Changed my text and wrote a how to. I was searching about how to do it.
VLAN is actually more straight forward since the new OpenWRT version 21.02.
My goal was to set up as a Acces Point only (that was easy, but a Wizard or such should be helpful that can disable many settings), ofcourse it all worked fine out. For convenience I found a guide, see link below.
I couldn’t get my head arround for the VLAN setup. I have many VLAN’s and have to deal with several SSID's I wanted to assign to a to VLAN.
There are many examples, YoutTube (horrible presentations and explanations, perhaps i should give it a shot), that didn’t fit my use case. I didn’t need the router function in OpenWRT, for this is have PFSense and also my gateway to the internet and ofcourse my firewall.
Assumption you have network knowledge to follow this guide, i don’t explain the technology itself, only how to get it done.
The steps I have followed to get it done:
First my Hardware: TP-LINK Archer C6U > OpenWRT 21.02
I wanted to try Mediatek chipset, looks good and feels stable (using OpenWRT since 2011).
- Access Point setup
- Convert WAN as an usable interface
- Create/add VLAN's
- Change "Bridge: br lan" into "Sofware VLAN: [vlan you have created]"
- Create Interface's for the added VLAN's
- SSID's assigned to their "Ïnterface" VLAN's
Step 1 - Access Point setup
Follow the guide as written in the guide for OpenWRT 21.01
Do the steps 1 - 9 (till you read: In versions of OpenWrt older than 21.02.0)
[OpenWrt Wiki] Wireless Access Point / Dumb Access Point
Additional: I have removed ALL firewall policies and disabled SYN-flood:
|> Network |> Firewall |> [removed all polices]
Step 2 - Convert WAN as an usable interface
Just delete any WAN the interfaces:
|> Network |> Interfaces |> [delete all WAN}
Step 3 - Create/add VLAN (only submit changes when in step 4 when doing this for the first time)
|> Network |> Devices |> Configure [br-lan] |> Bridge VLAN filtering |> Enable VLAN Filtering |> [create/add your VLAN's]
VLAN will "devices"wil be automatically created
When configuring "Egress untagged" on the Physical Interface (can be only done for 1 VLAN at a time), it makes sense to tik the box of "Primary VLAN ID", if devices should communicate on the local interfaces in the same VLAN on your TP-LINK device.
Assigned my TP-Link physical WAN interface as my TRUNK interface: [Egress tagged] for the VLAN's I want them trunked.
Step 4 - Change "Bridge: br lan" into "Sofware VLAN: [vlan you have created]"
|> Network |> Interfaces |> [br-lan] Edit |> Device |> [change] "Bridge: br lan" into "Sofware VLAN: [vlan you have created]"
Make sure the IP sits in the Subnet of that VLAN you creates...
Step 5 - Create Interface's for the added VLAN's
To assign your SSID to an VLAN, a Interface is needed. Make sure the VLAN is set [Egress tagged] as described in Step 3.
|> Network |> Interfaces |> Add new interface |> Name [give it a name] |> Protocol [Unmanaged] |> Device [select your Sofware VLAN: br-lan.xx]
Now you have an interface that can be selected when creating a new SSID.
Step 6 - SSID's assigned to their "Ïnterface" VLAN's
|> Network |> Wireless |> [select your SSID/ or create one] Edit |> Network |> [select here your VLAN/your created Interface]
This worked for me.
My home network:
PFSense that is my firewall and gateway to the internet (and VPN to my home). PfSense has many virtual interfaces for the VLAN's.
Netgear switches where VLAN and TRUNK is enabled and have un-tagged interfaces.
many TP-Link devices running with OpenWRT that provided WiFi AP in my house with multiple SSID's in their own VLAN.
Using ESX hypervisor to setup VM's for home services.