Help with Guest VLANs on Archer A7 as "Dumb AP"

Installing and Using OpenWrt
1

I'm new to OpenWRT and still confused by how DSA works. Most tutorials use the older builds with no DSA, and that doesn't help.

I have a Linksys EA8300 as primary router running 23.05.02, and configured to support a main lan (vlan 1), and two different guest networks vlan 101 called iot where devices can only access the internet, vlan 102 caller camera where devices cannot access the internet. This all works, and also works well with one of my old routers running AsusWRT Merlin as a dumb AP and configured to send vlan tagged traffic on one of the EA8300 ports. The EA8300 is the only DHCP server running, assigning 192.168.2.x for the main lan, 192.168.10.x for vlan 101 and 192.168.20.x for vlan 102. The AP is using a static address of 192.168.2.6 and connected to a tagged port on the EA8300.

I'm now trying to set up an Archer A7 V5.8 as a dumb AP instead of the Asus, and properly tag traffic as vlan 1, vlan 101 and vlan 102. What is confusing me, is that on the Archer, I don't see a lan1 lan2 lan3 lan4 and wan port, but an eth0 with an eth0.1 and eth0.2 vlan, so what I thought I learned from the EA8300 doesn't really apply. And most tutorials don't apply either. Moreover, the tutorials for "Dumb AP with guest" assumes I'll have a DHCP server running on the Archer, which is not what I want.

I have the following configured, and it's working as a "Dumb AP"

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd87:39a5:056c::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'
	list ports 'eth0.2'
	option bridge_empty '1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.2.6'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.2.1'
	list dns '192.168.1.1'
	list dns '192.168.2.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 2 3 4 5 1'
	option vid '1'

Port 1 seems to be the WAN port, which I use to connect to the EA8300. And I removed the wan interface because I don't think I'll need it for the firewall (if I understand things correctly, there should be no firewall on the AP in my configuration, bridges should take care of everything, then it's up to the main EA8300 to sort things out based on the vlan tags)

I tried various combinations of vlans, bridge devices and ports assignment, but I keep losing access due clearly to configuration mistakes (or, if I keep access, nothing works as it should)

Ideally I'd like to be able to have ports 4 and 5 as untagged ports to connect devices that will be on the main network. Port 3 as vlan 102 and port 2 as vlan 101. Port 1, the WAN port, as uplink to the EA8300 sending tagged traffic. I will then add the necessary wireless interfaces, but for ow I'm focusing on th ebasic bridge/vlan setup.

Appreciate any pointer to get unstuck. I still can't wrap my head around some basic OpenWRT concepts.

2

If the A7 is the device you need help with, you will be using the old swconfig methods, not DSA because the device has not yet made the transition.

eth0.1 and eth0.2 should not be bridged. Make it look like this instead:

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'

You've already added logical port 1 to VLAN 1 in the switch config. Now we'll add new VLANs on that same logical port, all tagged. You didn't mention any other ports needed for those VLANs, so I'll assume it is purely the physical wan port (logical port 1) and wifi.

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 1t'
	option vid '101'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 1t'
	option vid '102'

Now, we can create bridged and unmanaged network interfaces for the new VLANs:

config device
	option name 'br-iot'
	option type 'bridge'
	list ports 'eth0.101'

config device
	option name 'br-camera'
	option type 'bridge'
	list ports 'eth0.102'

config interface 'iot'
	option device 'br-iot'
	option proto 'none'

config interface 'camera'
	option device 'br-camera'
	option proto 'none'

Now you just create SSIDs as appropriate for iot and camera and link them against the respective networks.

Finally, not related ot your issue, but you have an extra DNS in your lan interface that should be removed...

remove the 192.168.1.1 entry since that doesn't appear to be an address/subnet you are using in your configuration at all.

Finally, reboot the A7 and you should have the dumb AP configuration you have described.

1 Like
3

Well, that's embarrassing :frowning: I got so lost in the EA8300 and DSA that I assumed all the routers made the transition. The presence of the "Switch" menu under network should have been a dead giveaway, but I was so single-minded thinking about DSA

Thanks so much, it all makes sense now. I added the physical ports I needed to the vlans, and my configuration is below, working:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd87:39a5:056c::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.2.6'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.2.1'
	list dns '192.168.2.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0t 4 5 1t'
	option vid '1'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0t 2 1t'
	option vid '101'

config switch_vlan
	option device 'switch0'
	option vlan '3'
	option ports '0t 3 1t'
	option vid '102'

config device
	option name 'br-iot'
	option type 'bridge'
	list ports 'eth0.101'

config device
	option name 'br-camera'
	option type 'bridge'
	list ports 'eth0.102'

config interface 'iot'
	option device 'br-iot'
	option proto 'none'

config interface 'camera'
	option device 'br-camera'
	option proto 'none'

(And, yes, the wrong DNS was due to a previous test on another IP range, good catch)

1 Like
4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.