# Managed Switch or OpenWrt? **URL:** \ **Category:** Hardware Questions and Recommendations\ **Created:** [November 17, 2021, 3:49am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165 "2021-11-17T03:49:58Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 17, 2021, 3:49am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/1 "2021-11-17T03:49:58Z")
I do not have control over my router. I want to seggregate my traffic with vlans. Do I need to buy a managed switch or can I use an OpenWrt router? The ISP router is a blackbox. Will it knows my managed switch/OpenWrt router vlans? What's the best way? ---
**Author:** ![slh](https://forum.openwrt.org/user_avatar/forum.openwrt.org/slh/32/113591_2.png) [@slh](https://forum.openwrt.org/u/slh)\ **Post date:** [November 17, 2021, 3:52am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/2 "2021-11-17T03:52:20Z")
You'll need a router, to do the network segmenting (into VLANs) and do the routing between the different VLANs on L3, switches work on L2. ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 17, 2021, 3:53am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/3 "2021-11-17T03:53:54Z")
ISP \> OpenWrt router \> switch? will that have double NAT? ---
**Author:** ![slh](https://forum.openwrt.org/user_avatar/forum.openwrt.org/slh/32/113591_2.png) [@slh](https://forum.openwrt.org/u/slh)\ **Post date:** [November 17, 2021, 3:56am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/4 "2021-11-17T03:56:27Z")
Not necessarily, if your ISP router allows you to configure static routes, you can disable masquerading (NAT) on the router. ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 17, 2021, 3:57am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/5 "2021-11-17T03:57:25Z")
The thing is I don't have control over the ISP router...otherwise I would just use OpenWrt and be done with it. ---
**Author:** ![eduperez](https://forum.openwrt.org/user_avatar/forum.openwrt.org/eduperez/32/2066_2.png) [@eduperez](https://forum.openwrt.org/u/eduperez)\ **Post date:** [November 18, 2021, 7:50am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/6 "2021-11-18T07:50:59Z")
If your OpenWrt router has enough LAN ports, you will not need the managed switch. ---
**Author:** ![bobafetthotmail](https://forum.openwrt.org/user_avatar/forum.openwrt.org/bobafetthotmail/32/39_2.png) [@bobafetthotmail](https://forum.openwrt.org/u/bobafetthotmail)\ **Post date:** [November 18, 2021, 11:03am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/7 "2021-11-18T11:03:04Z")
> [@systemfriendly](#): > > I want to seggregate my traffic with vlans. > > The ISP router is a blackbox. > > Will it knows my managed switch/OpenWrt router vlans? Devices that see the VLAN need to be configured to understand VLAN traffic so you cannot connect a VLAN trunk port directly to the ISP router. If you segregate traffic with VLANs then you have at least 2 subnets, (one per VLAN) so for example 192.168.1.0 and 192.168.2.0. It is useless to run the same subnet on multiple VLANs as all devices will still be able to talk to each other through the port connected to the ISP router. So if you have no access to ISP router you have to get a OpenWrt router that will NAT all the subnets you want to make with VLANs into the single subnet that the ISP router understands. And an additional switch if you need more ports. Yes this is double NAT if you cannot touch the ISP router. It should be OK for most web application use but can be an issue with some games or special applications. Some ISPs will do the configurations on the ISP router if you ask through the customer support tickets. Most ISPs with cable in US usually have remote control access to the device. ---
**Author:** ![drbrains](https://forum.openwrt.org/user_avatar/forum.openwrt.org/drbrains/32/55252_2.png) [@drbrains](https://forum.openwrt.org/u/drbrains)\ **Post date:** [November 18, 2021, 11:09am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/8 "2021-11-18T11:09:23Z")
Can you or customer support set the ISP router in bridge mode? This should solve a lot of your problems and you can run your own (OpenWrt) router behind it. ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 19, 2021, 2:57am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/9 "2021-11-19T02:57:46Z")
Will that be ok for IRC, P2P games, UPnP and alike? I will try that. Thank you for your informative answer. ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 19, 2021, 2:58am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/10 "2021-11-19T02:58:13Z")
How about a L3 switch? ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 19, 2021, 2:58am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/11 "2021-11-19T02:58:45Z")
Bridge mode is not ideal for me. ---
**Author:** ![drbrains](https://forum.openwrt.org/user_avatar/forum.openwrt.org/drbrains/32/55252_2.png) [@drbrains](https://forum.openwrt.org/u/drbrains)\ **Post date:** [November 19, 2021, 3:04am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/12 "2021-11-19T03:04:40Z")
I don't understand? Ideal would be to replace the ISP device, which in a lot of cases can't be done. The alternative to bridge mode is double NAT as mentioned by @bobafetthotmail which I would consider less ideal. But based on "not ideal" it does suggest that you would be able to do it. ---
**Author:** ![slh](https://forum.openwrt.org/user_avatar/forum.openwrt.org/slh/32/113591_2.png) [@slh](https://forum.openwrt.org/u/slh)\ **Post date:** [November 19, 2021, 3:13am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/13 "2021-11-19T03:13:57Z")
> [@systemfriendly](#): > > How about a L3 switch? A L3 managed switch is just a switch with limited routing capabilities beyond mere switching, but the situation is still the same as with a 'normal' router. Either you can set a static route on your ISP router `XOR` you have to do masquerading (and end up with double-NAT). ---
**Author:** ![psherman](https://forum.openwrt.org/letter_avatar/psherman/32/5_5575768a8748004e209b776fc1b2916d.png) [@psherman](https://forum.openwrt.org/u/psherman)\ **Post date:** [November 19, 2021, 4:12am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/14 "2021-11-19T04:12:16Z")
There is one other option... use a setup similar to the [dumbAP + guest network](https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guestwifi_dumbap) route. Your additional VLANs would still be double-NAT'd, but you would still be able to have one of the networks only behind the single NAT layer (of the ISP's router). ---
**Author:** ![bobafetthotmail](https://forum.openwrt.org/user_avatar/forum.openwrt.org/bobafetthotmail/32/39_2.png) [@bobafetthotmail](https://forum.openwrt.org/u/bobafetthotmail)\ **Post date:** [November 19, 2021, 8:29pm UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/15 "2021-11-19T20:29:40Z")
any service that relies on UPnP or opening ports on the router will not work (as it requires a port forwarding in the ISP router that is not accessible). A lot of modern applications are designed with this limit in mind, but I don't know about games or consoles, afaik they still may need you to open ports or use UPnP on the router. > [@systemfriendly](#): > > How about a L3 switch? That's a router, same issues. > [@systemfriendly](#): > > Bridge mode is not ideal for me. It would be ideal if the ISP router could be put in bridge mode actually, that usually means it disables its firewall and will just "passthrough" the IP of its own WAN interface to the WAN interface of your router, so you are not doing double NAT anymore. This is something you can ask the customer support of your ISP. > **[Bridge mode](https://openwrt.org/docs/guide-user/network/wan/bridge-mode)** > > Bridge mode See also: Bridge firewall This method relies on switching the current modem-router in bridge mode, or by buying a Ethernet modem that supports this mode. Bridge mode is a special mode of operation where the current gateway/modem acts as... ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 24, 2021, 2:29am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/16 "2021-11-24T02:29:55Z")
I managed to get a netgear router working instead of my ISP. How can I make 3 ethernet ports working with regular ethernet without vlans tags and just 1 with 1 vlan tag? it's a 5 port router. ---
**Author:** ![eginnc](https://forum.openwrt.org/letter_avatar/eginnc/32/5_5575768a8748004e209b776fc1b2916d.png) [@eginnc](https://forum.openwrt.org/u/eginnc)\ **Post date:** [November 24, 2021, 3:30am UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/17 "2021-11-24T03:30:01Z")
> [@systemfriendly](#): > > I managed to get a netgear router working instead of my ISP. Does this mean the netgear router is now connected to the ISP router in bridge mode, or the netgear router is connected to a modem only device, or something else? Also, the instructions to do what you want are a little different depending on whether your netgear OpenWrt router has been converted to DSA or is still using swconfig. What model netgear router are you using, and what version of OpenWrt is installed on it? ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 26, 2021, 12:02pm UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/18 "2021-11-26T12:02:38Z")
Sorry for the delay. It is connected to a modem only I was told. It is a Netgear R6800 and I just installed OpenWRT [21.02.1] and left stock for now. ---
**Author:** ![eginnc](https://forum.openwrt.org/letter_avatar/eginnc/32/5_5575768a8748004e209b776fc1b2916d.png) [@eginnc](https://forum.openwrt.org/u/eginnc)\ **Post date:** [November 27, 2021, 12:56pm UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/19 "2021-11-27T12:56:09Z")
Your R6800 is a MT7621 device. This ramips target has been converted to DSA. Instructions for setting up VLANs with DSA are found here: [https://openwrt.org/docs/guide-user/network/dsa/start](https://openwrt.org/docs/guide-user/network/dsa/start) There is also quite a bit of good information and discussion in this thread: [mini-tutorial-for-dsa-network-config](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998) This information covers what you would like to do and is also good general knowledge for expanding or changing your network in the future. ---
**Author:** ![systemfriendly](https://forum.openwrt.org/letter_avatar/systemfriendly/32/5_5575768a8748004e209b776fc1b2916d.png) [@systemfriendly](https://forum.openwrt.org/u/systemfriendly)\ **Post date:** [November 28, 2021, 6:20pm UTC](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165/20 "2021-11-28T18:20:58Z")
Maybe I'm dumb but shouldn't be br-lan.4 if you wanted VLAN tagged traffic on the example above? Also since I just need one port using tagged VLANs I think using one port for br-home and all others to office should suffice? is it possible to assign just one port to one and the rest to the other(home and office)? [Next page](https://forum.openwrt.org/t/managed-switch-or-openwrt/112165.md?page=2)