# Mini tutorial for DSA network config **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [May 19, 2021, 12:13pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998 "2021-05-19T12:13:28Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![rmilecki](https://forum.openwrt.org/letter_avatar/rmilecki/32/5_5575768a8748004e209b776fc1b2916d.png) [@rmilecki](https://forum.openwrt.org/u/rmilecki)\ **Post date:** [May 19, 2021, 12:13pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/1 "2021-05-19T12:13:28Z")
Update from 2021-05-31: - Option `ifname` was renamed to `device` - This tutorial is valid for 21.02-rc2 (or newer) and recent snapshots **Introduction** DSA stands for Distributed Switch Architecture and is Linux kernel subsystem for network switches. It's an upstream replacement for OpenWrt's swconfig framework and many new routers use DSA drivers instead of swconfig drivers. In DSA each switch port is a separated Linux interface. It means `ip` / `ifconfig` command will show interfaces like `lan1`, `lan2`, `wan`, etc. DSA switch ports can be used as standalone interfaces (common solution for WAN) or can be bridged using Linux bridge interface. In the later case switch will still be able to route traffic on the hardware level so it won't affect performance. Each port can be part of maximum of one bridge only. **Simple ports bridging** In the simplest scenario switch ports are simply bridged using Linux bridge interface and OpenWrt configures that interface with an IP protocol. In such case all devices connected to bridged ports can communicate each other and router itself. Example: ![01-device](https://forum.openwrt.org/uploads/default/original/3X/8/b/8b42ef2bccca4b95252f5d890bcc47a311b25b5e.png) ``` config device option name 'br-lan' option type 'bridge' list ports 'lan1' list ports 'lan2' list ports 'lan3' list ports 'lan4' ``` ![01-interface](https://forum.openwrt.org/uploads/default/original/3X/a/f/af62286787a2a476ca243a3f07920d9a66cd9b7c.png) ``` config interface 'lan' option device 'br-lan' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' ``` **Multiple networks (using bridges)** A switch can be setup to group selected ports into separated networks by using multiple bridge interfaces. With separated firewall zones devices connected to different port groups won't be able to communicate each other. Example: ![02-device-home](https://forum.openwrt.org/uploads/default/original/3X/2/f/2fed3d7bd2b31169cf42997463b5490e67434416.png) ![02-device-office](https://forum.openwrt.org/uploads/default/original/3X/c/1/c1c7633da7a7158d547ea25d5f1f6b19a5f153a3.png) ``` config device option name 'br-home' option type 'bridge' list ports 'lan1' list ports 'lan2' config device option name 'office' option type 'bridge' list ports 'lan3' list ports 'lan4' ``` ![02-interface-home](https://forum.openwrt.org/uploads/default/original/3X/b/a/baa283f872a5dd28637b0906d3c9fab7aceb5fca.png) ![02-interface-office](https://forum.openwrt.org/uploads/default/original/3X/f/f/ff7773d3ab73fc1f7d53486a5e2b5e726b18cd76.png) ``` config interface 'home' option device 'br-home' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' config interface 'office' option device 'office' option proto 'static' option ipaddr '192.168.13.1' option netmask '255.255.255.0' ``` **Multiple networks (using VLANs)** Ports can also be separated (grouped) using single bridge with multiple VLANs. That requires assigning interfaces to correct software VLANs. Example: ![03-device](https://forum.openwrt.org/uploads/default/original/3X/f/d/fd45acec927cc33887759fd26aa9325ac2762953.png) ``` config device option name 'br-lan' option type 'bridge' list ports 'lan1' list ports 'lan2' list ports 'lan3' list ports 'lan4' config bridge-vlan option device 'br-lan' option vlan '1' list ports 'lan1' list ports 'lan2' config bridge-vlan option device 'br-lan' option vlan '2' list ports 'lan3' list ports 'lan4' ``` ![03-interface-home](https://forum.openwrt.org/uploads/default/original/3X/d/d/dd3b40953e731b5d2a1419f00265590bbeea5d94.png) ![03-interface-office](https://forum.openwrt.org/uploads/default/original/3X/8/0/806813a7a986a3632d57147359151ebfd7611545.png) ``` config interface 'home' option device 'br-lan.1' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' config interface 'office' option device 'br-lan.2' option proto 'static' option ipaddr '192.168.13.1' option netmask '255.255.255.0' ``` **VLAN tagged traffic** With proper bridge VLAN configuration it's also possible for selected port to use VLAN tagged traffic. It also requires assigning OpenWrt interface to the correct software VLAN. Example: Port `lan4` uses tagged packets for VLAN 1 and has PVID 2. ![04-device](https://forum.openwrt.org/uploads/default/original/3X/3/1/3103b15dda0b8a8094277de5c7f881ed3abcff95.png) ``` config device option name 'br-lan' option type 'bridge' list ports 'lan1' list ports 'lan2' list ports 'lan3' list ports 'lan4' config bridge-vlan option device 'br-lan' option vlan '1' list ports 'lan1' list ports 'lan2' list ports 'lan3' list ports 'lan4:t' config bridge-vlan option device 'br-lan' option vlan '2' list ports 'lan4:u*' ``` ![04-interface](https://forum.openwrt.org/uploads/default/original/3X/e/2/e27e078a6dd57ed7fc031e99bc625ba1ad0fc822.png) ``` config interface 'lan' option device 'br-lan.1' option proto 'static' option ipaddr '192.168.1.1' option netmask '255.255.255.0' ``` ---
**Author:** ![rsalvaterra](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rsalvaterra/32/15424_2.png) [@rsalvaterra](https://forum.openwrt.org/u/rsalvaterra)\ **Post date:** [May 19, 2021, 1:21pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/2 "2021-05-19T13:21:07Z")
Outstanding guide, thanks, @rmilecki! Like I said on IRC, the only thing missing is how to specify a PVID. Add that, and it will be perfect! 😉 ---
**Author:** ![cesarvog](https://forum.openwrt.org/user_avatar/forum.openwrt.org/cesarvog/32/39892_2.png) [@cesarvog](https://forum.openwrt.org/u/cesarvog)\ **Post date:** [May 19, 2021, 1:56pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/3 "2021-05-19T13:56:46Z")
Excelent Guide. Thanks for taking the time to share this with us non-developers. It makes everything much, much clearer. ---
**Author:** ![Borromini](https://forum.openwrt.org/letter_avatar/borromini/32/5_5575768a8748004e209b776fc1b2916d.png) [@Borromini](https://forum.openwrt.org/u/Borromini)\ **Post date:** [May 19, 2021, 1:59pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/4 "2021-05-19T13:59:43Z")
Thanks a lot for your time and code @rmilecki ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [May 19, 2021, 8:41pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/5 "2021-05-19T20:41:03Z")
Would be well worth including it in the wiki! ---
**Author:** ![anomeome](https://forum.openwrt.org/user_avatar/forum.openwrt.org/anomeome/32/15002_2.png) [@anomeome](https://forum.openwrt.org/u/anomeome)\ **Post date:** [May 19, 2021, 8:44pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/6 "2021-05-19T20:44:48Z")
For the CLI orientated, [patch](https://patchwork.ozlabs.org/project/openwrt/patch/20201230220637.525822-1-me@irrelefant.net/) is a useful addition to ones build. ---
**Author:** ![flygarn12](https://forum.openwrt.org/user_avatar/forum.openwrt.org/flygarn12/32/57396_2.png) [@flygarn12](https://forum.openwrt.org/u/flygarn12)\ **Post date:** [May 19, 2021, 9:12pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/7 "2021-05-19T21:12:03Z")
Maybe this should be pinned at the top regarding the high pressure of never ending DSA questions in the forum right now, at least pinned at the top until the user guide get updated. If it’s not pinned it will just be buried down in the forum stream. ---
**Author:** ![tmomas](https://forum.openwrt.org/letter_avatar/tmomas/32/5_5575768a8748004e209b776fc1b2916d.png) [@tmomas](https://forum.openwrt.org/u/tmomas)\ **Post date:** [May 19, 2021, 9:44pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/8 "2021-05-19T21:44:19Z")
---
**Author:** ![Sylvan](https://forum.openwrt.org/letter_avatar/sylvan/32/5_5575768a8748004e209b776fc1b2916d.png) [@Sylvan](https://forum.openwrt.org/u/Sylvan)\ **Post date:** [May 20, 2021, 4:00am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/9 "2021-05-20T04:00:04Z")
Do I really need to create an extra bridge device myself? So far I have entered the ports directly at the interface and as I understood it, a corresponding bridge is automatically created: ```apache config interface 'lan' [...] option ifname 'lan1 lan2 wan' option type 'bridge' config interface 'office' [...] option ifname 'lan1.3 lan2.3 wan.3' option type 'bridge' ``` Everything seems to work as it should in my case - untagged ends up in lan and everything with VLAN ID 3 ends up in office. Is there a problem if I configure it this way? ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [May 20, 2021, 4:18am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/10 "2021-05-20T04:18:26Z")
Hmm.... I think that this guide is currently only right for master, but not for the forthcoming 21.02 release, right? Your brand new port / bridge device related config changes have not been backported to 21.02. If I have understood the situation right, you might clearly specify in your message that to which branches this guide applies. Ps. And as 21.02 does not know about the new config syntax, it will be impossible to downgrade from up-to-date master to a 21.02 build is DSA if used, right? ---
**Author:** ![flygarn12](https://forum.openwrt.org/user_avatar/forum.openwrt.org/flygarn12/32/57396_2.png) [@flygarn12](https://forum.openwrt.org/u/flygarn12)\ **Post date:** [May 20, 2021, 4:38am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/11 "2021-05-20T04:38:21Z")
21.02 has full DSA support if your device has DSA support. But 21.02 doesn’t have LUCI DSA config support. But there are no problem moving config files from master snapshot back and forth to 21.02 (done that my self). The problem is actually going back to 19.07 if you have installed 21.02. ---
**Author:** ![Sylvan](https://forum.openwrt.org/letter_avatar/sylvan/32/5_5575768a8748004e209b776fc1b2916d.png) [@Sylvan](https://forum.openwrt.org/u/Sylvan)\ **Post date:** [May 20, 2021, 4:38am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/12 "2021-05-20T04:38:49Z")
I have my config running on 21.02 rc1. So you mean in future releases I can no longer use this but must configure it as in the tutorial here? - I hope not.... ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [May 20, 2021, 4:45am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/13 "2021-05-20T04:45:35Z")
> [@flygarn12](#): > > But there are no problem moving config files from master snapshot back and forth to 21.02 (done that my self After yesterday's config changes in master? Really? (It has worked earlier, sure. But I doubt that it works from the current master f716c30241 or later) ---
**Author:** ![rmilecki](https://forum.openwrt.org/letter_avatar/rmilecki/32/5_5575768a8748004e209b776fc1b2916d.png) [@rmilecki](https://forum.openwrt.org/u/rmilecki)\ **Post date:** [May 20, 2021, 5:21am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/14 "2021-05-20T05:21:29Z")
> [@Sylvan](#): > > Do I really need to create an extra bridge device myself? > So far I have entered the ports directly at the interface and as I understood it, a corresponding bridge is automatically created: Yes. UCI sections `interface` are meant for layer 3 configuration. Bridge works in layer 2 and should use UCI section `device`. What you are using is legacy (deprecated) syntax that the recent LuCI doesn't support anymore and is planned to be dropped at some point. Related commits: - [base-files: generate "device" UCI type section for bridge](https://git.openwrt.org/?p=openwrt/openwrt.git;a=commitdiff;h=43fc720657c6e3b30c6ed89d7227ee6e646c158b) - [luci-mod-network: drop support for _adding_ legacy bridges](https://git.openwrt.org/?p=project/luci.git;a=commitdiff;h=b7f3cf66cadf6753153bc9d1feac1eca0c7e37f0) - [luci-mod-network: drop support for _editing_ legacy bridges](https://git.openwrt.org/?p=project/luci.git;a=commitdiff;h=ec020cee0c44793f8ce1b346675c6a36e63b0154) - [luci-mod-network: use "ports" option for setting bridge ports](https://git.openwrt.org/?p=project/luci.git;a=commitdiff;h=a90115cd82372eaaa0ed531800b568387e200c97) Patch that will switch all old syntax users at some point: [[PATCH] base-files: migrate old UCI network sections defining bridges](https://patchwork.ozlabs.org/project/openwrt/patch/20210518214133.6622-1-zajec5@gmail.com/) ---
**Author:** ![rmilecki](https://forum.openwrt.org/letter_avatar/rmilecki/32/5_5575768a8748004e209b776fc1b2916d.png) [@rmilecki](https://forum.openwrt.org/u/rmilecki)\ **Post date:** [May 20, 2021, 5:23am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/15 "2021-05-20T05:23:38Z")
> [@tmomas](#): > > Would be well worth including it in the wiki! Absolutely. It was just easier for me to sit down and write quickly this tutorial without integrating it into existing wiki content. I'll work on that later. ---
**Author:** ![alexrebell](https://forum.openwrt.org/letter_avatar/alexrebell/32/5_5575768a8748004e209b776fc1b2916d.png) [@alexrebell](https://forum.openwrt.org/u/alexrebell)\ **Post date:** [May 20, 2021, 7:25am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/16 "2021-05-20T07:25:24Z")
Tell me, please, and how to make the bridge between the local and wireless interface now? Thank you ---
**Author:** ![Sylvan](https://forum.openwrt.org/letter_avatar/sylvan/32/5_5575768a8748004e209b776fc1b2916d.png) [@Sylvan](https://forum.openwrt.org/u/Sylvan)\ **Post date:** [May 20, 2021, 8:34am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/17 "2021-05-20T08:34:09Z")
> [@rmilecki](#): > > What you are using is legacy (deprecated) syntax that the recent LuCI doesn't support anymore and is planned to be dropped at some point. Nice trick: Make the file configuration much more cumbersome than before to push people towards LUci. 😅 But of course - I can understand the reasoning behind it - I still found the previous solution pretty smart and now it sadly becomes significantly more cumbersome. ---
**Author:** ![Borromini](https://forum.openwrt.org/letter_avatar/borromini/32/5_5575768a8748004e209b776fc1b2916d.png) [@Borromini](https://forum.openwrt.org/u/Borromini)\ **Post date:** [May 20, 2021, 8:53am UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/18 "2021-05-20T08:53:48Z")
DSA already greatly complicated UCI configuration so I'm happy people decided to sanitise and document it. ---
**Author:** ![rsalvaterra](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rsalvaterra/32/15424_2.png) [@rsalvaterra](https://forum.openwrt.org/u/rsalvaterra)\ **Post date:** [May 20, 2021, 1:23pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/19 "2021-05-20T13:23:29Z")
> [@Sylvan](#): > > Make the file configuration much more cumbersome than before to push people towards LUci. Why? Cumbersome is to mix both L2 and L3 configuration. It doesn't make sense, they're independent layers and should be treated as such. The new DSA configuration in UCI is, in fact, a lot similar in intent to the old `swconfig`, with a more explicit structure. The extra verboseness makes it largely self-documenting (the exception being the PVID configuration which, granted, is rather cryptic). ---
**Author:** ![Sylvan](https://forum.openwrt.org/letter_avatar/sylvan/32/5_5575768a8748004e209b776fc1b2916d.png) [@Sylvan](https://forum.openwrt.org/u/Sylvan)\ **Post date:** [May 20, 2021, 3:37pm UTC](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998/20 "2021-05-20T15:37:11Z")
Yes - for my sake, this corresponds to pure doctrine. In my practice, however, the configuration of a new network is always a combination of L2 and L3. And even if I am always aware that I am working on several layers of a theoretical concept at the same time, I have no noticeable disadvantage when I do this combined in one place. What is the bad consequence if I also set layer2 settings in the interface section? 9 additional lines with named links to other places in the configuration file with completely the same final result do not promote clarity for me. A solution which respects the layer concept and could be configured similarly elegantly as the past ifname solution would have been dearer to me simply than the construct which was presented here. And yes - the concept is quite clear to me - but so was the previous one. But I am neither a network expert nor an active developer - this is just the view of a normal end user. So consider my limited knowledge and inability to fully assess the consequences of such a decision. I therefore plead for nothing and ask no one to reconsider the concept - I only regret that the solution, which has been elegant for me so far, is to be abolished. [Next page](https://forum.openwrt.org/t/mini-tutorial-for-dsa-network-config/96998.md?page=2)