DSA - Multiple Bridges vs Multiple VLANs on a single bridge

I recently bumped into the excellent DSA tutorial in Openwrt's documentation here: https://openwrt.org/docs/guide-user/network/dsa/dsa-mini-tutorial

I have been using DSA for a while now with no issues whatsoever, and I am using two different subnets:

  • One trusted zone for my known secure devices
  • One untrusted zone for IOT devices, TVs, and a server. Devices within that network cannot communicate with each other, and cannot connect to devices in the trusted zone either. They can ONLY connect to the internet.

I have it setup as per the "Multiple bridged networks" configuration (one bridge for each zone), but from what I understand I can set it up via the "Multiple networks using VLANs" configuration as well. Now my question is: What are the differences? In terms of functionality, performance or anything I might be forgetting?

I know it's a bit of a strange question, since everything works just fine in its current configuration. But I am always interested in learning more. So if multiple solutions can be used, I am very much interested to see exactly what the differences are. Thank you very much in advance :slight_smile:

1 Like

Is there anyone that has experience with both setups?

"Multiple bridged networks" can pass through VLAN-tagged frames as is (VLAN filtering is disabled), while "Multiple VLANs on a single bridge" cannot.

I've actually decided to go the multiple bridges way with DSA on mvebu/WRT1200AC though failed badly.. spent 4 hours troubleshooting why the second bridge is not bringing up its interfaces, to find there is a bug in 21.02 with DSA causing mutliple bridges apparently don't work yet with DSA as documented.

You can read more also here [Solved] DSA Multiple Networks on 21.02 not bridging to lan ports

1 Like

I have also submitted a bug report for this issue, so that it gets some visibility https://bugs.openwrt.org/index.php?do=details&task_id=4171

1 Like

I have the same problem decribed here DSA with two VLAN on one Network. I thought I just do it wrong but it seems as if I'm not the only one with this problem.

On 19.07.8 I created an interface (DMZ) where I could easily add multiple VLANs to the interface (which itself created a bridge).
I installed kmod-br-netfilter to separate the bridge ports on the bridge (so they could not talk to each other, which is what I wanted)
I added some traffic rules so that the pi-hole on one port/VALN was accessible on port 53, the reverse proxy on 80 and 443, the mail server on 25, 587.
As the bridge with kmod-br-netfilter did not allow direct connection, only the desired ports have been accessible even for the other devices in the same network / interface.

Now in 21.02 I did not get something like this working. :frowning: