Individual per-passphrase Wifi VLANs using wpa_psk_file (no RADIUS required)

Hello everyone,

So I managed to get this feature working on my TP-Link EAP615v1 AP. However there seems to be an issue with AirPlay to my Apple devices when using this feature on my Netgear R7800 when setup as a Dumb AP per the OpenWRT article. I have a thread opened here detailing the issue but here is a quick rundown, maybe someone can shed a little light....

I have my R7800 configured with DPSK but AirPlay doesn't work between my Apple TV and my iPhone. The R7800 has (2) separate SSIDs, the 2.4GHz radio is for devices like phones/laptops and such. the 5GHz radio streaming devices like my Apple TV (bigger pipe since they are not hardwired yet). I have (3) VLANs...LAN (VLAN1, mainly for wired devices like servers), WLAN (VLAN20 for laptops, mobile devices, etc), and Guest-WLAN (VLAN21, segregated for guest devices).

When I have my Apple devices (TV,iPhone) connected to VLAN1, AirPlay works fine. When I have it connected to VLAN20 AirPlay doesn't work. Apple devices do not show. This happens regardless of whether the devices are on the same radio or different radios. The devices are getting the same subnet IP addresses, so I'm confused as to what could be the issue.

If anyone can give some insight, that would be great. The latest configuration for my R7800 can been seen below. NOTE that DHCP, DNS, and Firewall services have been disabled per the Dumb AP article.

root@R7800:~# ubus call system board
{
        "kernel": "5.15.137",
        "hostname": "R7800",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Netgear Nighthawk X4S R7800",
        "board_name": "netgear,r7800",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.2",
                "revision": "r23630-842932a63d",
                "target": "ipq806x/generic",
                "description": "OpenWrt 23.05.2 r23630-842932a63d"
        }
}
root@R7800:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd60:c227:0684::/48'
        option packet_steering '1'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 6t'

config switch_vlan
        option device 'switch0'
        option vlan '20'
        option ports '4t 6t'

config switch_vlan
        option device 'switch0'
        option vlan '21'
        option ports '4t 6t'

config device
        option type 'bridge'
        option name 'br-vlan1'
        list ports 'eth1.1'

config device
        option type 'bridge'
        option name 'br-vlan20'
        list ports 'eth1.20'

config device
        option type 'bridge'
        option name 'br-vlan21'
        list ports 'eth1.21'

config interface 'vlan1'
        option device 'br-vlan1'
        option proto 'static'
        option ipaddr '192.168.50.200'
        option netmask '255.255.255.0'
        option gateway '192.168.50.1'
        list dns '192.168.50.1'

config interface 'vlan20'
        option proto 'none'
        option device 'br-vlan20'

config interface 'vlan21'
        option proto 'none'
        option device 'br-vlan21'
root@R7800:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT160'
        option cell_density '0'
        option country 'US'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'vlan1'
        option mode 'ap'
        option ssid 'SSID1'
        option encryption 'psk2'
        option key '********'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
        option channel '2'
        option band '2g'
        option htmode 'HT40'
        option cell_density '0'
        option country 'US'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'vlan1'
        option mode 'ap'
        option ssid 'SSID2'
        option encryption 'psk2'
        option key '*********'

config wifi-vlan
        option name 'vl20'
        option network 'vlan20'
        option vid '20'

config wifi-station
        option key '********'
        option vid '20'

config wifi-vlan
        option name 'vl21'
        option network 'vlan21'
        option vid '21'

config wifi-station
        option key '*********'
        option vid '21'
root@R7800:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
root@R7800:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'