OpenWrt on WRT1900ACS cannot get VLANs to work

Let me start by saying that I've spent a long time googling and searching for a solution. I've flashed the router, all is fine, but I can't create bridges, VLANs or basically segregate and separate networks on my router which is what my main goal is:

  1. to separate my work laptop and pc from everything else
  2. to isolate a Tegra TX2 which runs Tor, XMR Nodes and other P2P from everything else.
  3. to attach a WiFi to that VLAN so I can ssh into the Tegra from my laptop by connecting to the Wifi.
  4. to attach a second WiFi to the first VLAN because my laptop doesn't have an ethernet adapter.

I have installed OpenWRT 21.02.2 and can SSH or access Luci via HTTPS.

Steps I've taken:

  • I use the existing br-lan to try setup two VLANs
  • I go under Network > Interfaces > Devices and select br-lan and Configure
  • The selected bride ports are lan1, lan2, lan3 and lan4
  • Under Bridge VLAN filtering I setup filtering with Local checked:
  • VLAN1 is using untagged lan1 and lan2 and VLAN 2 is using **untagged lan3 and lan4

When I press "save&apply" it hangs. The exact message is "Failed to confirm within 90s, waiting for rollback".
If I press the reset button I end up rolling back to before I tried this. I'm obviously doing something wrong or I've miss-understood something.

My understanding is that this is a DSA router. All the above are done via LuCi, but I have also tried over ssh to no avail. Any help is greatly appreciated!

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless

How are you connecting to the router? By cable (which port) or wirelessly?

Ok, I finally managed to get it to work. I did the following:

  1. Reset to Defaults
  2. Setup the LAN static IP (it was conflicting with the Modem's IP range)
  3. SSH into the 1900ACS (I decided LuCi wasn't doing it for me).
  4. Installed package bridge once I verified I could connect to the internet.

This is where it gets more bizarre;

  1. I tried the bridged approach (two different bridges) from the DSA tutorial; the 2nd bridge simply didn't work.
  2. I tried the VLAN approach from the DSA tutorial; it now worked.

All the setting up was done over SSH using vim.

I still had to setup the firewall and routes manually, but that's most likely due to me messing the settings up as I learn.

I still haven't figured out how to isolate one of the VLANs from the router (I don't want the VLAN to have access to the "internal" side of the VLAN/router as it will be hosting publicly available services, but I suppose that's a question for another day.

Was the installation of bridge required? Or is LuCi for this version bugged? I must have tried at least 15 times using the web ui and I simply couldn't get it to work.

Set each network into its own firewall zone. Then, set input = reject on the zone(s) that should not have access to the router itself. You'll probably need to allow DHCP (67-68) and maybe DNS (53) in separate rules.


Thanks Peter, that’s what I tried but I managed to mess up DHCP leasing. I’ll try adding an exception to TCP 53 and UDP 68.

udp+tcp 53 for dns and udp 67 for dhcp.

1 Like

Thanks a lot gents, all done now! I still don't understand why LuCi wouldn't work but configuring it through SSH did, but I'm not bothered.

1 Like

Hi, I have the same problem. How did you fix the problem? I am still unable to make it work.


  1. setup the VLAN by going to devices then br-lan then Bridge VLAN filtering nothing else I tried worked with it.
  2. setup your VLAN ids, then setup the equivalent interfaces with their IPs and DHCP, etc...
  3. setup the firewalls; at this point you should be able to check by using different ethernet ports
  4. alternatively setup a wifi and attach it to a vlan, test by connecting to it.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.