Need to change VLAN IDs ... can I just edit /etc/config/network and reboot?

Installing and Using OpenWrt Network and Wireless Configuration
1

I purchased a managed switch and want to place it between my RPi4 router/firewall and my dumb AP like so:

[ RPi4 ]-eth1 --- WAN
[ RPi4 ]
[ RPi4 ]-eth0 --- [ Managed switch ] --- [PCs]
                           |
                           |
                     [PoE cameras]

I read that one should avoid using VLAN IDs of 1 and 0 but my router and AP are currently using VLANs 1, 3, and 5. To avoid potential problems/conflicts, I'd like to change these to 10, 30, and 50.

Is it as simple as editing their respective /etc/config/network files and to substitute 1-->10, 3-->30, and 5-->50 followed by a reboot of each device? I don't want to lock myself out due to a misconfiguration.

Current /etc/config/network for:

router 
config interface 'loopback'
  option device 'lo'
  option proto 'static'
  option ipaddr '127.0.0.1'
  option netmask '255.0.0.0'

config globals 'globals'
  option ula_prefix 'fd1a:184b:b879::/48'
  option packet_steering '1'

config device
  option name 'eth0'
  option ipv6 '0'

config device
  option name 'eth1'
  option ipv6 '0'

config device
  option name 'wg0'
  option ipv6 '0'

config device
  option type 'bridge'
  option name 'lxcbr0'
  option ipv6 '0'
  option bridge_empty '1'

config device
  option name 'eth0.1'
  option type '8021q'
  option ifname 'eth0'
  option vid '1'
  option ipv6 '0'

config device
  option name 'eth0.3'
  option type '8021q'
  option ifname 'eth0'
  option vid '3'
  option ipv6 '0'

config device
  option name 'eth0.5'
  option type '8021q'
  option ifname 'eth0'
  option vid '5'
  option ipv6 '0'

config interface 'wan'
  option device 'eth1'
  option proto 'dhcp'
  option peerdns '0'
  option delegate '0'
  list dns '1.1.1.1'
  list dns '1.0.0.1'

config interface 'lxc'
  option device 'lxcbr0'
  option proto 'static'
  option ipaddr '10.0.4.1'
  option netmask '255.255.255.0'

config interface 'lan'
  option device 'eth0.1'
  option proto 'static'
  option ipaddr '10.9.8.1'
  option netmask '255.255.255.0'

config interface 'guest'
  option device 'eth0.3'
  option proto 'static'
  option ipaddr '10.9.7.1'
  option netmask '255.255.255.0'

config interface 'iot'
  option device 'eth0.5'
  option proto 'static'
  option ipaddr '10.9.5.1'
  option netmask '255.255.255.0'

config interface 'wg0'
  option proto 'wireguard'
# details omitted for privacy
dumb AP 

config interface 'loopback'
  option device 'lo'
  option proto 'static'
  option ipaddr '127.0.0.1'
  option netmask '255.0.0.0'

config globals 'globals'
  option ula_prefix 'fd90:d55a:8500::/48'
  option packet_steering '1'

config device
  option name 'br-lan'
  option type 'bridge'
  option ipv6 '0'
  list ports 'lan1'
  list ports 'lan2'
  list ports 'lan3'
  list ports 'lan4'
  list ports 'wan'

config interface 'lan'
  option device 'br-lan.1'
  option proto 'dhcp'

config interface 'guest'
  option proto 'none'
  option device 'br-lan.3'

config interface 'iot'
  option proto 'none'
  option device 'br-lan.5'

config bridge-vlan
  option device 'br-lan'
  option vlan '1'
  list ports 'lan1:t'
  list ports 'lan2:u*'
  list ports 'wan:t'

config bridge-vlan
  option device 'br-lan'
  option vlan '3'
  list ports 'lan1:t'
  list ports 'wan:t'

config bridge-vlan
  option device 'br-lan'
  option vlan '5'
  list ports 'lan1:t'
  list ports 'lan4:u*'
  list ports 'wan:t'

config device
  option name 'br-lan.1'
  option type '8021q'
  option ifname 'br-lan'
  option vid '1'
  option ipv6 '0'

config device
  option name 'br-lan.3'
  option type '8021q'
  option ifname 'br-lan'
  option vid '3'
  option ipv6 '0'

config device
  option name 'br-lan.5'
  option type '8021q'
  option ifname 'br-lan'
  option vid '5'
  option ipv6 '0'

config device
  option name 'wlan1'
  option ipv6 '0'
config device
  option name 'wlan1-1'
  option ipv6 '0'

config device
  option name 'eth0'
  option ipv6 '0'

config device
  option name 'lan1'
  option ipv6 '0'

config device
  option name 'lan2'
  option ipv6 '0'

config device
  option name 'lan3'
  option ipv6 '0'

config device
  option name 'lan4'
  option ipv6 '0'

config device
  option name 'wan'
  option ipv6 '0'

Proposed changes to these files (just diffs):

router's network.diff 
diff --git a/router b/router
index 4f5d7e9..18e6cae 100644
--- a/router
+++ b/router
@@ -27,24 +27,24 @@ config device
   option bridge_empty '1'
 
 config device
-  option name 'eth0.1'
+  option name 'eth0.10'
   option type '8021q'
   option ifname 'eth0'
-  option vid '1'
+  option vid '10'
   option ipv6 '0'
 
 config device
-  option name 'eth0.3'
+  option name 'eth0.30'
   option type '8021q'
   option ifname 'eth0'
-  option vid '3'
+  option vid '30'
   option ipv6 '0'
 
 config device
-  option name 'eth0.5'
+  option name 'eth0.50'
   option type '8021q'
   option ifname 'eth0'
-  option vid '5'
+  option vid '50'
   option ipv6 '0'
 
 config interface 'wan'
@@ -62,19 +62,19 @@ config interface 'lxc'
   option netmask '255.255.255.0'
 
 config interface 'lan'
-  option device 'eth0.1'
+  option device 'eth0.10'
   option proto 'static'
   option ipaddr '10.9.8.1'
   option netmask '255.255.255.0'
 
 config interface 'guest'
-  option device 'eth0.3'
+  option device 'eth0.30'
   option proto 'static'
   option ipaddr '10.9.7.1'
   option netmask '255.255.255.0'
 
 config interface 'iot'
-  option device 'eth0.5'
+  option device 'eth0.50'
   option proto 'static'
   option ipaddr '10.9.5.1'
   option netmask '255.255.255.0'
--
dumb AP's network.diff 
diff --git a/ap b/ap
index 537f918..ab9fef4 100644
--- a/ap
+++ b/ap
@@ -19,33 +19,33 @@ config device
   list ports 'wan'
 
 config interface 'lan'
-  option device 'br-lan.1'
+  option device 'br-lan.10'
   option proto 'dhcp'
 
 config interface 'guest'
   option proto 'none'
-  option device 'br-lan.3'
+  option device 'br-lan.30'
 
 config interface 'iot'
   option proto 'none'
-  option device 'br-lan.5'
+  option device 'br-lan.50'
 
 config bridge-vlan
   option device 'br-lan'
-  option vlan '1'
+  option vlan '10'
   list ports 'lan1:t'
   list ports 'lan2:u*'
   list ports 'wan:t'
 
 config bridge-vlan
   option device 'br-lan'
-  option vlan '3'
+  option vlan '30'
   list ports 'lan1:t'
   list ports 'wan:t'
 
 config bridge-vlan
   option device 'br-lan'
-  option vlan '5'
+  option vlan '50'
   list ports 'lan1:t'
   list ports 'lan4:u*'
   list ports 'wan:t'
@@ -54,21 +54,21 @@ config device
   option name 'br-lan.1'
   option type '8021q'
   option ifname 'br-lan'
-  option vid '1'
+  option vid '10'
   option ipv6 '0'
 
 config device
   option name 'br-lan.3'
   option type '8021q'
   option ifname 'br-lan'
-  option vid '3'
+  option vid '30'
   option ipv6 '0'
 
 config device
   option name 'br-lan.5'
   option type '8021q'
   option ifname 'br-lan'
-  option vid '5'
+  option vid '50'
   option ipv6 '0'
 
 config device
--
2

That is partially true! VLAN0 is forbidden.

But VLAN1 is standard VLAN everywhere and anytime so if you want to use that is more about your own preferences.

The only problem I know with VLAN1 is some cyber hacking things that will make a VLAN1 open just because everyone use that so the hacker can simply guess that VLAN1 is available.
But this is true for every VLAN1-4096 if the admin VLAN is known and you allow dual VLAN tagging.

3

Generally I personally do these operations by building up the new vlans parallel to the old ones and make sure they work.
After that I move the admin vlans to the new and then remove the old vlans.
But hypothetically you can rewrite the configs and reboot.

Just remember to start changing farthest out in the network and work your way to the dhcp server (router) or you will never be able to connect to the downstream devices without starting from scratch.

Note that some switches (Ubiquinti for example) can end up in a catch 22 dilemma when changing admin VLAN (if they change right away when you type in the admin VLAN) and the switch has a IP from a different VLAN. Then you may be forced to set this up with serial/console.

4

Thanks for the replies, @flygarn12. Maybe I'll just leave at as 1, 3, 5 and call it good.

Related but different question: I assume creating a VLAN that allows access to the managed switch separate from my initial three is a good idea. I assume the switch firmware will allow me to only allow logins to the web-based firmware on an "admin" VLAN? I went with the Netgear GS316EP

5

I have no first hand experience with Netgear. But both TP-Link and Ubiquinti business class smart manage L2/L3 switches has settings for management VLAN.

To be sure you have to check the manual for your switch.

There is one more thing with having a vlan1 available in the network, even if you isolate it from the internet and not using it on daily operations.
If you buy some new equipment or reset some equipment in the future it is almost guaranteed to be preset for a vlan1 existence at boot up. So if you have a vlan1 available in your network it will make connection easier to the new/reset devices.

6

While there is some truth to this, it actually isn't necessarily that important to use VLAN 1. With respect to switches, the vast majority of these types of devices will actually have all ports configured as access ports for VLAN 1 by default -- effectively operating as a simple unmanaged switch until the user configures it otherwise. APs, similarly, will come up with the untagged network as the default management network. This means that the initial configuration of most switches or APs will work on any VLANs as long as it is untagged (and thus the VLAN ID is irrelevant). It is true that some devices may not allow you to change the management VLAN (or they may not have a proper management VLAN config option in the first place), but those devices may also assume the management VLAN is the one that is untagged.