Guest WiFi vlan between AP + switch + router

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi
I have been trying for too long to make this work and sadly I just can't

Setup:

Router
ubus call system board 
{
        "kernel": "5.15.162",
        "hostname": "OpenWrt",
        "system": "AMD GX-415GA SOC with Radeon(tm) HD Graphics",
        "model": "QEMU Standard PC (i440FX + PIIX, 1996)",
        "board_name": "qemu-standard-pc-i440fx-piix-1996",
        "rootfs_type": "ext4",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.4",
                "revision": "r24012-d8dd03c46f",
                "target": "x86/64",
                "description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
        }
}
/etc/config/network 
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd2b:0e33:7897::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'eth2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.2'
        option netmask '255.255.255.0'
        list dns '192.168.1.11'
        option ip6assign '60'
        list ip6class 'wan_6'

config interface 'wan'
        option proto 'pppoe'
        option device 'wan'
        option username 'username'
        option password 'password'
        option ipv6 'auto'
        option force_link '1'
        option peerdns '0'
        list ip6class 'wan_6'
        list dns '192.168.1.11'
        list dns 'fe80::be24:11ff:fefa:8135'
        option ip6assign '60'

config device
        option type '8021q'
        option ifname 'eth0'
        option vid '20'
        option name 'wan'

config device
        option name 'eth0'

config interface 'tailscale'
        option proto 'none'
        option device 'tailscale0'
        list dns '192.168.1.11'
/etc/config/dhcp 
config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        option logdhcp '1'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option dhcpv6 'server'

config dhcp 'wan'
        option interface 'wan'
        option ra 'relay'
        option dhcpv6 'relay'
        option ndp 'relay'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
/etc/config/firewall 
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option log '1'
        option log_limit '10/second'
        list network 'wan6'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src '*'
        option proto 'icmp'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'WireGuard'
        option src 'wan'
        option src_dport '51820'
        option log '1'
        option family 'ipv6'
        list proto 'udp'
        option enabled '0'

config zone
        option name 'tailscale'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'tailscale'
        option masq '1'

config forwarding
        option src 'tailscale'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'tailscale'

config forwarding
        option src 'wan'
        option dest 'tailscale'

config forwarding
        option src 'tailscale'
        option dest 'wan'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option log '1'
        option log_limit '10/second'
        list network 'wan6'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src '*'
        option proto 'icmp'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'
        list icmp_type 'bad-header'
        list icmp_type 'destination-unreachable'
        list icmp_type 'echo-reply'
        list icmp_type 'echo-request'
        list icmp_type 'neighbour-advertisement'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'packet-too-big'
        list icmp_type 'router-advertisement'
        list icmp_type 'router-solicitation'
        list icmp_type 'time-exceeded'
        list icmp_type 'unknown-header-type'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'WireGuard'
        option src 'wan'
        option src_dport '51820'
        option log '1'
        option family 'ipv6'
        list proto 'udp'
        option enabled '0'

config zone
        option name 'tailscale'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        list network 'tailscale'
        option masq '1'

config forwarding
        option src 'tailscale'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'tailscale'

config forwarding
        option src 'wan'
        option dest 'tailscale'

config forwarding
        option src 'tailscale'
        option dest 'wan'

‎

Switch
ubus call system board 
{
        "kernel": "6.6.86",
        "hostname": "Switch",
        "system": "RTL8382",
        "model": "D-Link DGS-1210-20",
        "board_name": "d-link,dgs-1210-20",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "realtek/rtl838x",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }
}
/etc/config/network 
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdc6:f8d1:71e3::/48'
        option packet_steering '1'

config device 'switch'
        option name 'switch'
        option type 'bridge'
        option macaddr '64:29:43:24:03:80'

config bridge-vlan 'lan_vlan'
        option device 'switch'
        option vlan '1'
        option ports 'lan1 lan2 lan3 lan4 lan5 lan6 lan7 lan8 lan9 lan10 lan11 lan12 lan13 lan14 lan15 lan16 lan17 lan18 lan19 lan20'

config device
        option name 'switch.1'
        option macaddr '64:29:43:24:03:80'

config interface 'lan'
        option device 'switch.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option gateway '192.168.1.2'
        list dns_search 'lan'
        list dns '192.168.1.11'
        list dns 'fdc6:f8d1:71e3:0:be24:11ff:fefa:8135'
        option delegate '0'

config interface 'lan_6'
        option proto 'dhcpv6'
        option device '@lan'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'
        option ip6assign '64'

config route
        option interface 'lan'
        option target '192.168.200.1/24'
        option gateway '192.168.1.5'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'
        list ports 'lan15.40'

config bridge-vlan
        option device 'br-iot'
        option vlan '40'
        list ports 'lan15.40:t'

config interface 'iot'
        option proto 'static'
        option device 'br-iot.40'
        option ipaddr '192.168.40.1'
        option netmask '255.255.255.0'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'
        list ports 'lan15'

config interface 'guest'
        option proto 'static'
        option device 'br-guest.20'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

config device
        option name 'br-guest.20'
        option type '8021q'
        option ifname 'br-guest'
        option vid '20'
/etc/config/dhcp 
config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '3,192.168.1.2'
        list dhcp_option '6,192.168.1.11'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config dhcp 'iot'
        option interface 'iot'
        option start '100'
        option limit '150'
        option leasetime '12h'

config dhcp 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
        list dhcp_option '3,192.168.1.2'
        list dhcp_option '6,192.168.1.11'
        option rebind_protection '0'
        option localservice '0'
        option interface 'guest'

config dhcp 'lan_6'
        option interface 'lan_6'
        option dhcpv6 'hybrid'
        option ra 'hybrid'
        option master '1'
/etc/config/firewall 
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'lan_6'
        option masq '1'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option target 'ACCEPT'
        list icmp_type 'echo-request'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src '*'
        option proto 'icmp'
        option target 'ACCEPT'
        list icmp_type 'echo-request'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'iot'

config forwarding
        option src 'iot'
        option dest 'lan'

config rule
        option src 'iot'
        option name 'IOT-DHCP'
        list proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option src 'iot'
        option name 'IOT-DNS'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'tcp'

config rule
        option src 'guest'
        option name 'Allow Guest-DHCP'
        list proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option src 'guest'
        option name 'Allow Guest-DNS'
        option dest_port '53'
        option target 'ACCEPT'
        list proto 'tcp'

config zone
        option name 'guest'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'guest'

‎

AP
ubus call system board 
{
        "kernel": "6.6.73",
        "hostname": "WAX220",
        "system": "ARMv8 Processor rev 4",
        "model": "Netgear WAX220",
        "board_name": "netgear,wax220",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0",
                "revision": "r28427-6df0e3d02a",
                "target": "mediatek/filogic",
                "description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
                "builddate": "1738624177"
        }
}
/etc/config/network 
config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd50:7992:da08::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config device
        option name 'eth0'
        option macaddr '94:18:65:4e:0b:2d'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option target '0.0.0.0'
        option ipaddr '192.168.1.5'
        option netmask '255.255.255.0'
        option gateway '192.168.1.2'
        list dns '192.168.1.11'
        option ip6assign '56'

config interface 'SUN'
        option proto 'dhcp'
        option defaultroute '0'
        option peerdns '0'

config interface 'lan_6'
        option proto 'dhcpv6'
        option device '@lan'
        option reqaddress 'try'
        option reqprefix 'auto'

config interface 'smarttv'
        option proto 'dhcp'
        option device 'br-smarttv.40'
        option disabled '1'

config interface 'iot'
        option proto 'none'
        option disabled '1'

config device
        option name 'br-smarttv'
        option type 'bridge'
        list ports 'eth0.40'

config bridge-vlan
        option device 'br-smarttv'
        option vlan '40'
        list ports 'eth0.40:u*'

config device
        option name 'br-smarttv.40'
        option type '8021q'
        option ifname 'br-smarttv'
        option vid '40'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'
        option igmp_snooping '1'
        list ports 'eth0.20'
        option vlan_filtering '0'

config interface 'guest'
        option proto 'static'
        option device 'br-guest.20'

config bridge-vlan
        option device 'br-guest'
        option vlan '20'
        list ports 'eth0.20:t*'
        option local '0'
/etc/config/wireless 
config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel 'auto'
        option band '2g'
        option htmode 'HE20'
        option cell_density '0'
        option log_level '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'WiFI'
        option encryption 'sae-mixed'
        option key '********'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option channel '36'
        option band '5g'
        option htmode 'HE20'
        option cell_density '0'
        option log_level '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'WiFi'
        option encryption 'sae-mixed'
        option key '********'
        option ieee80211r '1'
        option ft_over_ds '0'

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'psk2'
        option network 'lan'
        option key '********'

config wifi-iface 'wifinet6'
        option device 'radio0'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'psk2'
        option key '********'
        option network 'lan'
        option wmm '0'

config wifi-iface 'wifinet7'
        option device 'radio0'
        option mode 'ap'
        option ssid 'WiFi_Guests'
        option encryption 'sae-mixed'
        option key '********'
        option ocv '0'
        option network 'guest'

config wifi-iface 'wifinet11'
        option device 'radio1'
        option mode 'ap'
        option ssid 'WiFi_Guests'
        option encryption 'sae-mixed'
        option key '********'
        option ocv '0'
        option network 'guest'
/etc/config/dhcp 
config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'smarttv'
        option interface 'smarttv'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option ignore '1'
        option dynamicdhcp '0'
/etc/config/firewall 
config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option input 'ACCEPT'
        option name 'sun'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'SUN'

config redirect
        option name 'SUN2000'
        option target 'DNAT'
        option src 'lan'
        option src_dport '6607'
        option dest 'sun'
        option dest_ip '192.168.200.1'
        option dest_port '6607'
        list proto 'tcp'

config forwarding
        option src 'sun'
        option dest 'lan'

config rule
        option name 'Allow SUN connection'
        option src 'lan'
        option dest 'sun'
        list dest_ip '192.168.200.1'
        option target 'ACCEPT'
        option enabled '0'

config forwarding
        option src 'lan'
        option dest 'sun'

config zone
        option name 'guest'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'guest'

config zone
        option name 'smarttv'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'smarttv'

config forwarding
        option src 'smarttv'
        option dest 'guest'

config forwarding
        option src 'guest'
        option dest 'smarttv'

config forwarding
        option src 'smarttv'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'smarttv'

config forwarding
        option src 'guest'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'guest'

config rule
        option name 'Allow Guest DHCP'
        list proto 'udp'
        option src 'guest'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow Guest DNS'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

Thank you.

2

Reached the character limit, so posting right below:

There are serveral things that I still cannot wrap my head around:

  1. Why must I use br-guest.20 as the interface for the network instead of br-guest? I believe it has to do with br-guest.20 being a L3 interface, capable of routing and br-guest being L2 with only switch capabilities.
  2. What is the difference between creating a bridge with port eth0.20 on the AP versus enabling vlan on the bridge and adding eth0 with VLAN ID 20, like this?

image
image899×406 11.9 KB

VS
image
image901×399 12.6 KB

3

Vlans and OpenWRT devices are purely in layer 2. When bridge filtering is turned on frames with the vlan tag X go to a device called <devname>.<vlanid>.