Trouble with VLAN configs and multi-AP access to multiple VLANs

I'm attempting to setup a multi-router configuration of OpenWRT. I'd like something close to the following:

  1. A main network for trusted devices. No restrictions. Anything on this network should be able to reach any device on any other network/VLAN as well.
  2. A guest and IoT style network for untrusted devices which need internet access. Nothing on this network should be able to see any other device (including devices on the same network/subnet/VLAN).
  3. A local-only network without internet, where devices on this network can see only this network/subnet/VLAN.
  • I would want networks 1 and 3 to be accessible by Wi-Fi or by Ethernet, and network 2 only accessible by Wi-Fi.
  • Network 1 should be able to reach anything on any other network. Eg; A printer on network 3 should be reachable by a device on network 1, and a web gui on a device on network 3 should be accessible by network 1, and a computer on network 2 should be ssh-able by a computer on network 1. But anything on network 2 or network 3 shouldn't be able to reach network 1 as outbound connections which network 2/3 are originating.

I'm attempting to configure this in the GUI but I'm running into various problems and confusions. I can't seem to make much sense out of the docs to clear it up either.


If I go to Network -> Interfaces -> Devices, I can add a bridge device without specifying a physical bridge port (br-test). Then, going to Network -> Interfaces -> Interfaces, I can create a separate network for this bridge device (nw-test). I can then go to Network -> Wireless and create a new SSID and tie it to the new network created (nw-test).

This seems to provide a Wi-Fi network which I can connect to, but it's unclear to me how I would control wired access, internet access, and cross network communication for each network/subnet/VLAN. There's a checkbox in the Wireless settings page for isolating devices, but that doesn't allow me to do so for wired connectivity.

It's also unclear if I should be creating a VLAN for this purpose instead, and how exactly I would go about doing that. Would I want to create a new VLAN "device", or would I want to modify the VLAN settings of a bridge "device?"

It's extremely hard to tell which direction is the correct direction to take.


I'm also in need of extending all of these networks across multiple OpenWRT devices. I believe I'd want Wi-Fi roaming for this? https://openwrt.org/docs/guide-user/network/wifi/roaming

But I'm not exactly sure what I would want to configure for this, and how it would carry over the separate networks/subnets/VLANs between devices. I was expecting something resembling a, "Wi-Fi repeater" mode type of thing where I could easily link multiple OpenWRT devices together and tell them to go at it, but I can't seem to find that.


I would greatly appreciate any help in this matter. I've been trying to configure this for most of the day, and it's been frustrating to find good documentation to follow for this. Thanks!

The specific devices in use will dictate the methods by which you actually realize this configuration.

All of your networks will need to be available on ethernet in order to handle the bridged APs, but those can be limited to trunk ports such that the only access ports are for networks 1 and 3.

The router will be the main device and it's in charge of all of the routing. I'm assuming of course that the APs will be connected to ethernet -- in this case, they can simply be setup as bridged APs with the addition of the VLANs to enable all 3 of your networks to be broadcast from each AP.

Roaming is a client side process and will happen automatically as long as things are configured properly on your router and APs.

So... a few questions:

  • What devices are in use for the router and each AP (what is the output of ubus call system board)?
  • How are they connected (specifically, which ports are used on each device and where do all the cables go)? A system topology diagram can be really useful -- please be sure to label the devices and the port numbers.
  • Do you have any switches in your system now? If so, are they managed or unmanaged, and where are they in the topology (again, that diagram will be useful)?
  • What do you want the other router/AP ethernet ports to do (please specify for each port)?

Thanks for the reply!

The specific devices in use will dictate the methods by which you actually realize this configuration.

I'm confused why the device hardware matters since it's all OpenWRT, but I'm using 1 Linksys MX4300 and 1-3 MX4200 routers. They're equivalent in nearly every way other than RAM. They have three LAN ports and one WAN/Internet port. The MX4300 would be the main router and AP, with the MX4200's being the other APs for extended range.

These devices have three wireless interfaces - two 5Ghz and one 2.4Ghz. I'm using the 2.4Ghz one for network 3.

All of your networks will need to be available on ethernet in order to handle the bridged APs, but those can be limited to trunk ports such that the only access ports are for networks 1 and 3.

The router will be the main device and it's in charge of all of the routing. I'm assuming of course that the APs will be connected to ethernet -- in this case, they can simply be setup as bridged APs with the addition of the VLANs to enable all 3 of your networks to be broadcast from each AP.

The AP's won't be connected via ethernet, save one ethernet cable being accessible to one AP from the main router, which probably wouldn't be super helpful when trying to share three networks. If I really had to, I might could get away with this AP only broadcasting a single network/subnet/VLAN from there (and just use the bridged AP mode that you linked), but I'm not sure how optimal that is yet. The other APs would definitely need to be wirelessly repeated.

Roaming is a client side process and will happen automatically as long as things are configured properly on your router and APs.

I understand that the decision of when to roam is client side, but what I was asking about was what configuration is required on the router/AP side to actually make that transition smooth, beyond just ensuring 802.11r is enabled for example. You allude to it here but I can't really tell what else I'd need to change in order to ensure they are treated as the same roaming network beyond just the same SSID (and maybe MAC? But that seems like it'd cause a lot of problems with duplicate packets and speaking priority, etc).

What devices are in use for the router and each AP (what is the output of ubus call system board)?

For devices - the main router would be the MX4300, and the other 1-3 would be MX4200.

Output per request:

$ ubus call system board
{
	"kernel": "6.12.87",
	"hostname": "OpenWrt",
	"system": "ARMv8 Processor rev 4",
	"model": "Linksys MX4300",
	"board_name": "linksys,mx4300",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "25.12.4",
		"firmware_url": "https://downloads.openwrt.org/",
		"revision": "r32933-4ccb782af7",
		"target": "qualcommax/ipq807x",
		"description": "OpenWrt 25.12.4 r32933-4ccb782af7",
		"builddate": "1778712129"
	}
}

How are they connected (specifically, which ports are used on each device and where do all the cables go)? A system topology diagram can be really useful -- please be sure to label the devices and the port numbers.

Nothing OpenWRT is connected yet really, I've been trying to get the basic networks structured in the OpenWRT configuration before I attempt to tear down my existing network (conceptually very similar, but with different devices for each subnet and lacking in wireless repeating).

I don't think a diagram is going to be any more useful than what I've already laid out, but I'll try to clarify: All three networks should provide wireless connectivity at every AP. Only networks 1 and 3 need ethernet ports, and the only need for ethernet ports from a physical router/AP is at the main router (MX4300). So let's say: ports 1-2 for network 1, port 3 for network 3 (again, all only on the one MX4300). Everything else is wireless, or handled with a switch which is outside of the scope of this OpenWRT configuration. All AP's (including the MX4300) would need to provide wireless access to all networks. The only thing connecting AP's together and to the router is wireless connectivity. Naturally, it is assumed that each AP is in range of at least one other device. I don't think I'll have too much conflict or hidden node / exposed node problems to the point of causing problems. If a specific 802.11 feature specification could help with this, that might be useful.

To me this seems straightforward. The OpenWRT part of things is just one device providing routing and ethernet, and a few wireless repeaters - just with three networks/subnets/VLANs. If you really want a diagram I can try to make one, but I cannot imagine how this in visual would be easier to follow, especially if I'm the one making the diagram.

Do you have any switches in your system now? If so, are they managed or unmanaged, and where are they in the topology (again, that diagram will be useful)?

Yes, but that's 100% not relevant to any of this. It's all completely downwind of OpenWRT. Their configuration won't be changing a single bit as a result of me trying to use OpenWRT. It's simply out of scope of what I'm stuck with in OpenWRT - I can ensure I have the correct subnets for my existing networks configured in OpenWRT once I can figure out how to get OpenWRT to provide the proper network separation I'm going for.

Just for completion and your curiosity, I'll have several switches connected to networks 1 and 3, but any DHCP involved is handled via OpenWRT. There's nothing competing with OpenWRT for routing in any way.

The only detail in my mind which might be relevant is that I'll have one computer with two ethernet NICs connected (to switches, which are ultimately connected to the main router / MX4300) to both networks 1 and 3. This serves a separate primary purpose, but I currently use this dual connectivity along with static routing and IP forwarding to give my current "equivalent" to network 1 access to the current "equivalent" of network 3. I'd still want to keep this dual NIC connectivity for this singular computer even if I could access network 3 from network 1 purely from OpenWRT.

I know I could do the same static routing and IP forwarding setup with OpenWRT, but I was really expecting OpenWRT to have a better built in solution, especially with the networks being managed by the same device now.

What do you want the other router/AP ethernet ports to do (please specify for each port)?

It could conceivably be useful to specify access to perhaps network 2 or 3 from a port on those other APs, though I hadn't given it much thought. I'd likely want ports 1-2 to be network 2, and port 3 to be network 3, assuming the WAN/internet port is either in use for sharing a network to this AP (as above - unlikely), or it's all just wirelessly repeated.


I'm really just stuck on which of the seemingly several approaches I have to configuring separate networks on shared devices here, and then how I'd go about repeating all of those networks. I was hoping there was a simple "checkbox" of sorts to have OpenWRT connect themselves together (providing relevant credentials of course) and solve this problem for me, with only the main router (MX4300) needing any real configuration at all. I thought that's what a mesh network was, but I recently learned otherwise.

I hope I was able to clarify some of this, please let me know if I can clarify it further. Thanks again for the help!

The hardware matters mainly because the switch/VLAN model and wireless capabilities differ between targets. The bigger issue in your updated plan is the wireless backhaul: a normal routed/bridged AP design with multiple VLANs assumes an Ethernet trunk between the main router and each AP. If the extra nodes are only wireless repeaters, you generally should not expect clean separation for several VLANs/SSIDs unless you build a supported WDS/802.11s/mesh backhaul and test whether it carries the needed tagged networks reliably on those devices. I’d first make it work with one wired AP and VLAN trunk, then add wireless backhaul only after that baseline is understood.