I've done my best to scour the interwebz to ensure I'm not duplicating a question, but couldn't find an answer, but apologies if it is a duplicate! I'm new to using OpenWRT but I've found it fairly intuitive and there's an awesome amount of support, tutorials, etc. I'm an amateur (but hopefully not completely oblivious) when it comes to networking.
What I'm trying to achieve
Raspberry Pi 4 Model B running OpenWRT as the router (no modem needed)
Mikrotik HAP AC2 running OpenWRT as the access point
Using this YouTube guide I've set up the router with the required interfaces, firewall and traffic rules, etc.
And using the official OpenWRT guidance, I've set up the Mikrotik with OpenWRT, plus I've set up the various WiFi SSIDs noted above, currently not linking to any interface or device
As far as I can tell, this has all worked well enough.
The question (finally)
I'm now at the point where I need to associate wireless interfaces (i.e. SSIDs on the Mikrotik) to the respective networks (i.e. on the RPi router), but I can't work out how to 'discover' (or whatever the right word is) the AP from the Router or vice versa.
I wondered if it might be the case that, once I'd set up the dumb AP, it would somehow automagically become available from the router, but it didn't ("obviously", I hear you think).
I originally went down a VLAN rabbit hole and came back out off the back of a few other forum posts that suggested that the OP was overcomplicating things, which I thought might be the case for me too. However, I'm wondering if I need to jump back into that rabbit hole and use VLANs to communicate across the two devices?
I hope this is enough info. Let me know if not. Thanks in advance for any help!
Possibly not, to be fair, but I'm not sure if that would solve the problem. The issue is that I can't 'see' my AP from my router (and vice versa) and therefore can't map SSID/WiFi interfaces to zones on my router.
Yep, so the various links above get you to the point where the actual ethernet port is the LAN port, and then a USB-to-ethernet adapter is the WAN port (which, in my case, goes straight to the internet without needing a modem).
When I say 'see', I mean that I don't know how to route traffic from each of the SSIDs/wireless networks on the AP (Mikrotik) to their respective interfaces on the router (RPi)
Please connect to your OpenWrt devices using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood 1
option input REJECT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward ACCEPT
config zone
option name wan
list network 'wan'
list network 'wan6'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
config rule
option name Allow-IGMP
option src wan
option proto igmp
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://github.com/openwrt/openwrt/issues/5066
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option dest_port 546
option family ipv6
option target ACCEPT
config rule
option name Allow-MLD
option src wan
option proto icmp
option src_ip fe80::/10
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
config rule
option name Allow-IPSec-ESP
option src wan
option dest lan
option proto esp
option target ACCEPT
config rule
option name Allow-ISAKMP
option src wan
option dest lan
option dest_port 500
option proto udp
option target ACCEPT
### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
# option src lan
# option src_ip 192.168.45.2
# option dest wan
# option proto tcp
# option target REJECT
# block a specific mac on wan
#config rule
# option dest wan
# option src_mac 00:11:22:33:44:66
# option target REJECT
# block incoming ICMP traffic on a zone
#config rule
# option src lan
# option proto ICMP
# option target DROP
# port redirect port coming in on wan to lan
#config redirect
# option src wan
# option src_dport 80
# option dest lan
# option dest_ip 192.168.16.235
# option dest_port 80
# option proto tcp
# port redirect of remapped ssh port (22001) on wan
#config redirect
# option src wan
# option src_dport 22001
# option dest lan
# option dest_port 22
# option proto tcp
### FULL CONFIG SECTIONS
#config rule
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 80
# option dest wan
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
# option target REJECT
#config redirect
# option src lan
# option src_ip 192.168.45.2
# option src_mac 00:11:22:33:44:55
# option src_port 1024
# option src_dport 80
# option dest_ip 194.25.2.129
# option dest_port 120
# option proto tcp
All traffic should go through the AP then the RPi, yes. That's what I was trying to show in the diagram, but perhaps not successfully..? I was trying to show below each of the two devices (RPi and MT HAP AC2) how they're configured.
Currently, no. This is a brand new, fresh network. I'm currently connected to the AP via LAN (ethernet), in order to get the above terminal output, so I suppose my computer is connected, but only temporarily.
Ok, the most straightforward approach is probably to use VLANs and a trunk between the RPi4 and the AC2.
Before doing anything backup your configs from both devices and check you know how to reset them.
On the RPi4 in the network config remove:
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0'
Change
config interface 'lan'
option device 'br-lan'
to
config interface 'lan'
option device 'eth0.10'
Under config interface 'GUEST' add option device 'eth0.20' and under config interface 'IOT' add option device 'eth0.30'
You'll need to run /etc/init.d/network reload after making the changes, but be aware you will briefly lose connectivity to the RPi4 until you have made the changes on the AC2 to set up the trunk.
On the AC2 ensure the cable between the two devices is connected in the WAN port. Change the contents of the network config to:
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan'
config device
option name 'lan1'
option macaddr 'dc:2c:6e:70:de:0d'
config device
option name 'lan2'
option macaddr 'dc:2c:6e:70:de:0d'
config device
option name 'lan3'
option macaddr 'dc:2c:6e:70:de:0d'
config device
option name 'lan4'
option macaddr 'dc:2c:6e:70:de:0d'
config interface 'lan'
option device 'br-lan.10'
option proto 'static'
option ipaddr '192.168.1.2'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.1.1'
list dns '192.168.1.1'
config device
option name 'wan'
option macaddr 'dc:2c:6e:70:de:0c'
config device
option type '8021q'
option ifname 'br-lan'
option vid '10'
option name 'br-lan.10'
option promisc '1'
config device
option type '8021q'
option ifname 'br-lan'
option vid '20'
option name 'br-lan.20'
config device
option type '8021q'
option name 'br-lan.30'
option vid '30'
option ifname 'br-lan'
config bridge-vlan
option device 'br-lan'
option vlan '10'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
list ports 'wan:t'
config bridge-vlan
option device 'br-lan'
list ports 'wan:t'
option vlan '20'
config bridge-vlan
option device 'br-lan'
option vlan '30'
list ports 'wan:t'
Run /etc/init.d/network reload and then check you have connectivity with the RPi4 again. If that's working then we can look at adding interfaces for the wifi networks.
Thanks for taking the time to write such a comprehensive reply! I'll give it a go shortly. Before I do, could I confirm, where you've said add/replace the br-lan with br-lan.10 (and ditto the other networks) on the RPi, should I leave the static IP and subnet masks in? Or remove those?
In the remaining wifi-iface stanzas add option network followed by the relevant network interface (i.e. lan, GUEST, or IOT). So, for example, in config wifi-iface 'wifinet2' you'd add option network 'lan'.
Having made those changes run /etc/init.d/network reload.
Should that all be done now? I've just had a trawl through some of the settings and it looks good, but I clearly don't know everything I'm looking at/for, so...
Only way to tell is to connect to the wireless networks and test that you're getting the required/expected connectivity. It looks like the firewall config on the RPi4 only has a rule for DHCP & DNS for the guest zone, so if it's intended for devices connected to the IOT network to have DHCP & DNS you'll need to add a similar rule.
Amazing! Thank you so much I'll give it a go later this evening and head back if it doesn't work, but for now I'll mark your explanation's first part as the solution
Hopefully the above is now more useful than the nothing that I provided before 
I'll give it a go later this evening and head back if it doesn't work, but for now I'll mark your explanation's first part as the solution 