VLAN trunk port on r6900v2

MetalFistTerrorist · March 17, 2025, 6:13pm

OpenWRT 24.10.0 on a Netgear r6900 v2
I have a managed Cisco switch passing VLANs 1-4 on both trunk ports I have configured. Those ports are configured identically and I know the first one works, because my actual router passes traffic just fine.
The problem here is that I can't get my netgear to receive/pass VLAN traffic properly, to then bridge those connections to wireless networks; I want VLANs 1 and 2 to be wirelessly accessible.
I followed the documentation in these articles to confirm that the device uses DSA and got to work setting it up while following along:
https://openwrt.org/docs/guide-user/network/dsa/dsa-mini-tutorial
http://openwrt.org/toh/netgear/r6900_v2

In the Network > Interfaces menu and under the Devices tab, I configured "Br-Lan" to include the "wan" ethernet adapter with the lan (1-4) ports and hit save. I then went over to Bridge VLAN filtering, enabled it, added my 2 VLANs, set them as "not-local", and enabled all VLANs on the wan port as tagged, then enabled VLANs on the lan ports as untagged. Finally, I hit apply and ended up having to reset the router because I couldn't access it.

psherman · March 17, 2025, 6:18pm

Can you confirm that you are using the R6900 as a bridged AP?

Some other questions:

what VLAN is used for the management of the device?
What address should the R6900 use on that network (or should it be DHCP assigned)?
Are all 4 VLANs tagged, or is one of them untagged (on the Cisco switch port)?
What physical port is used as the uplink?
What port-VLAN membership should exist on the other ports on your R6900?

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

MetalFistTerrorist · March 17, 2025, 10:16pm

Yes, it's my goal to use the the R6900 as a bridged AP, though I don't know if there's a specific toggle for that; I figured I'd get there by editing configs.

VLAN 99 is for management.
The R6900v2's bridge device has a static ip of 10.0.99.10; my router - 10.0.99.1; the switch - 10.0.99.5.
VLAN 1(Guest) is untagged; VLAN 2(Home) is tagged; VLAN 3(Lab) is tagged; VLAN 4(Management) is tagged.
I'm attempting to use the yellow "WAN" port as the uplink, after including it in the bridge device with the rest of the physical ports.
physical ports 1-4 should have access to VLAN 3. If VLANs 1 and 2 MUST have a physical port assigned, then I'm fine with giving up physical ports 1 and 2

Ubus call system board
{
	"kernel": "6.6.73",
	"hostname": "OpenWrt",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "Netgear R6900 v2",
	"board_name": "netgear,r6900-v2",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "24.10.0",
		"revision": "r28427-6df0e3d02a",
		"target": "ramips/mt7621",
		"description": "OpenWrt 24.10.0 r28427-6df0e3d02a",
		"builddate": "1738624177"
	}
}
_____
cat /etc/config/network
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd5c:be53:fd07::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'wan'
	option acceptlocal '1'
	option ipv6 '0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.0.99.10'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '10.0.99.1'

config device
	option type '8021q'
	option ifname 'br-lan'
	option vid '1'
	option name 'br-lan.1'
	option ipv6 '0'
	option acceptlocal '1'

config device
	option type '8021q'
	option ifname 'br-lan'
	option vid '10'
	option name 'br-lan.10'
	option ipv6 '0'
	option acceptlocal '1'

config device
	option type '8021q'
	option ifname 'br-lan'
	option vid '30'
	option name 'br-lan.30'
	option ipv6 '0'
	option acceptlocal '1'

config device
	option type '8021q'
	option ifname 'br-lan'
	option vid '50'
	option name 'br-lan.50'
	option acceptlocal '1'
	option ipv6 '0'

config device
	option type '8021q'
	option ifname 'br-lan'
	option vid '99'
	option name 'br-lan.99'
	option acceptlocal '1'

config device
	option type 'bridge'
	option name 'Trunk'
	list ports 'br-lan.1'
	list ports 'br-lan.10'
	list ports 'br-lan.30'
	list ports 'br-lan.50'
	list ports 'br-lan.99'
	list ports 'wan'
	option bridge_empty '1'
	option acceptlocal '1'
	option ipv6 '0'

config interface 'trunkPort'
	option proto 'none'
	option device 'Trunk'

config device
	option type 'bridge'
	option name 'GuestBridge'
	list ports 'br-lan.1'
	option bridge_empty '1'
	option acceptlocal '1'
	option ipv6 '0'

config interface 'guestWifi'
	option proto 'none'
	option device 'GuestBridge'

config interface 'homeWifi'
	option proto 'none'
	option device 'HomeBridge'

config interface 'iotWifi'
	option proto 'none'
	option device 'IoTBridge'

config device
	option type 'bridge'
	option name 'HomeBridge'
	list ports 'br-lan.10'
	option bridge_empty '1'
	option acceptlocal '1'
	option ipv6 '0'

config device
	option type 'bridge'
	option name 'IoTBridge'
	list ports 'br-lan.30'
	option bridge_empty '1'
	option acceptlocal '1'
	option ipv6 '0'

config device
	option type 'bridge'
	option name 'LabBridge'
	list ports 'br-lan.50'
	option bridge_empty '1'
	option acceptlocal '1'
	option ipv6 '0'

config device
	option type 'bridge'
	option name 'MGMTBridge'
	list ports 'br-lan.99'
	option bridge_empty '1'
	option acceptlocal '1'
	option ipv6 '0'
_____
cat /etc/config/wireless
config wifi-device 'radio0'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
	option band '2g'
	option channel '1'
	option htmode 'HT20'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80211'
	option path '1e140000.pcie/pci0000:00/0000:00:01.0/0000:02:00.0'
	option band '5g'
	option channel '36'
	option htmode 'VHT80'
	option cell_density '0'

config wifi-iface 'wifinet0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'quarter_deck'
	option encryption 'psk2'
	option key 'password'
	option network 'guestWifi'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Golden Harbor'
	option encryption 'psk2'
	option key 'password'
	option network 'homeWifi'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'tideLink'
	option encryption 'psk2'
	option key 'password'
	option network 'iotWifi'
	option hidden '1'

config wifi-iface 'wifinet3'
	option device 'radio1'
	option mode 'ap'
	option ssid 'tideLink'
	option encryption 'psk2'
	option key 'password'
	option network 'iotWifi'
	option hidden '1'

config wifi-iface 'wifinet4'
	option device 'radio1'
	option mode 'ap'
	option ssid 'Golden Harbor'
	option encryption 'psk2'
	option key 'password'
	option network 'homeWifi'

config wifi-iface 'wifinet5'
	option device 'radio1'
	option mode 'ap'
	option ssid 'quarter_deck'
	option encryption 'psk2'
	option key 'password'
	option network 'guestWifi'
_____
cat /etc/config/dhcp
config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'
	option filter_aaaa '0'
	option filter_a '0'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'
_____
cat /etc/config/firewall
config defaults
	option syn_flood '1'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'
_____

psherman · March 17, 2025, 10:27pm

There are a lot of issues. It will be much faster to reset and start from scratch. You're welcome to make a backup first, but you won't be using it.

Please reset and then post your network config file again... I'll show you how to configure it based on your goals.

MetalFistTerrorist · March 17, 2025, 10:38pm

I ran firstboot && reboot now and got it back to default settings. Here's /etc/config/network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd69:96ed:ec78::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'

Thank you.

psherman · March 18, 2025, 1:38am

I noticed a discrepancy in your description:

and

I'm assuming you want both VLAN 4 and VLAN 99 added... I'll work with that assumption.

Thanks for the fresh config... let's make the changes:

Delete the wan/wan6 interfaces:

Add the wan port to br-lan so it looks like this:

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'wan'

Now create the bridge-VLANs:

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'wan:u*'

config bridge-vlan
	option device 'br-lan'
	option vlan '2'
	list ports 'wan:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '3'
	list ports 'lan1:u*'
	list ports 'lan2:u*'
	list ports 'lan3:u*'
	list ports 'lan4:u*'
	list ports 'wan:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '4'
	list ports 'wan:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '99'
	list ports 'wan:t'

Now we can create our interfaces... unmanaged except for VLAN 99.

config interface 'guest'
	option device 'br-lan.1'
	option proto 'none'

config interface 'home'
	option device 'br-lan.2'
	option proto 'none'

config interface 'lab'
	option device 'br-lan.3'
	option proto 'none'

config interface 'management'
	option device 'br-lan.4'
	option proto 'none'

And we'll create the management interface on VLAN 99 by slightly modifying the lan interface:

config interface 'lan'
	option device 'br-lan.99'
	option proto 'static'
	option ipaddr '10.0.99.10'
	option netmask '255.255.255.0'
	option gateway '10.0.99.1'
	list dns '10.0.99.1'

All of the above assumes you want VLAN 4 as a different management network vs VLAN 99 for your actual infrastructure management. If not...

If VLAN 4 is the real (and only) "management" VLAN, you can
- you can omit the bridge-vlan for VLAN 99
- set the device in the lan interface to br-lan.4
Or if VLAN 4 is not actually being used for anything, and it's actually VLAN 99 that is needed:
- simply omit the bridge-VLAN for VLAN 4
- and also omit the respective unmanaged network interface

From here, you can create SSIDs and then link them to the network names.

Restart when you're done, and connect the wan port to the upstream network.

MetalFistTerrorist · March 18, 2025, 3:24am

Wow... thank you so much for this. After getting my SSIDs setup, everything worked like a charm. I knew that whatever I was attempting was going too far, but I had zero idea how far I had gone. Thank you again for this explanation. This also helps me better understand VLANs and trunking, in general.

system · March 28, 2025, 3:24am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.