option country 'GB'
        option cell_density '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '36'
        option htmode 'HE80'
        option country 'GB'
        option cell_density '0'

config wifi-iface 'wifinet0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'xxx'
        option encryption 'psk2'
        option key 'xxx'
        option network 'vlan20'

config wifi-iface 'wifinet1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'xxx'
        option encryption 'psk2'
        option key 'xxx'
        option network 'vlan20'

cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'
5

You did not follow my advice....

To fix your current config, delete this:

Add this:

config device
        option name 'br-vlan20'
        option type 'bridge'
        list ports 'eth0.20'

Edit the vlan20 interface to look like this:

config interface 'vlan20'
        option proto 'none'
        option device 'br-vlan20'

Then reboot and test again.

6

You are a legend. Thank you for your patience and knowledge.

I've only tested with one vlan and device but all appears well.

Thank you again.