Individual per-passphrase/per-MAC Wifi VLANs and DSA

pluffmud · February 7, 2026, 2:29pm

I am starting a new thread since the original ‘Individual per-passphrase/per-MAC Wifi VLANs’ is all most 3 years long and my question pertains to DSA .

It all most works . The closest I can get is the client (phone) says ‘cant opbtain ip address’ .

I think the issue is the “option network ‘something here’” entry in the wireless config for the SSID

I dont understand what the ‘something here’ needs to be .

If I use ‘lan’ I get the ‘cant opbtain ip address’ .

If I point it to the interface using ‘bt-lan.1’ I get logged in but all ways get put on vlan 1

For what its worth I managed to get this working on my other ap which is still ‘switch’ based

Here is my setup

ubus call system board

{
"kernel": "6.6.93",
"hostname": "ollie",
"system": "MediaTek MT7621 ver:1 eco:3",
"model": "TP-Link EAP615-Wall v1",
"board_name": "tplink,eap615-wall-v1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.2",
"revision": "r28739-d9340319c6",
"target": "ramips/mt7621",
"description": "OpenWrt 24.10.2 r28739-d9340319c6",
"builddate": "1750711236"
}
}

cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd8d:f8c3:0d4c::/48'
option packet_steering '1'
option steering_flows '128'

config device
option name 'br-lan'
option type 'bridge'
option acceptlocal '1'
list ports 'lan0'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'

config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan0:t'
list ports 'lan1:t'
list ports 'lan2'

config interface 'vlan1'
option device 'br-lan.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '10.10.10.4'
option gateway '10.10.10.1'
list dns '10.10.10.1'

config device
option name 'eth0'
option acceptlocal '1'

config bridge-vlan
option device 'br-lan'
option vlan '3'
list ports 'lan0:t'

config interface 'vlan3'
option proto 'none'
option device 'br-lan.3'

config device
option name 'br-lan.3'
option type '8021q'
option ifname 'br-lan'
option vid '3'
option ipv6 '0'

config bridge-vlan
option device 'br-lan'
option vlan '7'
list ports 'lan0:t'

config device
option name 'br-lan.7'
option type '8021q'
option ifname 'br-lan'
option vid '7'

config interface 'vlan7'
option proto 'none'
option device 'br-lan.7'

config bridge-vlan
option device 'br-lan'
option vlan '5'
list ports 'lan0:t'
list ports 'lan1:t'
list ports 'lan2:t'

config bridge-vlan
option device 'br-lan'
option vlan '50'
list ports 'lan0'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'

config interface 'vlan50'
option proto 'static'
option device 'br-lan.50'
option ipaddr '10.10.50.4'
option netmask '255.255.255.0'

config interface 'lan'
option proto 'dhcp'
option device 'br-lan'

cat /etc/config/dhcp

config dnsmasq
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option expandhosts '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list rebind_domain 'evinrude.net'

config dhcp 'vlan1'
option interface 'vlan1'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option ignore '1'
option dynamicdhcp '0'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'

config dhcp 'vlan3'
option interface 'vlan3'
option start '100'
option limit '150'
option leasetime '12h'
option ignore '1'

config dhcp 'vlan7'
option interface 'vlan7'
option start '100'
option limit '150'
option leasetime '12h'
option ignore '1'

config dhcp 'vlan50'
option interface 'vlan50'
option start '100'
option limit '150'
option leasetime '12h'
option ignore '1'
option dynamicdhcp '0'

config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option ignore '1'

cat /etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
option band '2g'
option cell_density '0'
option country 'US'
option htmode 'HT20'
option channel 'auto'

config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0+1'
option band '5g'
option htmode 'HE80'
option country 'US'
option cell_density '0'
option channel '161'

config wifi-iface 'default_radio1'
option device 'radio1'
option mode 'ap'
option ssid 'ollie5'
option network 'lan'
option encryption 'psk2'
option dynamic_vlan '1'
option vlan_naming '1'
option vlan_bridge 'br-lan'
option vlan_tagged_interface 'wifi5'
option wpa_psk_file '/etc/hostapd.wpa_psk'
option vlan_file '/etc/hostapd-5.vlan'

config wifi-iface 'default_radio0'
option device 'radio0'
option mode 'ap'
option ssid 'ollie24'
option network 'lan'
option encryption 'psk2'
option dynamic_vlan '1'
option vlan_naming '1'
option vlan_bridge 'br-lan'
option vlan_tagged_interface 'wifi24'
option wpa_psk_file '/etc/hostapd.wpa_psk'
option vlan_file '/etc/hostapd-24.vlan'

cat /etc/hostapd-24.vlan

1 dyn24.1
3 dyn24.3
7 dyn24.7

cat /etc/hostapd-5.vlan

1 dyn5.1
3 dyn5.3
7 dyn5.7

cat /etc/hostapd.wpa_psk

vlanid=1 00:00:00:00:00:00 ***
vlanid=3 00:00:00:00:00:00 ****
vlanid=7 00:00:00:00:00:00 *****

brctl show

bridge name bridge id STP enabled interfaces
br-lan7 8000.2887ba2334c2 no dyn5.7
dyn24.7
br-lan3 8000.2887ba2334c2 no dyn24.3
dyn5.3
br-lan1 8000.2887ba2334c2 no dyn24.1
dyn5.1
br-lan 7fff.2887ba2334c2 no lan2
lan0
phy0-ap0
lan3
phy1-ap0
lan1

psherman · February 7, 2026, 7:07pm

Let's start with the following:

This appears to be an AP, not the main router. Is that correct?
What is the desired port-VLAN membership (in other words, what port is used as the uplink, and what VLAN(s) do you want on the other ports?
What is the uplink port connected to? (i.e. a switch or the main router itself? If a switch, is it managed? And if so, have you verified the configuration?)

Also, can you please repost your configs... right now it's difficult to read and will be hard to copy/quote when recommending fixes because the formatting isn't quite right... specifically, you may need to switch into the 'markdown' mode for posting this properly:

Please use the "Preformatted text </>" button for logs, scripts, configs and general console output (red circle; this works best in the 'Markdown' composer view in the blue oval):

pluffmud · February 7, 2026, 9:06pm

Sorry . Yes its an AP connected to a Ubiquiti EdgeRouter X running openwrt .

The 2 devices are connected vi ‘lan0’ .

The 3 vlan id’s are 1,3 and 7 .

Every things works fine when using 1 SSID per vlan .

Here are the configs again .