I'm running 23.05.0 on a Linksys EA8300 that's setup with a single vlan_filtering enabled bridge containing all physical lan ports with 802.1q interfaces setup for each vlan. The new DSA style. Works fine to tag / untag individual wired ports and traffic flows as expected.
By default adding a wireless AP adds a phyX-apY to the bridge with the corresponding vlan untagged (I see /tmp/run/hostapd-phyX.conf has snoop_iface set to the 802.1q interface from above). Also works as expected, however you need one AP per vlan, which doesn't scale well.
According to the docs one can set hostapd to use dynamic vlans, and this will allow one to create a new device per vlan and add it to a bridge all via a single AP.
The problem there's no way that I can see to set the tagging on the bridge.
This can be modified with a hotplug script, but that's suboptimal.
My question does anyone know where the code that adds the dynamic AP device to the bridge resides? (Or even better if one can control the vlan tagging when that happens.)
Hi this is very interesting. The info is scattered in quite many threads. Could you share the working solution revealing the necessary files, /etc/config/wireless, /etc/hostapd.wpa_psk and /etc/hostapd.vlan for a single working dynamic vlan. Would really appreciate.
Here's a working example, this DSA device has 5 wired ethernet ports (named lan1 through lan4, plus a wan) and 3 internal radios. It's setup as a dumb AP to do the following:
wan is a vlan trunk back to the rest of the network.
lan1 and lan2 are untagged on vlan 10.
lan3 and lan4 are untagged on vlan 20.
all 3 radios have SSID called TEST that connect clients to either vlan 10 or 20 based on password used.
there is an interface on vlan 99 for access to the device itself (ssh, luci, etc)
Network settings:
# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd95:1234:5678::/48'
config device
option name 'br-switch'
option type 'bridge'
option igmp_snooping '1'
option stp '1'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'
config device
option name 'wan'
option macaddr '12:34:56:78:00:00'
config device
option name 'lan1'
option macaddr '12:34:56:78:00:01'
config device
option name 'lan2'
option macaddr '12:34:56:78:00:02'
config device
option name 'lan3'
option macaddr '12:34:56:78:00:03'
config device
option name 'lan4'
option macaddr '12:34:56:78:00:04'
config bridge-vlan
option device 'br-switch'
option vlan '10'
list ports 'lan1'
list ports 'lan2'
list ports 'wan:t'
config bridge-vlan
option device 'br-switch'
option vlan '20'
list ports 'lan3'
list ports 'lan4'
list ports 'wan:t'
config bridge-vlan
option device 'br-switch'
option vlan '99'
list ports 'wan:t'
config device
option name 'br-switch.10'
option type '8021q'
option ifname 'br-switch'
option vid '10'
option macaddr '12:34:56:78:00:10'
config device
option name 'br-switch.20'
option type '8021q'
option ifname 'br-switch'
option vid '20'
option macaddr '12:34:45:78:00:20'
config device
option name 'br-switch.99'
option type '8021q'
option ifname 'br-switch'
option vid '99'
option macaddr '12:34:45:78:00:99'
config interface 'vlan10'
option device 'br-switch.10'
option proto 'none'
option delegate '0'
config interface 'vlan20'
option device 'br-switch.20'
option proto 'none'
option delegate '0'
config interface 'manage'
option device 'br-switch.99'
option proto 'dhcp'
option delegate '0'
All vlans pass up/down the trunk on the wan port as tagged traffic.
Can plug in a cable to any of the lan ports and those devices will be connected to the corresponding vlan as untagged traffic. They get (from upstream) a dhcp lease for ipv4 and see RA for ipv6.
Have a single SSID of "TEST" on 3 different frequencies, and clients using secret10 are connected to vlan 10, those using secret20 on vlan 20. Again, as untagged traffic. These get (from upstream) a dhcp lease for ipv4 and see RA for ipv6.
Can remotely communicate with this device over vlan 99 for ssh, luci, etc.
Edit
To get ipv6 RA events working on the radios I needed to add option multicast_to_unicast_all '1' to each. Not entirely sure why.
@chill Many thanks for the write up. I notice the wifi-iface definitions specify a key but not an explicit network. What happens if a client attempts to associate using psk donotuse?
This config works fine with my netgear wax 206 (mt7622). Now I'm struggling to get it working in xiaomi ax9000 (IPQ8074) Exactly same config seems to work with the QCA9887 radio in same router.
Mon Oct 30 11:53:20 2023 daemon.notice netifd: radio2 (8233): WARNING: Variable 'data' does not exist or is not an array/object
Mon Oct 30 11:53:20 2023 daemon.err hostapd: Failed to create interface phy2-ap0-vlan3: -95 (Not supported)
Mon Oct 30 11:53:20 2023 daemon.err hostapd: VLAN: Could not add VLAN phy2-ap0-vlan3: No such device
Mon Oct 30 11:53:20 2023 daemon.err hostapd: VLAN initialization failed.
Guessing ipq8074 is using an ath11k device, and that driver does not support the needed config (again guessing, that would be AP/VLAN), check iw phy on devices that do and do not work.
If it is AP/VLAN, this sadly seems pretty typical of Qualcomm: There is a reviewed patch that was not followed up:
