Extend Guest and IoT networks to Dumb AP with two OpenWrt One devices

net_user_dhr3 · March 29, 2025, 8:45pm

After changing the ports on my OpenWrt One Dumb AP to have 2 LAN ports as discussed in OpenWrt One using eth0 WAN as LAN
I have also cleaned up the config files in the CLI as, correctly mentioned by @ pavelgl, they were a mess. I started setting up in the Luci interface resulting in quite a messy file. Hopefully they should be a bit better now.

I am still learning (sorry for my ignorance) and my next step is having some issues with extending the Guest and IoT networks from the main unit to the Dumb AP.

The setup is:

Main unit: OpenWrt One
- Unmanaged switch in the middle
Second Dumb AP in an other area of the house: OpenWrt One

I have configured the networks to be:

Private network on VLAN 76 (ipaddr '192.168.7.1')
Guest VLAN 12 (ipaddr '192.168.3.1/24')
Iot VLAN 6 (ipaddr '192.168.6.1/24')

For the main VLAN (76), everything seems to be working well. I can move through the house and the devices are switching in between the 2 units correctly and staying in the same subnet.

However for the Guest and Iot networks, I am having issues when I connect via the Dumb AP, I get an IP on a wrong subnet (169.254.121.x) and of course no connection.

I am listing below the 2 network config files:

Main unit
Dumb AP

Main Unit:


config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd1c:d3da:921c::/48'
        option packet_steering '1'

# Wan interface
config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option peerdns '0'
        list dns '2606:4700:4700::1111'
        list dns '2606:4700:4700::1001'

# Private
config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'

config interface 'lan'
        option device 'br-lan.76'
        option proto 'static'
        option ipaddr '192.168.7.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config bridge-vlan
        option device 'br-lan'
        option vlan '76'
        list ports 'eth1'

## Guest
 config device 'guest_dev'
        option name 'br-guest'
        option type 'bridge'

config interface 'guest'
        option device 'br-guest.12'
        option proto 'static'
        list ipaddr '192.168.3.1/24'

config bridge-vlan
        option device 'br-guest'
        option vlan '12'

# Iot
config device 'iot_dev'
        option name 'br-iot'
        option type 'bridge'

config interface 'iot'
        option device 'br-iot.6'
        option proto 'static'
        list ipaddr '192.168.6.1/24'

config bridge-vlan
        option device 'br-iot'
        option vlan '6'

Dumb AP:

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd73:6c5b:50b4::/48'
        option packet_steering '1'

# Private
config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        list ports 'eth1'

config interface 'lan'
        option device 'br-lan.76'
        option proto 'dhcp'

config bridge-vlan
        option device 'br-lan'
        option vlan '76'
        list ports 'eth0'
        list ports 'eth1'

# Guest
config device 'guest_dev'
        option name 'br-guest'
        option type 'bridge'
        list ports 'br-guest.12'

config bridge-vlan
        option device 'br-guest'
        option vlan '12'

config interface 'guest'
        option proto 'dhcp'
        option device 'br-guest.12'

# Iot
config device 'iot_dev'
        option name 'br-iot'
        option type 'bridge'

config bridge-vlan
        option device 'br-iot'
        option vlan '6'

config interface 'iot'
        option device 'br-iot.6'
        option porto 'dhcp'

I must be clearly missing something but after being stuck on this for quite a bit I am asking for help.

And as I am still in the learning process, if you see non optimum points int e files feel free to comment. And if you need additional config files, let me know.

slh · March 30, 2025, 12:36am

VLANs and unmanaged switches are a no-go. Either you need to remove the switch out of the equation (e.g. via a direct cable link between your router and the AP) or you need to replace the unmanaged switch with a managed one. Unmanaged switches can only be used as long as they never get exposed to tagged packets (so single, untagged, network, as a leaf switch carrying only a single network).

pavelgl · March 30, 2025, 1:01pm

The unmanaged switch may pass or drop the larger tagged frames, you will check this after fixing the configuration.

There is no wired port defined for VLANs 6 and 12.

Move to a single bridge device (br-lan), set tagged VLANs 6 and 12 on eth1 using bridge vlan filtering and configure the interfaces defining br-lan.X as device.

Main router:

...

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'

config bridge-vlan
        option device 'br-lan'
        option vlan '76'
        list ports 'eth1'

config bridge-vlan
        option device 'br-lan'
        option vlan '12'
        list ports 'eth1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '6'
        list ports 'eth1:t'

config interface 'lan'
        option device 'br-lan.76'
        option proto 'static'
        list ipaddr '192.168.7.1/24'
        
config interface 'guest'
        option device 'br-lan.12'
        option proto 'static'
        list ipaddr '192.168.3.1/24'

config interface 'iot'
        option device 'br-lan.6'
        option proto 'static'
        list ipaddr '192.168.6.1/24'

AP (assuming eth1 is used as an uplink to the router)

...
config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        list ports 'eth1'

config bridge-vlan
        option device 'br-lan'
        option vlan '76'
        list ports 'eth0'
        list ports 'eth1'

config bridge-vlan
        option device 'br-lan'
        option vlan '12'
        list ports 'eth1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '6'
        list ports 'eth1:t'

config interface 'lan'
        option device 'br-lan.76'
        option proto 'dhcp'

config interface 'guest'
        option proto 'dhcp'
        option device 'br-lan.12'
	    option metric '10'

config interface 'iot'
        option device 'br-lan.6'
        option porto 'dhcp'
	    option metric '20'

When the AP's guest and iot interfaces get IP addresses from the main router (meaning tagged VLANs are working), you can switch their protocol to unmanaged/none.

net_user_dhr3 · March 31, 2025, 7:13pm

@slh thanks. An other of my misconception. I though (wrongly) that an unmanaged switch would just forward everything and that a managed switch could just sort the data further down the line. However, the good news is that I had already planned to replace this unmanaged switch with a larger managed model. It is in the post but hasn't arrived yet.

@pavelgl Thanks again for your fantastic help. It looks so much cleaner now. I have updated both device with above config and so far everything seems to be working perfectly fine. And in a day or two I will retire the unmanaged switch and replace it with the new one.

net_user_dhr3 · April 3, 2025, 6:24pm

I have received the managed switch. I will document below the next steps I did in case it can be useful for others:

I chose a TP Link TL-SG1016DE There is a a good video description of the managed switch on YouTube.

Here is an example of the switch's config, in this case port n°3 assigned to the Guest network and port 1 being connected to the OpenWrt:

Now everything seems to be working fine. All the devices connected to the VLAN from the switch are on the right subnet with the right IP address. I also created an extra VLAN for the media equipment (TV&Co). They all connect correctly (excepted one).

The Panasonic TV that doesn't seem to like the config (but it works for the other devices TV box Apple TV Nintendo Switch).

The Panasonic TV, connected to the managed switch via Ethernet on VLAN 22 (Media).

...
config bridge-vlan
        option device 'br-lan'
        option vlan '22'
        list ports 'eth1:t'
 ...
config interface 'media'
        option device 'br-lan.22'
        option proto 'static'
        list ipaddr '192.168.22.1/24'
...

While all devices connect fine on this VLAN, the TV message is saying:

"A Home network is available but the connection to the internet is not possible The Gateway did not respond"
And I can see the icons connected to the router but not to the internet. When I check the network settings of the TV I have:

- IP address: 192.168.22.155 
- Subnet mask: 255.255.255.0 
- Default Gateway: 192.168.22.1 
- DNS Address: 192.168.22.1 
- Proxy address:
- Proxy Port:

Any idea if I am missing something in my config that may affect this device?

mattimat · April 3, 2025, 6:45pm

Does the TV understand tagged ethernet packet ? I guess you might try
list ports 'eth1:u*'

psherman · April 3, 2025, 7:38pm

I don't think that the TV is directly connected to the router. It is almost certainly connected to the switch. Therefore, the OP doesn't need to change how eth1 is currently configured.

@net_user_dhr3 - Let's take a look at the complete config:

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

net_user_dhr3 · April 3, 2025, 7:50pm

Here is the output of:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall

ubus call system board:

root@OpenWrt-One-Master:~# ubus call system board
{
	"kernel": "6.6.83",
	"hostname": "OpenWrt-One-Master",
	"system": "ARMv8 Processor rev 4",
	"model": "OpenWrt One",
	"board_name": "openwrt,one",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "SNAPSHOT",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r29064-696ad7b1aa",
		"target": "mediatek/filogic",
		"description": "OpenWrt SNAPSHOT r29064-696ad7b1aa",
		"builddate": "1742557240"
	}
}
root@OpenWrt-One-Master:~#

Network:

root@OpenWrt-One-Master:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd1c:d3da:921c::/48'
        option packet_steering '1'

# Wan interface
config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option peerdns '0'
        list dns '2606:4700:4700::1111'
        list dns '2606:4700:4700::1001'

# Lan
config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'

config bridge-vlan
        option device 'br-lan'
        option vlan '76'
        list ports 'eth1'

config bridge-vlan
        option device 'br-lan'
        option vlan '12'
        list ports 'eth1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '6'
        list ports 'eth1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '22'
        list ports 'eth1:t'

config interface 'lan'
        option device 'br-lan.76'
        option proto 'static'
        list ipaddr '192.168.7.1/24'

config interface 'guest'
        option device 'br-lan.12'
        option proto 'static'
        list ipaddr '192.168.3.1/24'

config interface 'iot'
        option device 'br-lan.6'
        option proto 'static'
        list ipaddr '192.168.6.1/24'

config interface 'media'
        option device 'br-lan.22'
        option proto 'static'
        list ipaddr '192.168.22.1/24'

DHCP:

root@OpenWrt-One-Master:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	list dhcp_option '6,1.1.1.1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '1h'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '1h'

Firewall:


root@OpenWrt-One-Master:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone 'guest'
	option name 'guest'
	option network 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding 'guest_wan'
	option src 'guest'
	option dest 'wan'

config rule 'guest_dns'
	option name 'Allow-DNS-Guest'
	option src 'guest'
	option dest_port '53'
	option proto 'tcp udp'
	option target 'ACCEPT'

config rule 'guest_dhcp'
	option name 'Allow-DHCP-Guest'
	option src 'guest'
	option dest_port '67'
	option proto 'udp'
	option family 'ipv4'
	option target 'ACCEPT'

config zone 'iot'
	option name 'iot'
	option network 'iot'
	option input 'REJECT'
	option output 'REJECT'
	option forward 'REJECT'

config forwarding 'iot_wan'
	option src 'iot'
	option dest 'wan'

config rule 'iot_dns'
	option name 'Allow-DNS-iot'
	option src 'iot'
	option dest_port '53'
	option proto 'tcp udp'
	option target 'ACCEPT'

config rule 'iot_dhcp'
	option name 'Allow-DHCP-iot'
	option src 'iot'
	option dest_port '67'
	option proto 'udp'
	option family 'ipv4'
	option target 'ACCEPT'

config zone 'media'
	option name 'media'
	option network 'media'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding 'media_wan'
	option src 'media'
	option dest 'wan'

config rule 'media_dns'
	option name 'Allow-DNS-Media'
	option src 'media'
	option dest_port '53'
	option proto 'tcp udp'
	option target 'ACCEPT'

config rule 'media_dhcp'
	option name 'Allow-DHCP-Media'
	option src 'media'
	option dest_port '67'
	option proto 'udp'
	option family 'ipv4'
	option target 'ACCEPT'

psherman · April 3, 2025, 7:58pm

Your config looks fine. I suspect that the issue is with how the TV detects connectivity, rather than an actual problem with said connectivity.

Reading between the lines a bit here, I think it is saying it tried to ping the gateway and it didn't reply. This is expected based on your configuration, and it's actually following best practices. That said, you can add a rule to allow ping responses like this:

config rule
	option name 'Allow-media-Ping'
	option src 'media'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

I think that this will fix the issue. Try it out and let me know. (don't forget to restart the firewall or reboot the router to ensure the rule takes effect).

net_user_dhr3 · April 3, 2025, 8:05pm

You were absolutely right, the ping was the issue.
After adding the rule to the firewall and running service firewall restart it just connected straight away.

Big thank you @psherman and @pavelgl for your amazing contribution, I definitely could not have done it without you guys!!!

system · April 13, 2025, 8:05pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.