Extending multiple SSIDs - WDS? 801.s? Batman-adv? Which one is the best and how to configure it

sudo_nitz · January 11, 2026, 3:36pm

Hi!

I'm an intermediate user – I've been using OpenWrt for several years and have some experience, but I'm not an expert.

At home, I currently have a CUDY WR3000 router with a clean OpenWrt 24.10.5 installed.

This router broadcasts three SSIDs for each WiFi band:

"LIPKI_2.4GHz" (main),
"LIPKI_2.4GHz_Free" (for guests),
"LIPKI_2.4GHz_IoT" (for isolated devices),
"LIPKI_5GHz" (main),
"LIPKI_5GHz_Free" (for guests),
"LIPKI_5GHz_IoT" (for isolated devices).

The above SSIDs are assigned to three interfaces:

LIPKI_2.4GHz and LIPKI_5GHz are "lan" (a "br-lan" device with all physical Ethernet ports),
LIPKI_2.4GHz_Free and LIPKI_5GHz_Free are "guest" (a "br-guest" device with no assigned physical Ethernet ports),
LIPKI_2.4GHz_IoT and LIPKI_5GHz_IoT are "iot" (a "br-iot" device with no assigned physical Ethernet ports).

The above interfaces have separate DHCP.

They also have separate firewall zones and are isolated from each other.

Configuration:

root@LIPKI-ROUTER:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd13:1224:c7bb::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.2.254'
        option netmask '255.255.255.0'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wwan'
        option proto 'dhcp'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        option ipaddr '192.168.12.254'
        option netmask '255.255.255.0'

config interface 'iot'
        option proto 'static'
        option device 'br-iot'
        option ipaddr '192.168.22.254'
        option netmask '255.255.255.0'

root@LIPKI-ROUTER:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '0'
        option local '/LIPKI/'
        option domain 'LIPKI'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1200'
        option strictorder '1'
        list interface 'guest'
        list interface 'iot'
        list interface 'lan'

config dhcp 'lan'
        option interface 'lan'
        option start '1'
        option limit '20'
        option leasetime '1h'
        option dhcpv4 'server'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option name 'LIPKI-REPEATER1'
        option ip '192.168.2.241'
        list mac '86:AF:CA:E7:5E:C8'

config dhcp 'guest'
        option interface 'guest'
        option start '1'
        option limit '10'
        option leasetime '1h'

config dhcp 'iot'
        option interface 'iot'
        option start '1'
        option limit '10'
        option leasetime '1h'

root@LIPKI-ROUTER:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'DROP'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'iot'

config forwarding
        option src 'guest'
        option dest 'wan'

config forwarding
        option src 'iot'
        option dest 'wan'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'DNS-over-LAN'
        option src 'lan'
        option src_dport '53'
        option dest_ip '192.168.2.254'

config redirect
        option dest 'guest'
        option target 'DNAT'
        option name 'DNS-over-GUEST'
        option src 'guest'
        option src_dport '53'
        option dest_ip '192.168.2.254'

config redirect
        option dest 'iot'
        option target 'DNAT'
        option name 'DNS-over-IOT'
        option src 'iot'
        option src_dport '53'
        option dest_ip '192.168.2.254'

config rule
        option src 'guest'
        option name 'Allow-DHCP-GUEST'
        list proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option src 'iot'
        option name 'Allow-DHCP-IOT'
        list proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option src 'guest'
        option name 'Allow-DNS-GUEST'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option src 'iot'
        option name 'Allow-DNS-IOT'
        option dest_port '53'
        option target 'ACCEPT'

I need to extend the range of all SSIDs, so I purchased a CUDY RE3000 repeater, onto which I flashed raw OpenWrt version 2.10.4 – it's essentially a router with a single Ethernet port.

I configured the repeater identically to the main router – the only differences are:

the repeater has DHCP disabled on all interfaces,
the repeater's interfaces have different static addresses,
the main router is set as the gateway for all repeater interfaces.

Unfortunately, I can't connect the router to the repeater using an Ethernet cable.

I tried connecting the devices wirelessly using WDS. To do this:

on the main router, the SSID named "LIPKI_5GHz" was set to "WDS Access Point" mode,
on the repeater, the SSID named "LIPKI_5GHz" was set to "WDS Client" mode,
the other SSIDs were set to "Access Point" mode.

During testing, the WiFi client successfully connected to the repeater's "LIPKI_2.4GHz" and "LIPKI_5GHz" networks.

Unfortunately, when the WiFi client tried to connect to a guest or IoT network, it was unable to obtain an IP configuration.

I think it's because the "LIPKI_2.4GHz" and "LIPKI_5GHz" networks are associated with the "lan" interface, which is the only one that works in WDS.

Of course, the WiFi client uses all SSIDs of the primary router without any problems.

I tried to solve this problem using VLANs – by changing the following on both devices' interfaces:

br-lan on br-lan.2 (VID = 2),
br-guest on br-lan.12 (VID = 12),
br-iot on br-lan.22 (VID = 22).

Still without success.

I haven't been able to solve the problem this way. I don't think VLANs can be moved using WDS – if I'm wrong, please correct me and point out any configuration errors or help me resolve the issue.
I'm wondering if, given my hardware configuration, extending the WiFi network (multiple SSIDs) using WDS is the best solution. Perhaps mesh (802.11s) or batman-adv would be a better option? If so, which one and why?

dandek01 · January 11, 2026, 3:53pm

I also think that wds will not be helpful here because you need to send layer2 data over layer3 link ( wifi ). Batman-adv can do that and I think it is made for that puropse, among others.

So yes, you will have to use batman-adv if you want to extend your wifi and vlans.

It is not that difficult to set up. If you haven’t done it before please watch onemarcfifty video on setting up batman over wifi.

As I’m using batman-adv hybrid setup, lan and wifi, I can tell you that you have to basically install kmod-batman packages including batman luci, remove default wpad and use full wpad package of your choice. I’m using wpad openssl, same on both routers.

Just create batman device and interface, use dedicated radio, wifi 5 if you can, to create wifi link to it.

And on dumb ap just use unmamnaged interfaces fot vlans as they are managed by the main router, you know dhcp, firewall etc.

It is a bit this and that but you will get the grip on it as onemarcfifty explained this in details.

sudo_nitz · January 11, 2026, 4:12pm

dandek01:

I also think that wds will not be helpful here because you need to send layer2 data over layer3 link ( wifi ). Batman-adv can do that and I think it is made for that puropse, among others.

So yes, you will have to use batman-adv if you want to extend your wifi and vlans.

It is not that difficult to set up. If you haven’t done it before please watch onemarcfifty video on setting up batman over wifi.

As I’m using batman-adv hybrid setup, lan and wifi, I can tell you that you have to basically install kmod-batman packages including batman luci, remove default wpad and use full wpad package of your choice. I’m using wpad openssl, same on both routers.

Just create batman device and interface, use dedicated radio, wifi 5 if you can, to create wifi link to it.

And on dumb ap just use unmamnaged interfaces fot vlans as they are managed by the main router, you know dhcp, firewall etc.

It is a bit this and that but you will get the grip on it as onemarcfifty explained this in details.

Thanks for the quick reply!

So I'm abandoning WDS and switching to batman-adv.

Thank you for the precise instructions – I've already read elsewhere that for 802.11s (and therefore batman-adv), I need to uninstall wpad-basic-wolfssl and, ideally, install wpad-mesh-openssl. Thank you also for recommending a specific source of information.

I'll try the configuration tonight.

One more question: what's the best way to create VLANs? As 802.1q devices or as "bridge VLAN filtering" values in "br-lan" device? I think the second option is correct (due to DSA), but I'm not sure.

dandek01 · January 11, 2026, 4:37pm

I think you should use bridge, but I configured vlans on opnsense gateway and openwrt router is just again transparent bridge to it.

This is how i set up network on one dumb ap.

config interface 'bat0'
	option proto 'batadv'
	option routing_algo 'BATMAN_V'
	option bridge_loop_avoidance '1'
	option gw_mode 'off'
	option hop_penalty '30'
        option mtu '1460'

config interface 'batmesh0'
	option proto 'batadv_hardif'
	option master 'bat0'
	option mtu '1460'

config interface 'IOT'
	option proto 'none'
	option device 'br-iot'

config device
	option type 'bridge'
	option name 'br-iot'
	list ports 'bat0.10'
	option bridge_empty '1'
        option mtu '1460'

config interface 'ESP'
	option proto 'none'
	option device 'br-esp'

config device
	option type 'bridge'
	option name 'br-esp'
	list ports 'bat0.20'
	option bridge_empty '1'
        option mtu '1460'

and this is the same on server node, but as I said this is all going to opnsense firewall that have vlan set up so your config on gateway will probably be a bit different

config device
	option type 'bridge'
	option name 'br_iot'
	option bridge_empty '1'
	list ports 'bat0.10'
	list ports 'lan4.10'
	option mtu '1460'

config interface 'IOT'
	option proto 'none'
	option device 'br_iot'

config device
	option type 'bridge'
	option name 'br_esp'
	option bridge_empty '1'
	list ports 'bat0.20'
	list ports 'lan4.20'
	option mtu '1460'

config interface 'ESP'
	option proto 'none'
	option device 'br_esp'

sudo_nitz · January 11, 2026, 4:42pm

Thank You once again!

I will do tests and inform about results!

sudo_nitz · January 12, 2026, 10:31am

I've successfully launched a mesh network with multiple SSIDs.

Unfortunately, when I switch all local interfaces to the repeater in the "DHCP client" section, I lose access to the repeater's LUCI (it's not even available at the new address obtained from the main router's DHCP).

Could you share the DHCP and firewall configuration of your AP device?

dandek01 · January 12, 2026, 10:50am

I can but this will not solve your problem, because dhcp and firewall are managed by opnsense gateway and not server node in openwrt.

My firewall and dhcp are disabled on all openwrt nodes.

For repeater you will need probably avahi demon installed and configured on your gateway.

sudo_nitz · January 13, 2026, 12:05am

I found the cause of the problem.

Instead of disabling the firewall service, I removed the firewall zone assignment for each interface. Because of this, the default firewall rules were blocking access to LUCI.

Now everything is working perfectly.

Thank you for your help and support!

Note for others: the tutorial https://www.youtube.com/watch?v=t4A0kfg2olo&t=2s was very helpful, and by using it alone, you can achieve your goal – full mesh Wi-Fi or hybrid mesh.