Guest access from a Dumb AP

I apologize ahead of time and I know this topic has been addressed several times but I am using 22.03.2 with DSA networking and I don't seem to be able to find 22.03.2 DSA related discussion and I have no successful experience with vlans.

My setup is:
Internet into cable modem.
cable modem out to wan port on a Linksys WRT3200ASM 192.168.1.1 .

Lan1 to Desktop 192.168.101
Lan2 to Desktop 192.168.1.102
Lan3 to Dumb AP Linksys WRT1900v2 Lan1 192.168.1.2
Lan4 to Dumb AP Belkin RT3200 Lan1 192.168.1.5

All are running on Openwrt 22.03.2 utilizing DSA networking
Everything is running super fantastic!

For the holidays I wanted to setup the WRT1900 with a guest wireless access point utilizing vlans and continue to be a regular Dumb AP.

So....
logged into the wrt1900 and
created bridge device named "VLANS" and then created vlan "VLANS.10"

Bridged "lan1" and "VLANS.10" to bridge device "VLANS"
(Should I include eth0 in the bridge list??)

Created Interface "VLAN10" attaching the bridge device "VLANS" as the device for the Interface. (Is that the correct device or should I select "Software VLAN.10 ??)

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fde9:dd97:dfce::/48'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.1.1'
	list dns '192.168.1.1'
	option ipaddr '192.168.1.2'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config device
	option name 'wlan0'

config device
	option type 'bridge'
	option name 'VLANS'
	list ports 'VLANS.10'
	list ports 'lan1'
	option bridge_empty '1'

config bridge-vlan
	option device 'VLANS'
	option vlan '10'
	list ports 'VLANS.10:t'
	list ports 'lan1:t'

config interface 'vlan10'
	option proto 'static'
	option device 'VLANS'
	option ipaddr '192.168.10.10'
	option netmask '255.255.255.0'
	list dns '192.168.1.1'


And then (still in the Dumb AP wrt1900) I created a radio1 wireless interface GT10 connecting to network vlan10 which is a second interface on radio1.

config wifi-device 'radio0'
	option type 'mac80211'
	option channel '36'
	option hwmode '11a'
	option path 'soc/soc:pcie/pci0000:00/0000:00:01.0/0000:01:00.0'
	option htmode 'VHT80'
	option country 'US'
	option cell_density '0'
	option disabled '1'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option macaddr '14:91:82:xx:xx:xx'
	option encryption 'psk2'
	option key 'xxxxxxxx'
	option network 'lan'
	option ssid 'wrt1950'
	option disabled '1'

config wifi-device 'radio1'
	option type 'mac80211'
	option channel '11'
	option hwmode '11g'
	option path 'soc/soc:pcie/pci0000:00/0000:00:02.0/0000:02:00.0'
	option htmode 'HT20'
	option country 'US'
	option cell_density '0'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option macaddr '14:91:82:xx:xx:xx'
	option encryption 'psk2'
	option key 'xxxxxxxx'
	option ssid 'wrt1924'
	option disabled '1'

config wifi-iface 'wifinet2'
	option device 'radio1'
	option mode 'ap'
	option encryption 'psk2'
	option wmm '0'
	option key 'xxxxxxxx'
	option ssid 'GT10'
	option network 'vlan10'

Before I start trying to configure the main WRT3200 router (which I don't know how to do just yet, could I ask for some critique on these dumb AP configuration settings?

Thanks so much for any guidance. This is my first try at vlans.

I could just be projecting my personal preference, but you may actually want to start with your main router for this. Once you have your lan and guest network defined on the WRT3200, with your WRT3200 providing DHCP and DNS to same, it will be easier to "hook them up" to your dumb AP's. While you are at it, you might as well add an IOT network on its own vlan too by cutting and pasting your guest network setup.

On your WRT3200, /etc/onfig/network should look something like:

.
.
.
config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
#send lan vlan 1 untagged to all ports
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
# put the lan on vlan id 1
	option device 'br-lan.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config bridge-vlan
	option device 'br-lan.10'
#send Guest vlan 10 tagged to both dumb AP's plugged into lan3 and lan4 ports
	list ports 'lan3:t'
	list ports 'lan4:t'

config interface 'GST'
	option proto 'static'
	option device 'br-lan.10'
# Guest vlan needs to be on its own sub-net (192.168.10.x) to be segregated
	option ipaddr '192.168.10.1'
	option netmask '255.255.255.0'

config bridge-vlan
	option device 'br-lan.20'
#send IOT vlan 20 tagged to both dumb AP's plugged into lan3 and lan4 ports
	list ports 'lan3:t'
	list ports 'lan4:t'

config interface 'IOT'
	option proto 'static'
	option device 'br-lan.20'
# IOT vlan needs to be on its own sub-net (192.168.20.x) to be segregated
	option ipaddr '192.168.20.1'
	option netmask '255.255.255.0'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

Give your guest and IOT networks DHCP service in the WRT3200 /etc/config/dhcp file by adding:

config dhcp 'GST'
	option interface 'GST'
	option start '100'
	option limit '150'
	option leasetime '24h'
	list ra_flags 'none'

config dhcp 'IOT'
	option interface 'IOT'
	option start '100'
	option limit '150'
	option leasetime '24h'
	list ra_flags 'none'

And let the guest and IOT networks have access to DNS and DHCP provided by your WRT3200 by adding the following to /etc/config/firewall on your WRT3200:

config zone
	option name 'gst'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'GST'
	option input 'REJECT'

config zone
	option name 'iot'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'IOT'
	option input 'REJECT'

config forwarding
	option src 'iot'
	option dest 'wan'

config forwarding
	option src 'gst'
	option dest 'wan'

config rule
	option name 'Allow-gst-DNS'
	option src 'gst'
	option dest_port '53'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'

config rule
	option name 'Allow-gst-DHCP'
	option src 'gst'
	option dest_port '67-68'
	option target 'ACCEPT'
	list proto 'udp'

config rule
	option name 'Allow-iot-DNS'
	option src 'iot'
	option dest_port '53'
	option target 'ACCEPT'
	list proto 'tcp'
	list proto 'udp'

config rule
	option name 'Allow-iot-DHCP'
	option target 'ACCEPT'
	list proto 'udp'
	option src 'iot'
	option dest_port '67-68'

At this point, you should be able to add easily add new vlan segregated wifi interfaces on your WRT3200 from luci. Under the luci wireless menus, add a new interface (SSID MyWifi-Guest for example) and select "GST" from the network drop down box for the network you want that wifi interface to be attached to. Because these network interfaces are already setup on separate vlans, on separate sub-nets, with DHCP and DNS access already managed by your WRT3200, it's simple. Put the wifi interface on the network you want, and done. The really good news? It will be just as simple on your dumb AP's now (after you figure out receiving the untagged lan and tagged vlans on the dumb AP ports plugged into lan3 and lan4 on the WRT32000). In fact simpler - they are dumb AP's after all.

On the dumb AP's, disable your WAN interfaces of course. Do not add DHCP servers for the vlans on the dumb AP's (that is already being done on the WRT3200!). Set up the network file configuration on your dumb AP's to define the same lan, GST and IOT interfaces and receive the untagged lan vlan 1 and tagged guest and IOT vlans 10 and 20 from whatever port to which you connect WRT3200 lan3 (or WRT3200 lan 4 in the case of your RT3200).

On your dumb AP's, give the lan interface different static IP's on your lan subnect (e.g., 192.168.1.2 for the WRT1900 and 192.168.1.3 for the RT3200) so you can reach these devices on your lan at those addresses. But instead of "option proto 'static' " on the GST and IOT interfaces, make them dhcp clients with "option proto 'dhcp' " and, of course, no need to give them IP addresses - your WRT3200 will handle that.

Thanks so much for the blueprint!

I had a couple of lockouts and needed to boot back to stock. My faults. I'm going to make a fresh imagebuilder image and flash it so recovery does not include reloading so many upgrades one by one after reboot. After that I will continue with the reconfigure.

Thanks again for showing the path*. I will be back..........*

You're welcome. I just caught and corrected a couple careless mistakes in my blueprint, so be sure to recopy if you copied them them already.