Kind of. I mean, yes, but you need to apply some adaptation for your specific goals. It is best to look at that article as a tutorial/learning exercise and then adapt for your environment.
I took the configuration you originally posted and tried to clean it up based on what I assume you were trying to accomplish. I can't guarantee that this will work as is:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdf8:f373:857e::/48'
option packet_steering '1'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1'
list ports 'lan2'
config interface 'personal'
option device 'br-lan.10'
option proto 'static'
option ipaddr '192.168.10.1'
option netmask '255.255.255.0'
config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan3'
config interface 'iot'
option device 'br-lan.20'
option proto 'static'
option ipaddr '192.168.20.1'
option netmask '255.255.255.0'
config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan4'
config interface 'guest'
option device 'br-lan.30'
option proto 'static'
option ipaddr '192.168.30.1'
option netmask '255.255.255.0'
I did take the 'lan4' port off of the iot bridge-vlan and set it on the guest bridge-vlan so that each would have a port, so that was a little different than what you were doing.
Hopefully that will either get you fixed up or give you some guidance to help you get it fixed up
Please don't forget, while your network configuration could be "perfect", things like your firewall and DHCP configuration could still impact/prevent your network from working the way you're wanting.
In order to confirm, I would need to see the full configuration.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
Wrong VLAN tag... Every lan shoud have only 1 tag vlan port e.g vlan 10 on LAN 2 and don't tag VLAN 20 and 30 on lan 2, vlan 20 must tag in lan 3 and vlan 30 in lan 4 otherwise disable to use the default lan, configure vlan interface from luci and firewall for vlan and see to it that your ap support vlan then configure the ap wan port for vlan 10
At the surface, there is nothing wrong with the port-vlan membership based on the screenshot. I can’t verify that the full config is correct yet - I need to see the text config. But with that said, your post is a bit confusing, though. Maybe you can clarify.
also, @psherman is the firewall correct? somehow the pc connected to lan1 (vlan10) cannot ping the laptop connected to vlan10 wifi but it can ping the iphone and android device that is connected to vlan10 wifi.
The general structure looks okay, but some things that should be fixed:
Make VLAN20's status on ports lan3-lan4 explicit by making them untagged+PVID (:u*) like this:
config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan2:t'
list ports 'lan3:u*'
list ports 'lan4:u*'
In the wifi, set the encryption to WPA2 (psk2) or WPA3 (sae), and make sure that there is only one network listed (currently there are 2; it should be only PERSONAL):
Same with this one:
And with this one:
And this one:
Now, in the firewall, the preferred method is to set an untrusted zone's input rule to REJECT and then add rules to allow DHCP and DNS. So for example, the guest zone should look like this:
config zone
option name 'Guest'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'GUEST'
config rule
option name 'Allow Guest DHCP'
list proto 'udp'
option src 'Guest'
option dest_port '67'
option target 'ACCEPT
config rule
option name 'Allow Guest DNS'
option src 'Guest'
option dest_port '53'
option target 'ACCEPT
Do the same with the IoT zone.
This isn't necessary and should be deleted (you already have a corresponding forward rule):
This isn't necessary, so delete it:
This doesn't do anything, delete it:
We fixed these by setting the input to REJECT so delete these:
And I'm guessing that you don't actually want this (I'd recommend deleting):
thanks for this. i will update this tomorrow as it is already late night on my location and will let you know.
somehow the pc connected to lan1 (vlan10) cannot ping the laptop connected to vlan10 wifi but it can ping the iphone and android device that is connected to vlan10 wifi.
any idea what could be the reason for this?
also, what is the reason we should do this?
Make VLAN20's status on ports lan3-lan4 explicit by making them untagged+PVID
