OpenWRT Configuration for AP with an own Network (VLAN Tagging is not an option)

Hey Guys,

First of all: sorry it might be a bit long :C

I´m using a set of Deco M4Rv2 for my home network. My OpenWRT Router works absolutely fine and does its job perfectly. My AP has some strange problems, but thats for sure user error.

I would like to repeat my main Network, my guest network and my iot network on that AP, also i would like to create a complete new subnet for our tenants. My biggest problem with that is that i can`t use VLAN Tagging because the Connection goes from my Router to a desktop switch in my living room, up to the next desktop switch where my NAS and the AP are plugged into. I need to have a new network on that AP because the connection to the tenants home is from Up where the AP is down to their living room. We also have 5G Internet, so moving the main router is also not an option. Is there any possibility to create a VLAN on that AP with OpenWRT and restrict it to use my default network? I really dont want them to access my IoT Stuff and so on.

Currently my AP is configured to repeat my Main Network using the Network from the cable and Repeat the other two networks with relayd. Strange enough, the guest network doesn´t work, but the IoT network does. I must oversee something, on the main router both vlans work perfectly.

System board(Router and AP are the same device models):

{
        "kernel": "5.15.150",
        "hostname": "ThiemoAtHome",
        "system": "Qualcomm Atheros QCA956X ver 1 rev 0",
        "model": "TP-Link Deco M4R v1",
        "board_name": "tplink,deco-m4r-v1",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.3",
                "revision": "r23809-234f1a2efa",
                "target": "ath79/generic",
                "description": "OpenWrt 23.05.3 r23809-234f1a2efa"
        }
}

Configurtion main router:

root@ThiemoAtHome:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdce:9220:8dee::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.31.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 5'
        option vid '1'
        option description 'Home VLAN'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 3'
        option vid '2'
        option description 'WAN'

config interface 'Liwest'
        option proto 'dhcp'
        option device 'eth0.2'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t'
        option vid '3'
        option description 'Guest VLAN'

config interface 'Gast_Wifi'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        list dns '1.1.1.1'
        list dns '8.8.8.8'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option ports '0t'
        option vid '4'
        option description 'IoT'

config interface 'IoT_Wifi'
        option proto 'static'
        option ipaddr '192.168.101.1'
        option netmask '255.255.255.0'

root@ThiemoAtHome:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0'
        option channel '40'
        option band '5g'
        option htmode 'VHT80'
        option cell_density '0'
        option country 'AT'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option channel 'auto'
        option band '2g'
        option htmode 'HT40'
        option country 'AT'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'main network'
        option encryption 'psk-mixed'
        option key '##'
        option ieee80211r '1'
        option mobility_domain '2f31'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Guest'
        option encryption 'psk-mixed'
        option key '##'
        option network 'Gast_Wifi'
        option isolate '1'
        option ieee80211r '1'
        option mobility_domain '44f3'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

config wifi-iface 'wifinet3'
        option device 'radio0'
        option mode 'ap'
        option ssid 'main network'
        option encryption 'psk-mixed'
        option key '##'
        option ieee80211r '1'
        option mobility_domain '2f31'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option network 'lan'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option ssid 'TSN@IoT'
        option encryption 'psk-mixed'
        option key '##'
        option network 'IoT_Wifi'

root@ThiemoAtHome:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '30'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'hybrid'
        option ra 'hybrid'
        option master '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'Gast_Wifi'
        option interface 'Gast_Wifi'
        option start '50'
        option limit '70'
        option leasetime '6h'

config host
        option ip '192.168.31.2'
        option leasetime '12h'
        option instance '0'
        option broadcast '1'
        list mac '##'

config dhcp 'IoT_Wifi'
        option interface 'IoT_Wifi'
        option start '50'
        option limit '200'
        option leasetime '12h'

config host
        option ip '192.168.10.50'
        option leasetime '12h'
        list mac '##'

config host
        option ip '192.168.101.50'
        option leasetime '12h'
        list mac '##'

root@ThiemoAtHome:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'
        option flow_offloading '1'
        option flow_offloading_hw '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'
        list network 'Liwest'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'Gast'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'Gast_Wifi'

config forwarding
        option src 'Gast'
        option dest 'wan'

config rule
        option name 'Guest DHCP'
        list proto 'udp'
        option src 'Gast'
        option dest_port '67'
        option target 'ACCEPT'

config rule
        option name 'Guest DNS'
        option src 'Gast'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Guest-Securewifi'
        option src 'Gast'
        option target 'DROP'

config zone
        option name 'IoT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'IoT_Wifi'

config zone
        option name 'Lan2IoT'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config forwarding
        option src 'Lan2IoT'
        option dest 'IoT'

config forwarding
        option src 'IoT'
        option dest 'lan'

Configuration AP:

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd6e:e1b3:2033::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        option bridge_empty '1'
        option macaddr '##'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.32.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 3'
        option vid '1'
        option description 'Mieter'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0t 5'
        option vid '2'
        option description 'Wan'

config interface 'wan_lan'
        option proto 'static'
        option device 'eth0.2'
        option ipaddr '192.168.31.2'
        option netmask '255.255.255.0'
        option ip6assign '64'
        option force_link '0'
        option gateway '192.168.31.1'
        list dns '192.168.31.1'

config interface 'relay_lan'
        option proto 'relay'
        option ipaddr '192.168.31.2'
        list network 'lan'
        list network 'wan_lan'

config interface 'wwan_guest'
        option proto 'dhcp'
        option device 'phy1-sta0'
        option hostname 'AP1IoT'

config interface 'lan_guest'
        option proto 'static'
        option force_link '0'
        option ipaddr '192.168.33.1'
        option netmask '255.255.255.0'
        option gateway '192.168.10.1'
        list dns '1.1.1.1'
        list dns '8.8.8.8'
        option device 'br-guest'

config device
        option type 'bridge'
        option name 'br-guest'
        option bridge_empty '1'
        list ports 'eth0.3'
        option macaddr '##'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t'
        option vid '3'
        option description 'Gast'

config interface 'relay_guest'
        option proto 'relay'
        option ipaddr '192.168.10.50'
        list network 'lan_guest'
        list network 'wwan_guest'

config interface 'wwan_iot'
        option proto 'dhcp'
        option device 'phy1-sta1'

config switch_vlan
        option device 'switch0'
        option vlan '4'
        option ports '0t'
        option vid '4'
        option description 'IoT'

config device
        option type 'bridge'
        option name 'br-iot'
        list ports 'eth0.4'
        option bridge_empty '1'

config interface 'lan_iot'
        option proto 'static'
        option force_link '0'
        option device 'br-iot'
        option ipaddr '192.168.34.1'
        option netmask '255.255.255.0'
        option gateway '192.168.101.1'
        list dns '1.1.1.1'
        list dns '8.8.8.8'

config interface 'relay_iot'
        option proto 'relay'
        option ipaddr '192.168.101.50'
        list network 'lan_iot'
        list network 'wwan_iot'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0'
        option channel '40'
        option band '5g'
        option htmode 'VHT80'
        option country 'AT'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'main network'
        option encryption 'psk-mixed'
        option key '##'
        option ieee80211r '1'
        option mobility_domain '2f31'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option channel '2'
        option band '2g'
        option htmode 'HT40'
        option cell_density '0'
        option country 'AT'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option mode 'ap'
        option ssid 'TSN@IoT'
        option encryption 'psk-mixed'
        option network 'lan_iot'
        option key '##'

config wifi-iface 'wifinet2'
        option device 'radio1'
        option mode 'sta'
        option network 'wwan_guest'
        option ssid 'Guest'
        option encryption 'psk2'
        option key '##'
        option macaddr '##'

config wifi-iface 'wifinet3'
        option device 'radio1'
        option mode 'sta'
        option network 'wwan_iot'
        option ssid 'TSN@IoT'
        option encryption 'psk2'
        option key '##'
        option macaddr '##'

config wifi-iface 'wifinet4'
        option device 'radio1'
        option mode 'ap'
        option ssid 'testnet2'
        option encryption 'none'
        option key '##'
        option network 'lan_iot'
        option disabled '1'

config wifi-iface 'wifinet5'
        option device 'radio1'
        option mode 'ap'
        option ssid 'main network'
        option encryption 'psk-mixed'
        option key '##'
        option ieee80211r '1'
        option mobility_domain '2f31'
        option ft_over_ds '0'
        option ft_psk_generate_local '1'
        option network 'lan'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        list network 'wan_lan'
        list network 'relay_lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'gast'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'wwan_guest'
        list network 'lan_guest'
        list network 'relay_guest'

config forwarding
        option src 'gast'
        option dest 'wan'

config zone
        option name 'iot'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'wwan_iot'
        list network 'lan_iot'
        list network 'relay_iot'

config forwarding
        option src 'iot'
        option dest 'wan'

Thanks for any help. I'm also open to suggestions for changes. Unfortunately, laying the network cables differently is not an option, otherwise I wouldn't think so complexly if I could create a direct connection

Honestly, tagged vlan is your best option if you want all vlans expand from your main router to your access points.

I suggest you get some cheap managed switch and replace your curent unamanaged ones.

If you absolutely can't do that, you could split a single network cable of 8 wires into two different ones of 4 wires each. There are adapters for that (1x rj45 in, 2x rj45 out). This will limit your bandwidth to 100 MBit, but at least you could feed two RJ45 jacks on one side to two RJ45 jacks on the other side while going through a single Cat5e cable along the way.
See: https://www.amazon.com/dp/B095NPPHBC/
Mind the last picture.

Another idea could be a gretap tunneling devices. Those are basically "IP over IP point to point". You can create an additional network on your router, bridge that network to the gretap device, and do the very same thing on the AP. Think about a VPN, but with no encryption.

Router:

  • eth0.1 uses 192.168.0.1/24
  • tap0 uses 192.168.100.1/24 ("ipaddr" property) and targets 192.168.0.2 ("peeraddr" property)

AP:

  • eth0.1 uses 192.168.0.2/24
  • tap0 uses 192.168.100.2/24 ("ipaddr" property) and targets 192.168.0.1 ("peeraddr" property)

See: https://openwrt.org/docs/guide-user/network/tunneling_interface_protocols#protocol_gretap_ethernet_gre_tunnel_over_ipv4

You might even use the wire for a combined "eth0.1 tagged as well as eth0.2 untagged". I once read about that being an option. But I never tried this, and it feels even more wonky than 4-wire 100MBit split cables.

I'd rather invest into two or three managed switches, run a "tagged backbone" wire through the house and use the managed switches as outlet for whatever vlan is meant to be exposed.

1 Like