TLDR at the bottom:
Hello. I don't really know where to start but I figured I try this route. Anyway, I want to make openwrt as a managed switch to separate trunk port VLANS for transparent filtering. Here is my topology.
Modem > [ESXI host: OPNSense router > Sophos UTM (bridge mode)] > Wifi AP
My OPNSense Current Router Setup:
WAN > vmx0 (Physical Port 1) (public IP, dhcp) LAN > vmx1 (Physical Port 2) (static, 192.168.1.1/24, dhcp server) OPT1 > vmx2 (vOPT1 (no physical uplink)) (Static, 10.0.0.1, dhcp server) > test port OPT2> vmx3 (Physical Port 4) not enabled VLAN10 vmx3.10 (Static, 172.16.10.1/24 dhcp server) - IOTS VLAN20 vmx3.20 (Static, 172.16.20.1/24 dhcp server) - Local Wireless LAN VLAN30 vmx3.30 (Static, 172.16.30.1/24 dhcp server) - Guest Wireless LAN VLAN40 vmx3.40 (Static, 172.16.40.1/24 dhcp server) - Kids Wireless LAN
Sophos UTM on my test port as bridge
Bridged interface (eth0, eth1): Static, 10.0.0.2/24, Default Gateway 10.0.0.1, PROXY ARP eth0 > vOPT1 eth1 > Physical Port 3
Then, my wifi AP is connected to Physical Port 4.
Everything works at this setup. I tried to setup Sophos UTM as bridge interface for transparent filtering in a trunk port but no avail. I am able to get it to passthrough traffic, however, when I turn webfiltering on on KIDS Wireless VLAN, it stopped working. But, on my test port, everything works. I figured, probably there are issues when bridging a trunk port.
So, I though about this workaround where I could assign a virtual trunk port without physical uplink to my opensense router on OPT2 and connect it to openwrt VM, from openwrt VM, I can separate VLAN20 and VLAN40, place a sophosUTM VM bridge on both of them, and bridge it to physical trunk port. Please help with the config on OpenWrt. I don't see the option "port" under network.
Before anyone ask, why don't you use zenarmor, or use Sophos UTM as your router, or say Sophos XG, or whatever to make my life easier, you do you and I do me. I just want to learn more about networking.
TLDR: How can I configure OpenWrt as a managed switch in VM to untag VLANs from Opnsense trunk, and retag them again going to my WIFI AP?