Playground for VLAN

Reconfigure the OpenWrt LAN interface to use an IP address in the 192.168.111.x network; remove the gateway and dns options.

Connect the Archer C7's WAN port to the Fritzbox. You can keep the OpenWrt WAN interface set as DHCP client, which is the OpenWrt default. Connect your notebook to one of the Archer C7's LAN ports.

Under Network->Interfaces, add an interface for the 192.168.133.y subnet. Assign the interface to the LAN firewall zone, or create a new firewall zone for it, depending on your desired policy.
Under Physical settings, make sure the bridge option is enabled, and assign the physical interface eth0.3 as a preparation for adding wired ethernet ports via the built-in switch. Do not add any wireless interface to the bridge here - this happens automatically based on the following configuration.

Go to Network->Wireless, edit the wireless interface. There, under Interface configuration -> general setup, set the network to the interface you created in the previous step, and repeat this for each wireless interface you want to move over to this subnet.

In order to add wired ethernet ports to the 192.168.133.y subnet, create VLAN 3 in the OpenWrt switch config. On the ethernet port which connects the OpenWrt device to the Mikrotik switch, any VLAN you want to extend to the switch (say VLAN1 + VLAN3) should be configured as tagged. The same tagging needs to be done on the Mikrotik switch.

With the notebook connected to OpenWrt's LAN interface, you should be able to reach any host in your network, when allowed by your firewall policy. However, NAT may still be enabled on the OpenWrt WAN interface. You can switch it off (which I would recommend), but then you have to add static routes on the Fritzbox for the 192.168.111.x and 192.168.133.y networks.

1 Like