Issue Configuring Bridges with VLANs

Hi there,

I'm trying to distribute a couple of networks around the wired LAN in my house. There will end up being two networks on the LAN, untagged traffic being Network 1 and VLAN 11 traffic being Network 2. I am trying to configure my DSA enabled OpenWRT device to work with both of these networks.

The untagged Network 1 already exists, another router in the house provides DHCP addresses in the range.

The VLAN 11 tagged Network 2 will be served DHCP addresses by my OpenWRT device in the range. It will be NATted to Network 1 (yes, this will result in a double NAT).

The OpenWRT device has WiFi and 3 devices provided by DSA on the 3 port gigabit switch:

I also have two bridges configured:

I finally have the default LAN and WAN interfaces configured to use these bridges. Each interface also has two WiFi networks configured (2.4GHz and 5GHz each) so that I can access both the NATted Network 2 ( and the WAN Network 1 ( through this OpenWRT device on respective WiFI networks:

This setup works perfectly. I am able to access both Network 1 and Network 2 through this OpenWRT device using the respective SSIDs configured for them. However, I wish to also provide access to Network 2 ( through the wan device on VLAN 11, which I have not yet been able to achieve.

I have tried various combinations of bridge devices with VLAN filtering and virtual ethernets for VLAN under 802.11q, without much success. I have tried so many combinations I have unfortunately lost track.

How can I provide access to Network 2 ( via the wan (or maybe br-wan?) device on VLAN 11?


Tagged and untagged on the same cable is not a best practice but here it appears that you are trying to backfeed tagged packets into an unmanaged network consisting of an ISP router and an unmanaged switch. This is also not certain to work depending on how those non-vlan-aware devices handle tagged packets.

If you want to try though, the best way with DSA is to:

  • Put all the eth ports into one single bridge. I usually name it br-eth to distinguish that it is not dedicated to being lan or wan.
  • Establish a bridge-vlan inside br-eth for every VLAN, including those like wan that will not be tagged outside. The choice of VLAN numbers for those is arbitrary, but must be unique within the bridge. The VLANs which you do want to emit / receive tagged Ethernet packets must be numbered according to the tag numbers they are going to use.
  • Designate the external ethernet ports as tagged, untagged, or off in their VLANs.
  • Attach networks to this master bridge with the notation br-eth.N where N is the unique VLAN number, in the Device setting on the network interface.

The critical point is that everything inside br-eth is tagged, including the connections to the higher level kernel networks. Tags may be retained or removed on the external cables.

1 Like

Hi mk24,

Wow, okay, I did not see that being the way to achieve what I wanted, but it worked! Thank you.

For future reference for myself and others who may want to do the same, here is my new configuration:


Interfaces are configured with their own br-wan and br-lan bridges still, to allow WiFi networks to be attached to them.


The following devices are present, consisting of the 3 bridges, 2 VLANs for the br-eth and the 3 ethernet ports:

Bridge br-eth is configured with VLAN 1 being WAN and VLAN 11 being LAN, as so:

This achieves the following:

  • Untagged packets entering device wan are tagged with VLAN 1 (WAN) then enter the bridge
  • Untagged packets entering devices lan1 and lan2 are tagged with VLAN 11 (LAN) then enter the bridge
  • Packets exiting the bridge tagged with VLAN 11 (LAN) leave lan1 and lan2 untagged
  • Packets exiting the bridge tagged with VLAN 11 (LAN) leave wan tagged with VLAN 11 (LAN)
  • Packets exiting the bridge tagged with VLAN 1 (WAN) leave wan untagged

Bridge br-lan is configured as so:

Bridge br-wan is configured as so:

Hope this helps someone else too!

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.