[solved] Adding a new network

[azu]

Pasting here the multiple solutions (cannot edit title to add [Solved]):

@ncompact

unfortunately your router has not yet switched to the DSA version but you still have swconfig

@ncompact

for x in /etc/config/*; do uci show "${x##*/}" >/dev/null || echo "$x is broken"; done

@psherman

Bridges need to be defined separately, not in the network interface stanza. We can also remove the dns servers here because they don't do anything.

@azu

config interface 'sp'
        option proto 'static'
        option device 'eth0.100'
        option ipaddr '192.168.100.1'
        option netmask '255.255.255.0'
        list dns '8.8.8.8'
        list dns '1.1.1.1'
        list dns '192.168.1.1'
        option type 'bridge'

Instead, it should look like this:

config device
        option name 'br-sp'
        option type 'bridge'
        list ports 'eth0.100'

config interface 'sp'
        option proto 'static'
        option device 'br-sp'
        option ipaddr '192.168.100.1'
        option netmask '255.255.255.0'

You can also delete this:

@azu

config device
        option name 'eth0.100'
        option type '8021q'
        option ifname 'eth0'
        option vid '100'

These changes will fix the wifi issue. But, if the DNS still doesn't work, please post your /etc/config/dhcp file for review.

EDIT: Adding stuff for the DNS issue:

I see you have 3 rules related to DNS here...

@azu

config rule
        option name 'SP DHCP and DNS'
        option src 'sp'
        option dest_port '53 67 68'
        option target 'ACCEPT'

config rule
        option name 'SP to LAN DNS'
        list proto 'udp'
        option src 'sp'
        option dest 'lan'
        list dest_ip '192.168.1.254'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'SP to WAN DNS'
        list proto 'udp'
        option src 'sp'
        option dest 'wan'
        option dest_port '53'
        option target 'ACCEPT'

The first rule is not necessary (currently) because your sp firewall zone has input = accept.

The last rule can be deleted because there is nothing that would block DNS requests from the sp network to the wan (since sp > wan forwarding is allowed).

The middle rule points to a host in your lan -- this one could be relevant if you set DHCP option 6 on the sp DHCP server -- did you set it to this address? And if so, is that address correct (i.e. a DNS server is listening at that address)? If you're using a PiHole or other server on the lan, you do need to make sure it will respond to requests from other subnets (this can be a function of that host's firewall and/or DNS server configuration).

Omitting option 6 from the DHCP server will cause the DHCP server to advertise the router itself (192.168.100.1) as the DNS server and DNS lookups should work. Likewise, setting option 6 to a public DNS server (like 1.1.1.1 or 8.8.8.8) should also work.

Since we don't know what you have in the DHCP file, this is just a guess as to why your DNS isn't working -- but I suspect that this should help you solve the issue. If not, please post that file.