I'm trying to understand VLANs under OpenWRT with the goal of splitting APs between 2 VLANS. One of the radios will go on one VLAN (the private network) the other will go on the other VLAN (the public network)
The VLANS are presented to the APs on a single physical interface, as tagged and untagged, the untagged goes to the VLAN I want to use to manage the AP. (so that I can factory reset the AP such as during a firmware update then connect to it at 192.168.1.1) None of the AP's is setup as a router, all are setup as APs.
It APPEARS to me that the way to do this is leave the first bridged interface connected to the hardware port getting untagged packets alone, create a second bridged device, create a virtual hardware ethernet interface on the public VLAN (101) , tie the second bridged device to the virtual hardware interface on VLAN 101, then disconnect the radio I want to put on the public network from the first bridge and connect it to the second bridge.
It does not seem possible to tie the radio interface directly to the hardware interface, (luci doesen't allow it) but this must be done with a second bridge. Is this correct?
I've read through the instructions on https://openwrt.org/docs/guide-user/network/vlan/switch_configuration but it seems mostly concerned with swconfig setups. Possibly because most AP hardware is still running swconfig?
It also says nothing about using Luci - probably because when it was written Luci couldn't do this? I'm fine with configuring things at the command line, and I assume Luci will read the reconfigured /etc/config/network and I can figure out
how to do this with Luci later, if I want.
In my case I have the following AP on the following switch (these are all testing devices):
Netgear WNDR3700 running OpenWRT 24.10.3 on a Catalyst C3560. This AP uses swconfig on this OpenWRT version.
The switch port the AP is on is configured thusly:
!
interface FastEthernet0/2
switchport trunk encapsulation dot1q
switchport trunk native vlan 101
switchport mode trunk
!
The Catalyst switch presents 192.168.0.0/16 to the AP as untagged, and it presents 172.16.16.0/24 as tagged with VLAN id 101. the only physical port plugged into the AP is port1 on the LAN ports, the WAN port is not used.
Unfortunately, while the documentation for this AP concerning VLANS is extensive, here:
https://openwrt.org/toh/netgear/wndr3700#specific_configuration
it appears to be VERY old since for example, /etc/config/network does NOT match what the docs display. In the docs it talks about device rtl8366s while currently I'm seeing "device switch0"
ANYWAY what I THINK I just need to do is add the following to /etc/config/network
config device
option name 'br-lan101'
option type 'bridge'
list ports 'eth0.101'
config device
option name 'eth0.101'
config interface 'lan-101'
option device 'br-lan101'
Then modify the /etc/config/wireless file to change the
option network
from 'lan' to 'lan101'
What I am confused about, however, is do I need to add
option enable_vlan '101'
to the option device that defines eth0.101?
And, do I need to add a made-up MAC address with
option macaddr '00:00:0b:ad:be:ef'
to the interface for lan-101? I don't want to assign an IP address to it.
Now, this is all swconfig stuff. I ALSO have a Meraki MR52 running OpenWRT 24.10.3 on a Cisco Catalyst C2960X. This AP uses DSA on this OpenWRT version.
The switch port the AP is on is configured thus:
!
interface GigabitEthernet1/0/20
switchport trunk native vlan 201
switchport mode trunk
The switch presents 172.16.201.0/24 to the AP as Untagged, and it presents 192.168.0.0/16 as VLAN id 101, tagged.
The MR52 is running OpenWRT 24.10.3 and it's lan interface is 172.16.201.254
it's /etc/config/wireless file ties
config wifi-iface 'default_radio0'
option network 'lan'
config wifi-iface 'default_radio1'
option network 'lan'
config wifi-iface 'default_radio2'
option network 'lan'
and it's considerably simpler /etc/config/network just defines lan as a bridge br-lan here:
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '172.16.201.254'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '172.16.201.1'
Once more, am I correct in assuming all I need to do is add the following to /etc/config/network
config bridge-vlan 'eth0_vlan'
option device 'br-lan'
option vlan '101'
list ports 'eth0:u*'
config bridge-vlan
option device 'br-lan'
option vlan '101'
list ports 'eth0:t'
config interface 'publiclan'
option device 'br-lan.101'
option proto 'none'
then modify /etc/config/wireless to change the option network from lan to publiclan?
Good luck!