Need help with Archer C7v5 VLANs for bridged AP

maelkoth72 · May 5, 2026, 9:22pm

[Sorry for "hijacking" the thread somewhat, but it seems a very close fit for my question]

I have an Archer C7 v5 and am trying to add VLANs to my network. One goal/idea is to split WiFi into 3 VLANs through 3 ESSID. VLAN and OpenWRT are both new and initial attempts failed horribly

After more learning I finally got things working it seems. Especially above mentioned YT videos by OneMarcFifty were helpful.

However, there is one question bothering me, which fits into this thread: The working setup seems very weird.

The Archer is running "dumb", not as router. The relevant parts relate to the physical WAN port only, while LAN port setup had been merely to as fallback if something goes wrong.

I tried following the "VLANs in OpenWrt 21" by OneMarcFifty (but it did not work).

On Network > Switch I had VLAN 10 (only) and assigned that to the WAN port as "untagged".
I then created a "bridge" device onto that "eth0.10" device with "Bridge VLAN filtering" enabled. In filtering, I had added VLAN 10 and VLAN 11, both with "Local" checked. VLAN 10 configured as "untagged" as well as "primary VLAN" on eth0.10, VLAN 11 as "tagged".
Created 2 interfaces "wired" and "wireless" onto the new "bridge.10" and "bridge.11" devices
Linked the wireless to the "wireless" interface attached to "bridge.11" assidged to VLAN 11 with "tagged"

This is how the mentioned video describes and seems "logical". It did not work however. No connectivity on the WiFi and in fact not even the "wireless interface" itself.

After trial-and-error and testing, I ended up with the working weird setup: I had to

add VLAN 11 on Network -> Switch as "tagged" (on top of the existing "untagged" VLAN 10)
then add that new eth0.11 to the "bridge" device (additionally to the eth0.10)
in "Bridge VLAN filtering":

bridge_filtering628×206 13.2 KB

The interfaces remain assigned to the bridge.10 and bridge.11 devices (not eth0.10 and eth0.11). This seems the only way it works (ie. DHCP from OPNsense reaching WiFi devices through a tagged VLAN 11).
Anything else, like (in VLAN filtering) changing VLAN 11 to "tagged" for eth0.11 or removing the "primary VLAN" there, seems to break things again.

So I seem to have to (ie. the "weird" in the setup)

create the VLAN 11 on Switch as tagged on the WAN port
then merge it with VLAN 10 (eth0.10) in the "bridge" device
then split things again through VLAN filtering
in filtering use untagged on eth0.11 for VLAN 11 (while eth0.11 is using tagged for WAN)

I this all required because there is no DSA support? Am I missing something that overcomplicates things? Does it only "seem to be working" ?

psherman · May 5, 2026, 9:30pm

I've moved your post to a new thread...

let's take a look at your config to make sure it's all correct...

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network

maelkoth72 · May 6, 2026, 6:15am

[Thanks for moving the tthread!]

ubus call system board

{
        "kernel": "6.12.74",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA956X ver 1 rev 0",
        "model": "TP-Link Archer C7 v5",
        "board_name": "tplink,archer-c7-v5",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.2",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r32802-f505120278",
                "target": "ath79/generic",
                "description": "OpenWrt 25.12.2 r32802-f505120278",
                "builddate": "1774469393"
        }
}

cat /etc/config/network

config globals 'globals'
        option dhcp_default_duid '0004af7ff0ff1b124a10ac6365922b6a9008'
        option ula_prefix 'fd26:2dc2:2819::/48'
        option packet_steering '1'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3 4 5'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 2t 3t 4t 5t 1'
        option vid '10'
        option description 'LAN'

config device
        option type 'bridge'
        option name 'bridge'
        list ports 'eth0.10'
        list ports 'eth0.11'

config bridge-vlan
        option device 'bridge'
        option vlan '10'
        list ports 'eth0.10:u*'

config bridge-vlan
        option device 'bridge'
        option vlan '11'
        list ports 'eth0.11:u*'

config interface 'LAN'
        option proto 'static'
        option device 'bridge.10'
        list ipaddr '192.168.2.34/24'
        option gateway '192.168.2.1'
        list dns '192.168.2.1'
        option multipath 'off'
        option delegate '0'
        option dns_metric '100'

config interface 'OLYMP'
        option proto 'static'
        option device 'bridge.11'
        list ipaddr '192.168.11.34/24'
        option multipath 'off'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t 1t'
        option vid '11'
        option description 'trusted_wireless'

I have removed the loopback, device "br-lan" with interface "lan" and it's static 192.168.1.1/24.
Although it should be irrelevant for this, I left the switch_vlan for VLAN ID 1 on LAN ports. It's just 1 port that matters, which is WAN (untagged on VLAN 10, tagged on VLAN11).
Interface 'OLYMP' is linked to the WifI and would be unmanaged. I just had switched it to static to allow debugging.

Thanks for the help upfront!

psherman · May 6, 2026, 6:23am

This config is invalid and has too many errors to correct. The fastest way to solve it is to read to defaults. Set the device up as a bridged ap and then take a look at this post for an idea of how an swconfig device comes together with VLANs.

If you’re having any trouble following the above, let me know where you’re stuck and I’ll help you through it.

Also, for reference, here is the bridged AP guide:

maelkoth72 · May 6, 2026, 8:39am

Your statement about "too many errors to correct" shocked me After checking primarily into the thread you mentioned, it however seems that the difference is not all that huge after all. Anyway...

Important: I am coming from a no-VLAN setup in my house with lots of devices (wired as well as wireless) and numerous VMs and containers on Docker and Proxmox VE. All running on a single 192.168.2.x subnet with a mix of static addresses and (static-)DHCP. So everything on this VLAN-journey had been done with fundamental rule "existing setup must must not be disrupted" while trying to figure out things.

Referring to Pass VLANs from OpenWrt router to OpenWrt AP - #4 by psherman

VLAN 20 there seems to be my intended VLAN 10.
Port 1 there seems Port 1 ("WAN") for me.
And it seems that the software now uses "option vlan" as identifier only and "option vid" defines the VLAN ID.

So

is reflected in my

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 2t 3t 4t 5t 1'
        option vid '10'

Ignoring the currently irrelevant LAN ports (2-5), it is tagging VLAN 10 on the CPU. Difference is the tagging on WAN (port 1).
The rational for this at this point is to "merge" traffic into the existing no-VLAN network. If I would be tagging it, I would need to tag it through the managed switch up to the OPNsense firewall and set up networking there to link it to the existing traffic untagged VLAN 1 traffic . Using untagged for now makes VLAN 10 on the AP essentially the same as VLAN 1 in the house without taking any extra steps.

Now, VLAN 24 there seems to be my VLAN 11.

is reflected identically in my

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t 1t'
        option vid '11'

The fundamental differences had been the connection of the interfaces to the devices.

Pass VLANs from OpenWrt router to OpenWrt AP

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.20'
config device
        option name 'br-ext'
        option type 'bridge'
        list ports 'eth0.24'

is using 2 bridges, one for each switch0-VLAN. While mine

config device
        option type 'bridge'
        option name 'bridge'
        list ports 'eth0.10'
        list ports 'eth0.11'
config bridge-vlan
        option device 'bridge'
        option vlan '10'
        list ports 'eth0.10:u*'
config bridge-vlan
        option device 'bridge'
        option vlan '11'
        list ports 'eth0.11:u*'

has been using 1 bridge and filtering and seemed weird to me.

So based on this, I have changed it now to

config device
        option type 'bridge'
        option name 'br-trust_wire'
        list ports 'eth0.10'
config device
        option type 'bridge'
        option name 'br-trust_wifi'
        list ports 'eth0.11'

and moved the corresponding interfaces to now

config interface 'LAN'
        [...]
        option device 'br-trust_wire'
config interface 'OLYMP'
        option proto 'static'
        list ipaddr '192.168.11.34/24'
        option device 'br-trust_wifi'
        option multipath 'off'

which reflects the setup in that other thread:

Pass VLANs from OpenWrt router to OpenWrt AP

config interface 'lan'
        [...]
        option device 'br-lan'
config interface 'ext'
        option device 'br-ext'
        option proto 'none'

This results in

the AP is still reachable over wire through VLAN 11 (from a laptop setup to allow me this debugging)
the AP can still reach OPNSense (192.168.11.1) over wire through VLAN 11

root@OpenWrt:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG    0      0        0 br-trust_wire
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 br-trust_wire
192.168.11.0    0.0.0.0         255.255.255.0   U     0      0        0 br-trust_wifi
root@OpenWrt:~# ping 192.168.11.1
PING 192.168.11.1 (192.168.11.1): 56 data bytes
64 bytes from 192.168.11.1: seq=0 ttl=64 time=0.896 ms

but a WiFI device (interface "OLYMP") no longer gets DHCP from OPNsense

Using tcpdump on the AP to monitor the DHCP traffic

shows traffic on the device automatically created by creating the ESSID (device "5-olymp")
shows no traffic on the bridge device "br-trust_wifi"
shows no traffic on the switch device "eth0.11"

which maybe is to-be-expected.

In any case, the changes cause DHCP to stop working.

Basically this setup is where I started my journey at. Facing the DHCP issue I then started combining the eth0.xx and ended up throwing VLAN filtering into the fray.

ncompact · May 6, 2026, 9:39am

can I ask how you added “vlan filtering” support if your router still has "swconfig" ?

https://firmware-selector.openwrt.org/?version=25.12.2&target=ath79%2Fgeneric&id=tplink_archer-c7-v5

maelkoth72 · May 6, 2026, 11:01am

I have not been using CLI configuration but everything is done through Luci. And there, it is available for the bridge device. I only later started to get an idea that there may be something off with this, based on something called DSA on ath79 .

I only stumbled into that VLAN filtering after my initial trials. Those trials led, step-by-step, to a situation where I had eth0.10 and eth0.11 on the switch0, both merged into a single bridge (otherwise DHCP would not work) and both interfaces (wifi+lan) being attached to that single bridge. Figured that it cannot know which interface would be meant for which VLAN and searching turned up that VLAN filtering .

maelkoth72 · May 10, 2026, 9:58am

Thanks to @_bernd I have used a different approach now, so that the problems mentioned her are no longer of concern.