I am trying to setup a segmented network using my router with openWRT
I need 4 networks
one for my homelab
one for my IOT
one for my main network
one for Guests
I will soon be moving to a pfsense router and just using the openwrt box as an accesspoint
I need each of the networks to have their own wireless ssid's
the wan port will be a trunk to the pfsense when I get that but for now a normal wan
I need two lan ports untagged on the main network vlan
I dont need firewall rules for the networks, I will do that in pfsense when that arrives
I just need the ssid's and networks and vlans
I tried to go to the interfaces tab and add an interface for each one and set them to the lan firewall and enable dhcp
but when I did that I lost all network access anywhere except lan
any ideas how to do this?
get four different access points, that way it will work.
wifi and vlans don't work together
Start by defining the wireless guest networks, and forget about the VLANs by now.
Unless utilising a radius backend or having a switch that features a Wlan port 802.1q tag management is not possible with Wlan.
However as mentioned 
When you bridge non-VLAN and VLAN interfaces together, the system takes care about adding VLAN ID when sending packet from non-VLAN to VLAN interface, and it automatically removes the VLAN ID when sending packet from VLAN interface to non-VLAN one.
This is an extension of a dumb AP configuration. Get the single network AP working first then add more.
A dumb AP has only one network, the lan, and no firewall. It has an IP address on the lan so that you can log in to administer it.
This remains true as you add some dumb bridged guest networks. The guest networks should be bridges with protocol
none (or Unmanaged in the GUI). They bridge from a wired interface e.g. eth0.10 to a wireless AP. That is the kernel's only interaction with those packets. Since the kernel holds no IP address on these interfaces, it is inherently impossible for guests to hack into the OS. There is no need for a firewall.
Set up the switch with one tagged external port and some untagged. Tagged ports only work if the device on the other end of the cable is also configured for VLANs. Until you have that you can use the untagged ports as part of the LAN.
OP wants to use VLANs for trunking on WAN and creating separated LAN ports, he does not need to use VLANs on the WLAN.
I hope this will help. This is on a Ubiquiti AC Pro running OpenWrt 21.02.1.
This worked for me, but I'm no expert, so if something I
say contradicts the official documentation, then I'm wrong
and I apologize.
Setup: the Ubiquiti AC Pro's main ethernet port is plugged
into one of my router's interfaces (call the router interface
vio0 with IP 192.168.1.254/24). The router has interface vlan0
configured with vlan id 4, and vio0 as the parent interface.
The IP for the router's vlan0 is 192.168.4.254/24.
This way we haven't changed the OpenWrt device's default
lan IP of 192.168.1.1/24.
Just to be clear, the OpenWrt's device's LAN is on the same
network as the router's physical vio0 interface, and the
OpenWrt's devices VLAN that we create below will be on
the same network as the router's vlan0 interface.
To add more VLANs, we could create vlan1, vlan2, etc
on the router, and corresponding VLANs on the OpenWrt
The rest of the steps are all on the OpenWrt device:
Add vlan device
network -> interfaces
add device from devices tab
device type vlan 802.1q
base device eth0
choose vlan id e.g. 4 but using X below in the rest of
Add bridge device
siill in devies, do another Add device configuration
device type bridge
bridge port: select Software VLAN: "eth0.X"
Add vlan interface
then on interfaces tab add new interface
protocol static address
device is bridgeX
set the static IP for the access point (e.g. 192.168.4.1/24)
note that dhcp server will be on by default
Save and Apply
In Network->Wireless menu
edit the desired wireless network
Under Device Configuation, Advanced Settings, choose country code
Under Interface Confguration, General Setup
for Network choose vlanX
Save and Apply
port status: X, description switchX, eth0 tagged
and LAN1 tagged.
NOTE: I could access the vlan once eth0 was tagged,
but needed to also have LAN1 tagged to get out to
Also make sure:
port status: 1, description is blank, eth0 tagged
(if not, you won't be able to access the device via
Save and Apply
Enable wireless network