No guide for Dumb AP, SSID and VLAN?

lon · January 13, 2026, 8:32pm

Main Router: Dynalink DL-WRX36 (openwrt)
Dumb Bridged AP: Archer C7 V4 (openwrt)

I already followed this guide
OpenWrt Wiki] Wi-Fi Extender/Repeater with Bridged AP over Ethernet

I created a test SSID on the Dumb AP and I am able to connect.

Now I am trying to look for a guide where I mimic the SSID + VLAN set up on my Main Router… but I couldn’t find any?

[OpenWrt Wiki] Guest Wi-Fi on a dumb wireless AP using LuCI – this one is creating a new guest wifi with it’s own firewall rules
[OpenWrt Wiki] Wi-Fi configuration - no mention of VLAN at all
VLANs in OpenWrt 21 – outdated so simply horrible to follow for a beginner

(For reference, I was using an EAP265HD (not openwrt). I just added a VLAN IDs to each SSID on the tp-link setup and it worked. I’m having issues getting started with Archer C7.)

psherman · January 13, 2026, 8:48pm

There isn't a specific wiki article on the addition of VLANs on bridged APs, but I did just help someone with that task earlier today. Take a look at the thread below and let me know if you have questions.

lon · January 13, 2026, 9:09pm

Thank you for responding chief!

So my first step was to create the VLAN IDs similar to my Main Router

I went to LuCI > Network > Switch

so now I have this

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdc6:4c1c:1baa::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.2'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
list dns '192.168.1.1'

config device
option name 'eth0.2'
option macaddr 'REDACTED'

config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'

config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3 4 5'
option vid '1'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1'
option vid '2'

config switch_vlan
option device 'switch0'
option vlan '3'
option vid '10'
option description 'MASTER'
option ports '0t'

config switch_vlan
option device 'switch0'
option vlan '4'
option vid '20'
option description 'GUEST'
option ports '0t'

config switch_vlan
option device 'switch0'
option vlan '5'
option vid '30'
option description 'IOT'
option ports '0t'

config switch_vlan
option device 'switch0'
option vlan '6'
option vid '40'
option description 'WORK'
option ports '0t'

root@OpenWrt:~#

Could you help check the tagged/untagged stuff?

btw the Main Router is connected to Dummy AP using Port 1.

So I have 3 ports left + WAN port

psherman · January 13, 2026, 9:19pm

I'd recommend undoing what you did there and building just one new VLAN. From there you can repeat the process for the others.

Meanwhile...

logical port 0 is the CPU. Yes, it should be tagged, so that is correct. However, you have not actually connected this to any of the physical ethernet ports on your device.

Physical ports 1-4 on your device correspond to logical ports 2-5 in the switch config. While this is a 1:1 relationship in general, the numbering may not be as simple as physical port 1 -> logical 2, physical 2 -> logical 3, etc. I don't know what the actual port mapping looks like.

Once you have found the logical port used for the uplink, it will look something like this -- below I'm just guessing logical port 2 (but this is not necessarily accurate):

config switch_vlan
    option device 'switch0'
    option vlan '4'
    option vid '20'
    option description 'GUEST'
    option ports '0t 2t'

Then, you'll need two more elements -- a bridge and an unmanaged interface:

config device
    option name 'br-guest'
    option type 'bridge'
    list ports 'eth0.20'

config interface 'guest'
    option device 'br-guest'
    option proto 'none'

lon · January 13, 2026, 9:34pm

By “uplink”, I assume that is the port used to connect Main Router and Bridge AP?

If yes, that would be LAN1

option ports '0t 2t'

Just for my future reference (Archer C7 V4)

LAN2 option ports '0t 3t'
LAN3 option ports '0t 4t'
LAN4 option ports '0t 5t'
WAN option ports '0t 1t'

Ok so now I have

config switch_vlan
option device 'switch0'
option vlan '4'
option vid '20'
option description 'GUEST'
option ports '0t 2t'

config device
option type 'bridge'
option name 'br-guest'
list ports 'eth0.20'

config interface 'guest'
option proto 'none'
option device 'br-guest'

psherman · January 13, 2026, 9:35pm

Yes.

lon:

config switch_vlan
option device 'switch0'
option vlan '4'
option vid '20'
option description 'GUEST'
option ports '0t 2t'

config device
option type 'bridge'
option name 'br-guest'
list ports 'eth0.20'

config interface 'guest'
option proto 'none'
option device 'br-guest'

That looks good.

Does it work?

lon · January 13, 2026, 9:39pm

Wait..sorry if I’m slow… how is the new br-guest device used in an SSID?

psherman · January 13, 2026, 9:40pm

The device itself is not, but the network interface guest is used in the SSID config stanza (in /etc/config/wireless to link the SSID with the network.

lon · January 13, 2026, 9:45pm

Oh ok, I created a new SSID

config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'GUESTWIFI'
option encryption 'psk2'
option key 'REDACTED'
option network 'guest'

Could not connect to GUESTWIFI though.. Anything I could check?

psherman · January 13, 2026, 9:48pm

Have you verified the main router's configuration? Is the guest network working there? Is it properly configured with VLANs to connect to the downstream AP?

lon · January 13, 2026, 9:54pm

Oh wait, nevermind. I was stupid. I had the AP plugged to Port 1 (which is untagged). It works now with the proper IP.

Which leads me to a new question. How come I can’t manage the AP when it’s not on an “Untagged” port?

Is there a way around that?

This is Main Router

config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1:u*'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '40'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

psherman · January 13, 2026, 9:59pm

You can have all of your networks tagged on your trunk port if you want. The 802.1q standard allows the use of an untagged network in addition to tagged ones, but some will argue that a trunk should never have any untagged networks.

It comes down to sequencing, really.

You need to change the VLAN tagging associated with the AP's management network. This needs to be done first on the AP. Once that is complete, you will not have connectivity until you then change the tagging of that VLAN on the upstream connection (i.e. the main router, or a switch if there is one involved).

lon · January 13, 2026, 10:13pm

I see, thanks.
I’ll probably won’t explore that further, since I can easily switch ports to manage the AP.

Btw, how do I make sure the remaining ports of my Bridged AP is still usable?

Let’s say I’d like to use the 3 other ports for PS5, Steamdeck, etc.

psherman · January 13, 2026, 10:16pm

You can also just simply put VLANs 20, 30, and 40 as tagged on port lan1.

config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '40'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

In fact, unless you're using ports lan2-lan4 as trunks as well, those don't need to be included in the VLAN port assignments.

lon · January 13, 2026, 10:38pm

Hmm I just connected my spare laptop to the LAN2 port of my Dumb AP…

and it can’t connect to wired network.

Are there extra steps to make these ports usable?

psherman · January 13, 2026, 10:46pm

Make the change in recommended on the main router and then use port lan1.

lon · January 13, 2026, 10:52pm

Oh my bad.

Alright, I’ll do that..

Just for completeness sake, what would VLAN 10 look like in this scenario? Remain as-is?

Edit:

After saving, and retesting… the 3 ports are still not working (device connected through wire) when on the Bridged AP.
Also, I don’t see “lan1, lan2, lan3, lan4” under Devices (compared to Main Router)– is that normal?

psherman · January 13, 2026, 11:17pm

Yes, since you already have port lan 1 untagged for VLAN 10.

Let's see the latest config.

Yes... your AP uses swconfig but your router is DSA. As I explained earlier...

Let me see the latest network configs from each device (as well as one other bit):

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network

lon · January 14, 2026, 12:33am

Sorry for the delay.. Here are the logs

Main Router

root@OpenWrt:~# ubus call system board
{
"kernel": "5.15.150",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 4",
"model": "Dynalink DL-WRX36",
"board_name": "dynalink,dl-wrx36",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.3",
"revision": "r23809-234f1a2efa",
"target": "ipq807x/generic",
"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
}
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd09:b0ce:1b1f::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan.10'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'
option device 'wan'
option proto 'dhcp'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'

config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1:u*'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config interface 'guest'
option proto 'static'
option device 'br-lan.20'
option ipaddr '192.168.20.1'
option netmask '255.255.255.0'

config interface 'iot'
option proto 'static'
option device 'br-lan.30'
option ipaddr '192.168.30.1'
option netmask '255.255.255.0'

config bridge-vlan
option device 'br-lan'
option vlan '40'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config interface 'work'
option proto 'static'
option device 'br-lan.40'
option ipaddr '192.168.40.1'
option netmask '255.255.255.0'

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd09:b0ce:1b1f::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'

config interface 'lan'
option device 'br-lan.10'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'

config interface 'wan'
option device 'wan'
option proto 'dhcp'

config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'

config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1:u*'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '20'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config interface 'guest'
option proto 'static'
option device 'br-lan.20'
option ipaddr '192.168.20.1'
option netmask '255.255.255.0'

config interface 'iot'
option proto 'static'
option device 'br-lan.30'
option ipaddr '192.168.30.1'
option netmask '255.255.255.0'

config bridge-vlan
option device 'br-lan'
option vlan '40'
list ports 'lan1:t'
list ports 'lan2:t'
list ports 'lan3:t'
list ports 'lan4:t'

config interface 'work'
option proto 'static'
option device 'br-lan.40'
option ipaddr '192.168.40.1'
option netmask '255.255.255.0'

root@OpenWrt:~#

Bridged AP

root@OpenWrt:~# ubus call system board
{
"kernel": "6.6.104",
"hostname": "OpenWrt",
"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
"model": "TP-Link Archer C7 v4",
"board_name": "tplink,archer-c7-v4",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.3",
"revision": "r28872-daca7c049b",
"target": "ath79/generic",
"description": "OpenWrt 24.10.3 r28872-daca7c049b",
"builddate": "1758316778"
}
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdc6:4c1c:1baa::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'

config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.2'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
list dns '192.168.1.1'

config device
option name 'eth0.2'
option macaddr 'REDACT'

config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'

config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3 4 5'
option vid '1'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1'
option vid '2'

config switch_vlan
option device 'switch0'
option vlan '4'
option vid '20'
option description 'GUEST'
option ports '0t 2t'

config device
option type 'bridge'
option name 'br-guest'
list ports 'eth0.20'

config interface 'guest'
option proto 'none'
option device 'br-guest'

config switch_vlan
option device 'switch0'
option vlan '5'
option ports '0t 2t'
option vid '30'
option description 'IOT'

config device
option type 'bridge'
option name 'br-iot'
list ports 'eth0.30'

config interface 'iot'
option proto 'none'
option device 'br-iot'

config switch_vlan
option device 'switch0'
option vlan '6'
option ports '0t 2t'
option vid '40'
option description 'WORK'

config device
option type 'bridge'
option name 'br-work'
list ports 'eth0.40'

config interface 'work'
option proto 'none'
option device 'br-work'

config switch_vlan
option device 'switch0'
option vlan '7'
option ports '0t 2t'
option vid '10'
option description 'LAN'

config device
option type 'bridge'
option name 'br-lan-on-ap'
list ports 'eth0.10'

config interface 'lan_on_ap'
option proto 'none'
option device 'br-lan-on-ap'

root@OpenWrt:~#

psherman · January 14, 2026, 12:53am

This should be upgraded to a currently supported version...

This one should be upgraded to 24.10.5:

delete this:

lon:

config switch_vlan
option device 'switch0'
option vlan '7'
option ports '0t 2t'
option vid '10'
option description 'LAN'

config device
option type 'bridge'
option name 'br-lan-on-ap'
list ports 'eth0.10'

config interface 'lan_on_ap'
option proto 'none'
option device 'br-lan-on-ap'

Everything should work if you connect port lan1 on the main router to port lan1 on the AP.

If you want to use one of the other ports on the main router, then simply change the following on the AP:
Edit the original VLAN 1 definition - change the VID to 10 and tag port 2 as shown here:

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2t 3 4 5'
option vid '10'

then change br-lan to use eth0.10

config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.10'

Reboot and connect and test.