"Dumb" AP with VLANs

slaw3474 · July 6, 2026, 11:48am

Hello,

I am new to OpenWRT and am having a heck of a time getting VLANs working the way I want. I already have a router and am only configuring OpenWRT on a Unifi AP AC Lite as an access point. My final goal is a configuration like so:

VLAN 99 "Management" 192.168.0.2
VLAN 100 "LAN" <no IP> "SSID1"
VLAN 101 "IOT" <no IP> "SSID2"
VLAN 102 "Guest" <no IP> "SSID3"

I would like to be able to access the web UI via 192.168.0.2 and otherwise just forward traffic from the WiFi networks over the VLANs upstream to the router. (I am not 100% sure on client isolation/switching within VLANs on the AP, but I can come to that problem later.)

I am using DSA and am creating the VLANs in the default bridge. I then created interfaces on each VLAN (and moved the default LAN interface to the proper VLAN as well).

Unfortunately, I haven't been able to connect to the web UI via VLAN 10. (I am testing this with a direct connection to my computer and having its interface join the proper VLAN.) If I leave an IP address configured on the "LAN" interface, I can continue to reach the web UI on that address.

After changing the firewall defaults under "General Settings" all to accept, I was then able to connect via SSH to the "Management" IP, but still no luck with the web UI. (Other than this change, I haven't changed any firewall settings, either for the default LAN interface or the new ones I created.)

I tested with curl and got some weird behavior: on the "LAN" IP, I get a 403 Forbidden followed by the login page HTML. On the "Management" IP, I see the 403 Forbidden response, but then the response hangs indefinitely and no HTML (and actually no further headers) arrive.

I searched for configuring LuCI to "listen" on additional interfaces, but it seems like by default it should be doing that anyway.

(Of course, if I remove the IP address from the "LAN" interface, I cannot connect to LuCI at all.)

Can anyone give me advice on this? I'm certain that I'm missing something simple/obvious, but I've locked myself out and had to do a factory reset so many times that it became time to ask for help.

Thanks!

egc · July 6, 2026, 12:29pm

For the record:

If you post your config the network gurus on this forum can have a look, for that please connect to your OpenWRT device using ssh and copy the output of the following commands and post it here using the "Preformatted text button </>
Remember to redact keys, passwords, MAC addresses and any public IP addresses you may have but do not redact private RFC 1918 IP addresses (192.168.X.X, 10.X.X.X and 172.16-32.X.X) as that is not needed:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

slaw3474 · July 6, 2026, 10:41pm

Thank you for the reference information. I think what I want to do is almost exactly "Multiple networks using VLAN tagging" in the DSA tutorial, so it is odd that I'm having such trouble.

The config I've included below is already in the "broken" state, and it's worse than I remembered. I've only made changes to devices and interfaces (not to the firewall at all), and I can access the device over SSH. However, I cannot access LuCI:

$ ssh root@192.168.1.1
# ...this works as expected...

$ curl -v http://192.168.1.1/cgi-bin/luci
*   Trying 192.168.1.1:80...
* Connected to 192.168.1.1 (192.168.1.1) port 80
> GET /cgi-bin/luci/ HTTP/1.1
> Host: 192.168.1.1
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 403 Forbidden
< Connection: Keep-Alive
< Transfer-Encoding: chunked
# hangs here indefinitely

If I change list ports eth0:t to list ports eth0:u* for the VLAN 100 (and reconfigure my computer's network interface to be untagged), I can connect to LuCI again. I must be missing something here.

ubus call system board:

{
	"kernel": "6.12.94",
	"hostname": "OpenWrt",
	"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
	"model": "Ubiquiti UniFi AC LR",
	"board_name": "ubnt,unifiac-lr",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12.5",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r33051-f5dae5ece4",
		"target": "ath79/generic",
		"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
		"builddate": "1782737960"
	}
}

/etc/config/network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	list ipaddr '127.0.0.1/8'

config globals 'globals'
	option dhcp_default_duid '0004d9fddb1fae7d4086bf47abfa7eed21cf'
	option ula_prefix 'fd1f:59e4:f6ea::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan.100'
	option proto 'static'
	list ipaddr '192.168.1.1/24'
	option ip6assign '60'
	option multipath 'off'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '100'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '101'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '102'
	list ports 'eth0:t'

/etc/config/dhcp:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	list ipaddr '127.0.0.1/8'

config globals 'globals'
	option dhcp_default_duid '0004d9fddb1fae7d4086bf47abfa7eed21cf'
	option ula_prefix 'fd1f:59e4:f6ea::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan.100'
	option proto 'static'
	list ipaddr '192.168.1.1/24'
	option ip6assign '60'
	option multipath 'off'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '100'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '101'
	list ports 'eth0:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '102'
	list ports 'eth0:t'

/etc/config/firewall: completely default

psherman · July 7, 2026, 12:38am

What is the address of your main router?

How is this AP connected to the main router? Is it a direct connection (not counting a PoE injector)? Or is it via a PoE switch? If via a switch, is that switch managed?

slaw3474 · July 8, 2026, 8:59pm

Perhaps my initial question was a bit overbroad. At the moment, with the configuration I shared above, there is no (other) router involved. Only the Unifi AP with OpenWRT directly connected via its one ethernet port to my MacBook (which is configured either with or without VLAN tagging on VLAN 100 and to get an IP from the OpenWRT device via DHCP).

With this config and the Mac on VLAN 100, I can connect via SSH but get that weird cut-off/hanging behavior when accessing the web UI:

config bridge-vlan
	option device 'br-lan'
	option vlan '100'
	list ports 'eth0:t'

With this config (and no other changes), I can access both SSH and the web UI normally:

config bridge-vlan
	option device 'br-lan'
	option vlan '100'
	list ports 'eth0:u*'

So, at this point my main question is: why can't I reach the web UI via a tagged VLAN?

psherman · July 8, 2026, 9:17pm

How have you configured your Mac's network interface? Did you setup the Mac to be VLAN aware on VLAN 100 (this is not hard to do, but requires explicit configuration of VLANs which is slightly hidden if you haven't done it before)?

sync · July 8, 2026, 10:44pm

Welcome to the forum!

Try this and let us know:

#### 1. Global Bridge Layer ####
config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        option vlan_filtering '1'

#### 2. Assign the New VLAN IDs to eth0 ####
config bridge-vlan
        option device 'br-lan'
        option vlan '99'
        list ports 'eth0:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '100'
        list ports 'eth0:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '101'
        list ports 'eth0:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '102'
        list ports 'eth0:t'

#### 3. Bind the Interfaces ####
# Admin Management interface is now on VLAN 99
config interface 'lan'
        option device 'br-lan.99'
        option proto 'static'
        option ipaddr '192.168.0.2'
        option netmask '255.255.255.0'
        option gateway '192.168.0.1'
        list dns '192.168.0.1'

# Virtual placeholders for your other VLANs
config interface 'vlan100'
        option device 'br-lan.100'
        option proto 'none'

config interface 'vlan101'
        option device 'br-lan.101'
        option proto 'none'

config interface 'vlan102'
        option device 'br-lan.102'
        option proto 'none'

Did you try restarting your MACOS?

Also via Terminal: ifconfig -v lan

What is the output? ^

slaw3474 · July 12, 2026, 12:30pm

Thank you all for the help. I ended up doing some tcpdump's on my Mac and on the AP. I could see the packets for the LuCI HTTP response being sent from the AP and some of them not arriving at the Mac on the VLAN interface. I then looked at the parent interface on the Mac...no large packets there either. I reduced the MTU on the VLAN interface on the Mac by 4 bytes and everything works. I'm not sure exactly where the problem lies, but I bet it's an MTU limitation in the USB-C ethernet dongle I'm using to connect to the AP.

(This also explains why SSH mostly worked: smaller packets because I was only sending short commands back and forth.)

Turns out, the OpenWRT configuration was always working perfectly/exactly as I expected!