Dumb AP Guest Wifi subnet no IP

Kyouma · November 30, 2025, 2:38pm

New to OpenWRT

I have a network setup like so:
Modem -> PFSense (192.168.1.3) -> OpenWRT Dumb AP (192.168.1.10, via lan1 port)
Been working fine for months
PFsense is the DHCP and DNS server

But tried to setup Guest wifi on new subnet (x.x.2.0/24) on the 2.4ghz radio following this guide:

No luck

Read dozens of forum threads on here and on Reddit, made some changes, but still cannot get an IP address

configs as below:

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.86",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Netgear Nighthawk X4S R7800",
        "board_name": "netgear,r7800",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "ipq806x/generic",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
				
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd37:3aa1:baa3::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.10'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.1.3'
        list dns '192.168.1.1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'guest'
        option proto 'static'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option device 'br-guest'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'
		
root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '5g'
        option channel '120'
        option htmode 'VHT80'
        option country 'GB'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt 5G'
        option encryption 'sae'
        option key 'password1'
        option ocv '0'
        option wpa_disable_eapol_key_retries '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option band '2g'
        option channel '1'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'guest'
        option mode 'ap'
        option ssid 'OpenWrt 2.4G'
        option encryption 'psk2'
        option key 'password2'
        option wpa_disable_eapol_key_retries '1'
        option isolate '1'
		
root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        list interface 'guest'
        list notinterface 'lan'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
		
root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config rule
        option src 'wan'
        option name 'Allow-guest-DNS'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option src 'wan'
        option name 'Allow-guest-DHCP'
        list proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option src 'guest'
        option dest '*'
        option name 'Block-guest-Local'
        list proto 'all'
        list dest_ip '192.168.1.0/24'
        option target 'DROP'

config forwarding
        option src 'guest'
        option dest 'lan'

Not sure what I am doing wrong?

I have tried:
-Using an empty bridge (still in config)
-Firewall 'guest' -> 'wan' (internet is in via lan1 port, WAN port is empty)
-rebooting after every config change
-Restoring a prev good config and starting again
-Not using a 'Block guest from lan rule'

Thank you for any help

egc · November 30, 2025, 3:03pm

Use this guide:

Furthermore consider upgrading to 24.10.4

ncompact · November 30, 2025, 3:12pm

The best solution is to manage the Guest network entirely from pfSense.
Since you need VLANs anyway, it’s recommended to create two VLANs:

one VLAN for your main LAN
one VLAN for the Guest network

This keeps both networks fully separated and ensures that pfSense can properly handle routing, firewalling, and DHCP.

Practical example on pfSense (based on your setup)

Assuming the connection between pfSense and OpenWRT runs over the pfSense LAN interface:

1. On pfSense

Create VLAN 10 for your main LAN
- Subnet: 192.168.1.0/24
- DHCP Server enabled
Create VLAN 20 for the Guest network
- Subnet: 192.168.2.0/24
- DHCP Server enabled

Assign both VLANs to the same physical interface (e.g., igb1 or em1, depending on your hardware).

Then configure firewall rules:

VLAN 10 → normal LAN access
VLAN 20 → Internet-only access, no access to VLAN 10

2. On OpenWRT (as a Dumb AP)

Tag the LAN port connected to pfSense with both VLAN 10 and VLAN 20
Assign the main WiFi SSID to VLAN 10
Assign the Guest WiFi SSID to VLAN 20
Do not enable DHCP on OpenWRT
No firewall rules needed on OpenWRT

Result

pfSense handles everything (routing, DHCP, firewall).
OpenWRT acts as a simple access point that carries the VLANs to Wi-Fi.
This ensures the Guest network receives IPs correctly from pfSense and remains isolated from the main LAN.

ncompact · November 30, 2025, 3:18pm

a reference video:

ncompact · November 30, 2025, 3:21pm

Once the vlans have been created on pfsense they will also have to be applied to the dump-ap:

an example on a dump-ac (Openwrt) with a trunk port that allows the passage of the defined vlans towards the main router ( Obviously the main router can be either pfsense or an Openwrt router with the vlans defined.) :