Help to configure VLAN

1eo1 · June 11, 2026, 9:49am

Hi
I have 2 openwrt routers, ASUS Lyra MAP-AC2200 and Xiaomi Mi Router 4C, which are placed in different rooms. There is only one cable that connect two rooms. To each room internet comes from a different providers. 'ISP A' is a static IP, 'ISP B' is DHCP
Currently devices on MI access to internet over 'ISP A'.
ASUS has only 2 ports, one for LAN another for WAN. ASUS uses DSA and MI uses swconfig.

 room 1                       | room 2
             \      /         |        \       /
              ------          |         -------
   --ISP.A-->| ASUS |<====== eth =====>| MI 4C |    <--ISP.B--
              ------          |         -------     (not pluged)
                              |

The goal is to passthrough 'ISP B' to ASUS as 2nd WAN over that single cable so ASUS can get IP directly from ISP B.
also, Is it possible to configure wan port of MI as trunk port and normal wan port at same time, I mean, if I plug MI to any router with default configuration (to untagged port) can get an IP over DHCP ?

1eo1 · June 11, 2026, 10:02am

Here is default config of MI 4C

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '00041a0668d436394695b8913c3e54dfeb3b'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ip6assign '60'
        list ipaddr '192.168.10.1/24'

config device
        option name 'eth0.2'
        option macaddr '28:d1:27:d1:fd:33'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 2 4'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 1'

pavelgl · June 11, 2026, 1:06pm

Not such a trivial task.

On the ASUS you need to use bridge VLAN filtering. Add wan to the default bridge, create VLANs and interfaces.

vlan 1 lan
vlan 2 wan
vlan 10 wanb

config device
	    option type 'bridge'
	    option name 'br-lan'
	    list ports 'lan'
	    list ports 'wan'
	
config bridge-vlan
	    option device 'br-lan'
	    option vlan '1'
	    list ports 'lan'
	
config bridge-vlan
	    option device 'br-lan'
	    option vlan '2'
	    list ports 'wan'
	
config bridge-vlan
	    option device 'br-lan'
	    option vlan '10'
	    list ports 'lan:t'
	
config interface 'lan'
	    option device 'br-lan.1'
	    ...

config interface 'wan'
	    option device 'br-lan.2'
	    ...
	
config interface 'wanb'
	    option device 'br-lan.10'
	    option proto 'dhcp'
	    ...

On the MI, use (let's say) port 4 to connect to ISP.B
Remove it from vlan 1 and create vlan 10 (without including the CPU port) .

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 2'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 1'
		
config switch_vlan
        option device 'switch0'
        option vlan '10'
		option vid '10'
        option ports '1t 4'

Should work, just don't plug wired lan devices into port 4.

1eo1 · June 13, 2026, 7:12pm

Hello Pavel,
Right now I cant test ur config on Asus. I'll test it later.
But i have another mi 4c router. So for experiment instead of asus i tried to configure mi 4c (lets say Mi1) similar to ur config, but without success.
Here what i did. On second router (Mi2) I connected ISP.B to port 2 (according to my config) and wan port to port 2 of Mi1, nor wan neither wan2 able to obtain IP over dhcp on Mi2 The idea is to connect Mi2 as client device and trunk over its wan port at the same time.

attempt 1 to configure Mi1

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd1c:af9:1eb::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'
        list ports 'eth0.2'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'br-lan.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'br-lan.2'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'

config interface 'wan2'
        option proto 'dhcp'
        option device 'br-lan.10'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 4 2'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 1'
	
config switch_vlan
        option device 'switch0'
        option ports '6t 2t'
        option vlan '10'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'eth0.1'

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'eth0.2'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'eth0.1:t'
	
config interface 'wg'
	...
config wireguard_wg
	...

attempt 2 to configure Mi1


config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd1c:af9:1eb::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option norelease '1'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 4 2'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 1'

config interface 'wg'
...

config wireguard_wg
...

config switch_vlan
        option device 'switch0'
        option ports '6t 2t'
        option vlan '10'

config interface 'wan2'
        option proto 'dhcp'
        option device 'eth0.10'

But if i connect Mi2 to port 4 of Mi1 then it is able to obtain an IP on wan .

1eo1 · June 17, 2026, 8:03am

Not exactly what I want but I managed to pass ISP.B to Mi1

Mi1

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
list ports 'eth0.10'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.20.1'
option netmask '255.255.255.0'
option delegate '0'

config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'

config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '6t 4 2'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '6t 1'

config interface 'wg'
...

config wireguard_wg
...

config switch_vlan
option device 'switch0'
option ports '6t 2t'
option vlan '10'

config interface 'wan2'
option proto 'dhcp'
option device 'eth0.20'

config switch_vlan
option device 'switch0'
option ports '6t 2t'
option vlan '20'

config device
option name 'eth0.2'
option type '8021q'
option ifname 'eth0'
option vid '2'
option macaddr '...'

MI2

config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'

config globals 'globals'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ip6assign '60'
list ipaddr '192.168.10.1/24'

config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'

config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '6t 4'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '6t'

config switch_vlan
option device 'switch0'
option ports '6t 1t'
option vlan '10'

config switch_vlan
option device 'switch0'
option ports '2 1t'
option vlan '20'

config interface 'link'
option proto 'dhcp'
option device 'eth0.10'

config device
option name 'eth0.2'
option type '8021q'
option ifname 'eth0'
option vid '2'

1eo1 · June 18, 2026, 8:46am

but unable to get IP if I plug wan of Mi2 to other router (untaged port)

pavelgl · June 18, 2026, 12:22pm

# Mi1

config device
		option name 'br-lan'
		option type 'bridge'
		list ports 'eth0.1'

config interface 'lan'
		option device 'br-lan'
		....

config interface 'wan'
		option device 'eth0.2'
		option proto 'dhcp'

config interface 'wan2'
		option proto 'dhcp'
		option device 'eth0.10'

config switch
		option name 'switch0'
		option reset '1'
		option enable_vlan '1'

config switch_vlan
		option device 'switch0'
		option vlan '1'
		option ports '6t 4 2'

config switch_vlan
		option device 'switch0'
		option vlan '2'
		option ports '6t 1'

config switch_vlan
		option device 'switch0'
		option ports '6t 2t'
		option vlan '10'

# Mi2

config device
		option name 'br-lan'
		option type 'bridge'
		list ports 'eth0.1'

config interface 'lan'
		option device 'br-lan'
		....

config interface 'wan'
		option device 'eth0.2'
		option proto 'dhcp'

config switch
		option name 'switch0'
		option reset '1'
		option enable_vlan '1'

config switch_vlan
		option device 'switch0'
		option vlan '1'
		option ports '6t 4'

config switch_vlan
		option device 'switch0'
		option vlan '2'
		option ports '6t 1'

config switch_vlan
        option device 'switch0'
        option vlan '10'
		option ports '1t 2'

If it doesn't work, the Mi(s) have problems carrying tagged and untagged frames on the same physical port.

1eo1 · July 1, 2026, 2:52pm

Regarding tagging and untagging on same port on Mi, I did not bother with. Probably it does not support.
Regarding main goal. Here is my config

ASUS

config interface 'wan'
        option device 'wan'
        option proto 'static'
        ...

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan'

config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        ...

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan'

config interface 'wan2'
        option proto 'dhcp'
        option multipath 'off'
        option device 'br-lan.20'

config interface 'link'
        option proto 'static'
        option device 'br-lan.10'
        option multipath 'off'
        list ipaddr '192.168.10.1/24'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'lan:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '20'
        list ports 'lan:t'
...

MI

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ip6assign '60'
        list dns '192.168.1.1'
        list dns '1.0.0.1'
        list ipaddr '192.168.1.1/24'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '6t 4'

config switch_vlan
        option device 'switch0'
        option vlan '2'

config switch_vlan
        option device 'switch0'
        option vlan '10'
        option ports '6t 1t'
        option vid '10'

config switch_vlan
        option device 'switch0'
        option ports '2 1t'
        option vlan '20'
        option vid '20'

config interface 'link'
        option proto 'dhcp'
        option device 'eth0.10'
        option metric '11'
        option dns_metric '11'

Also to manage MI from ASUS site I created an another interface and vlan on both routers