Help Adding Wan port to Lan on Access Point (DSA)

Random · March 7, 2026, 6:26pm

I have a Linksys EA8500 WiFi Router running OpenWrt 25.12.0 and configured as a dedicated AP using directions found here. Ever since DSA, I have struggled to get the dedicated physical WAN port to be grouped and treated as a LAN port. Here are the default configured interfaces:

And here is my device list:

It seems like every which was I try to configure br-lan by adding things it doesn’t quit work out right. Here is what it looks like without any changes:

What do i need to do to get the WAN port to act as a regular LAN port? Also, do I need to change anything on my firewall:

Thank you!

anon63541380 · March 7, 2026, 6:31pm

You have to liberate physical port from past configs, like remove or disable wan/wan6 interfaces.

Random · March 7, 2026, 6:33pm

Okay, so I should start by deleting the Wan and Wan6 interfaces?

Random · March 7, 2026, 6:38pm

So i changed both Wan and Wan6 and did the following:

Disabled “bring up on boot”
Set the device to “unspecified”

Now what?

anon63541380 · March 7, 2026, 6:40pm

Add wan physical port to br-lan.

Random · March 7, 2026, 6:48pm

This is where I’ve locked myself out of the router multiple times, and had to reset it. Can you clarify exactly what to do? I think you’re saying:

Go to Network → Interfaces → Devices
Configure br-lan
Edit Bridge Ports
Add ???

What should I add? Every time i’ve done this in the past something had broken.

Random · March 7, 2026, 6:51pm

I’ve also disabled firewall in Startup just in case:

anon63541380 · March 7, 2026, 6:56pm

Add checkbox at port WAN

ghoffman · March 7, 2026, 6:57pm

i’ve had this problem on different device (rt4230w) since DSA mmigration a couple years ago. i had to manually set the macaddr on the wan port to the same as the lan port before adding it to the bridge device.

for the rt4230w, i think the DSA migration was incomplete. dont know if this is also true for ea8500.

anon63541380 · March 7, 2026, 6:58pm

See Problem: NFS export fails - #25 by brada4 to functionally neutralize firewall.

Random · March 7, 2026, 8:42pm

I did not implement your Firewall change suggestion.

I added Switch port: “wan” to the bridge ports and allowed the timer to expire and rollback because it could not reconnect.

cookiemonster · March 7, 2026, 9:08pm

You should never experience a revert doing this. Confirm you followed the wiki.

There may be a DSA bug. Try moving over eth1 instead to br-lan.

Random · March 7, 2026, 9:33pm

The only place i differ from that original link to setup the AP is I'm using roaming because i have a second AP.

I added eth1 to br-lan. The change was accepted. This resulted in an inability to connect to the router via WiFi, ethernet to a LAN port, or ethernet via the WAN port. I had to reset the router.

This is why i’m on the forum: no matter how many ways I’ve tried to add the WAN port to br-lan it bricks the device. I haven’t been succesful in figuring this out.

psherman · March 7, 2026, 9:55pm

Do not do this.

Let's take a look at the config to see what is going on. It's actually very easy to handle this by means of editing the text file.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network

Random · March 7, 2026, 10:27pm

Hello and thanks for jumping in. FYI: because I had to reset the router, the WAN and WAN6 are back to the default configuration.

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.12.71",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Linksys EA8500 WiFi Router",
        "board_name": "linksys,ea8500",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.0",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32713-f919e7899d",
                "target": "ipq806x/generic",
                "description": "OpenWrt 25.12.0 r32713-f919e7899d",
                "builddate": "1772496855"
        }
}

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '0004760a7f11885b4999a286f5302c2bef5d'
        option ula_prefix 'fd43:eba3:21e1::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '192.168.1.3/24'
        option multipath 'off'
        option gateway '192.168.1.1'
        list dns '192.168.1.1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

root@OpenWrt:~#

psherman · March 7, 2026, 10:35pm

Delete these:

Then add the wan port to the existing br-lan


config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'wan'

Random · March 9, 2026, 11:55am

I tested this but wasn't able to pay close enough attention to provide a proper reply. The router behaved unpredictably after the changes. I'll try to test this week and follow up when I have adequate time to document the behaviors. Thank you!

Random · March 11, 2026, 3:38am

I made the changes you suggested, rebooted the AP, and the results were mixed:

The wifi broadcast from the AP no longer connected devices to the Internet (fairly certain, this was hard to diagnose).
The AP has an address of 192.168.1.3 and this would not resolve in a web browser for devices on WiFi from a separate AP trying to reach this AP.
A computer connected directly to the AP at one of its LAN ports could reach the Internet but could not resolve 192.168.1.3 in a web browser.
A computer connected to the AP via its WAN port could access the Internet AND navigating to 192.168.1.3 in a web browser and it would resolve.

The broken wifi and mixed results on wired connections forced me to roll back to the network config before your suggestions.

psherman · March 11, 2026, 3:45am

The only way we can really troubleshoot this is to see the complete config based on the changes that I recommended.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Random · March 12, 2026, 12:55am

Here you go. Thank you. Please remember I had to role back your previously suggested change to achieve device stability, so that is why you'll see WAN as an interface again.

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.12.71",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Linksys EA8500 WiFi Router",
        "board_name": "linksys,ea8500",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.0",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32713-f919e7899d",
                "target": "ipq806x/generic",
                "description": "OpenWrt 25.12.0 r32713-f919e7899d",
                "builddate": "1772496855"
        }
}

SPACER

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '0004760a7f11885b4999a286f5302c2bef5d'
        option ula_prefix 'fd43:eba3:21e1::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '192.168.1.3/24'
        option multipath 'off'
        option gateway '192.168.1.1'
        list dns '192.168.1.1'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

SPACER

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option channel '1'
        option htmode 'HT20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid XXXXX
        option encryption XXXXX
        option key XXXXX
        option ieee80211r '1'
        option mobility_domain '1232'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b700000.pcie/pci0001:00/0001:00:00.0/0001:01:00.0'
        option band '5g'
        option channel '36'
        option htmode 'VHT80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid XXXXX
        option encryption XXXXX
        option key XXXXX
        option ieee80211r '1'
        option mobility_domain '1235'
        option ft_over_ds '0'
        option ocv '0'

SPACER

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

SPACER

root@OpenWrt:~# cat /etc/config/firewall
config defaults
        option syn_flood        1
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        option input            REJECT
        option output           ACCEPT
        option forward          DROP
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT


### EXAMPLE CONFIG SECTIONS
#removed to shorten the post