Help to create VLAN and to pass them to managed switch

DallasBelt · April 5, 2026, 10:35pm

Hello!

I’ve been using OpenWrt for a while but I needed more wifi coverage, so I bought a Omada EAP. I also bought a decent managed POE switch. My goal is to pass the br-lan and the br-iot interfaces to the switch using vlans. How can I acomplish that? Will I need to create new vlan interfaces/devices? Also, if I won’t be using the wifi part of the OpenWrt router, can I pass the firewall rules to the Omada EAP, or is that controlled by it?

I think this diagram describes better what I want:

root@OpenWrt:/etc/config# cat dhcp

config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option noresolv '1'
option port '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
list dhcp_option '6,10.12.20.1'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/odhcpd.leases'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
option piodir '/tmp/odhcpd-piodir'
option hostsdir '/tmp/hosts'

config dhcp 'guests'
option interface 'guests'
option start '100'
option limit '150'
option leasetime '12h'
list dhcp_option '6,10.12.21.1'

config dhcp 'depts'
option interface 'depts'
option start '100'
option limit '150'
option leasetime '12h'
list dhcp_option '6,10.12.22.1'

config host
option name 'server'
option ip '10.12.20.10'
option leasetime 'infinite'
list mac 'xx:xx:xx:xx:xx:xx'

config host
option name 'printer'
list mac 'xx:xx:xx:xx:xx:xx'
option ip '10.12.20.20'
option leasetime 'infinite'

config host
option name 'poe-switch'
list mac 'xx:xx:xx:xx:xx:xx'
option ip '10.12.23.2'
option leasetime 'infinite'

config dhcp 'iot'
option interface 'iot'
option start '100'
option limit '150'
option leasetime '12h'
option dynamicdhcp '0'

config host
option name 'cam-entrance'
list mac 'xx:xx:xx:xx:xx:xx'
option ip '10.12.23.10'
option leasetime 'infinite'

config host
option name 'cam-garage'
list mac 'xx:xx:xx:xx:xx:xx'
option ip '10.12.23.20'
option leasetime 'infinite'

config dhcp 'ext'
option interface 'ext'
option start '100'
option limit '150'
option leasetime '12h'
list dhcp_option '6,10.12.24.1'

config host
option name 'cam-reception'
list mac 'xx:xx:xx:xx:xx:xx'
option ip '10.12.23.30'
option leasetime 'infinite'

root@OpenWrt:/etc/config# cat network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdd0:xxx::/48'
        option packet_steering '1'
        option dhcp_default_duid '000xxx'

config device
        option name 'br-lan'
        option type 'bridge'
        option bridge_empty '1'
        list ports 'lan1'
        list ports 'lan2'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '10.12.20.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'pppoe'
        option username 'xxx'
        option password 'xxx'
        option ipv6 'auto'
        option peerdns '0'

config device
        option type 'bridge'
        option name 'br-guests'
        option bridge_empty '1'

config device
        option type 'bridge'
        option name 'br-depts'
        option bridge_empty '1'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'
        list ports 'lan3'

config device
        option type 'bridge'
        option name 'br-ext'
        list ports 'lan4'
        option bridge_empty '1'

config interface 'guests'
        option proto 'static'
        option device 'br-guests'
        option ipaddr '10.12.21.1'
        option netmask '255.255.255.0'

config interface 'depts'
        option proto 'static'
        option device 'br-depts'
        option ipaddr '10.12.22.1'
        option netmask '255.255.255.0'

config interface 'ext'
        option proto 'static'
        option device 'br-ext'
        option ipaddr '10.12.24.1'
        option netmask '255.255.255.0'

config interface 'iot'
        option proto 'static'
        option device 'br-iot'
        option ipaddr '10.12.23.1'
        option netmask '255.255.255.0'

root@OpenWrt:/etc/config# cat firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guests'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guests'

config forwarding
        option src 'guests'
        option dest 'wan'

config zone
        option name 'depts'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'depts'

config forwarding
        option src 'depts'
        option dest 'wan'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'iot'

config forwarding
        option src 'lan'
        option dest 'iot'

config rule
        option name 'Allow-DHCP-Guests'
        list proto 'udp'
        option src 'guests'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-Guests'
        option src 'guests'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Depts'
        list proto 'udp'
        option src 'depts'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-Depts'
        option src 'depts'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Iot'
        list proto 'udp'
        option src 'iot'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-Iot'
        option src 'iot'
        option dest_port '53'
        option target 'ACCEPT'
        option enabled '0'

config rule
        option name 'Allow-NTP-Iot'
        option src 'iot'
        option dest_port '123'
        option target 'ACCEPT'
        list proto 'udp'

config rule
        option name 'Allow-DHCP-Ext'
        list proto 'udp'
        option src 'ext'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Allow-DNS-Ext'
        option src 'ext'
        option dest_port '53'
        option target 'ACCEPT'

config zone
        option name 'ext'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'ext'

config forwarding
        option src 'ext'
        option dest 'wan'

config forwarding
        option src 'iot'
        option dest 'lan'

root@OpenWrt:/etc/config# cat wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
        option band '2g'
        option channel '1'
        option htmode 'HT20'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'SONRISO'
        option encryption 'psk2'
        option key 'xxx'
        option macfilter 'allow'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'

config wifi-device 'radio1'
        option type 'mac80211'
        option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
        option band '5g'
        option channel '36'
        option htmode 'VHT80'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'SONRISO'
        option encryption 'psk2'
        option key 'xxx'
        option macfilter 'allow'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'
        list maclist 'xx:xx:xx:xx:xx:xx'

config wifi-iface 'wifinet2'
        option device 'radio0'
        option mode 'ap'
        option ssid 'SONRISO INVITADOS'
        option encryption 'psk2'
        option isolate '1'
        option key 'xxx'
        option network 'guests'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'ap'
        option ssid 'SONRISO INVITADOS'
        option encryption 'psk2'
        option isolate '1'
        option key 'xxx'
        option network 'guests'

config wifi-iface 'wifinet4'
        option device 'radio0'
        option mode 'ap'
        option ssid 'DEPARTAMENTOS'
        option encryption 'psk2'
        option key 'xxx'
        option network 'depts'

Thanks in advance!

DallasBelt · April 6, 2026, 1:50am

I tried enabling Brifge VLAN Filtering in OpenWrt for the br-lan interface:

And my switch’s VLAN configuration:

This doesn’t work. also, if I mark LAN2 as tagged in OpenWrt, I can’t access the switch web interface. I bought the switch for the cheap price, but maybe it’s limited…

lleachii · April 6, 2026, 7:21am

You only use 1 bridge. With that said, where are the VLANs in your configuration?

e.g. br-lan.x

_bernd · April 6, 2026, 8:00am

Often vlan 1 introduces lots of issues with vendor firmware. General advise is to not use vlan 1.
And like @lleachii said, you miss all vlan interfaces.

DallasBelt · April 6, 2026, 2:14pm

Sorry, I'm not too good with networking.

From my understanding, I should create one bridge interface and then enabling VLAN filtering, right?

About the VLAN 1 of the switch, I can't delete it. The device is from the brand “STEAMEMO”, I presume chinese. So maybe it's limited?

psherman · April 6, 2026, 2:19pm

I’m still disagree with this. I’ve never encountered any modern devices that have issues with vlan 1.

lleachii · April 6, 2026, 2:22pm

In fact, I've used VLAN 1 as a legacy from non-DSA configurations for LAN.

Personally, I edit br-lan into br-lan.1, setup the VLAN filtering, then Save/Apply both changes concurrently.

_bernd · April 6, 2026, 4:34pm

Not with Linux but even dell or HP entry level "enterprise" gears even sometimes warn in their manual about using native vlan 1. And yes I encoutered that IRL.
And from a planning standpoint I thinks it's more clean. Because if you ever forget to tag a port it just sits in vlan 1. And vlan 1 is not used or configured. YMMV

DallasBelt · April 8, 2026, 3:50pm

I watched some tutorials to understand VLANs and finally could make it work.

PS: For future reference: when enabling the VLAN functionality on the POE switch, it's important to create a VLAN with ID 1 on OpenWrt so it's possible to access the web interface. It can be deleted later.

system · April 18, 2026, 3:51pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.