My target is to have two VLANs, one for IOT/HomeKit components and the other one for laptops, iPads etc. I also want to be able to limit the internet access for single IOT components for privacy purposes in the future.
I created two SSIDs, one for the standard things and one for IOT. The SSIDs run on both APs, who are connected to eth 1/1/2 and 1/1/4 on the switch. The router is connected to the switch on eth 1/1/1 on the switch and on LAN 1 on the router. Internet comes into the router on the Internet/WAN port.
On the management VLAN 1 I left eth 1/1/1 untagged and tagged it in VLANs 2+3. I also tagged eth 1/1/2 and eth 1/1/4 on the new VLANs.
I created the VLANs on the switch. "Management" VLAN 1, Standard VLAN 2 and IOT VLAN 3. VLAN 1 has the IP range 192.168.1.1/24, VLAN 2 192.168.2.1/24 etc. with the gateway being the router IP.
The router has the IP 192.168.1.1 and the switch has the IP 192.168.1.180
When I connect the the new SSIDs, the respective device does not have a connection to the internet, so next step was to trunk the ports I mentioned above between router and switch for the new VLANs, as my assumption is/was that the devices in the new VLANs do not get IPs via DHCP.
You'll need to use another vlan number for standard, as it is already in use in OpenWrt for the wan port.
vlan3 interface is not assigned to any firewall zone and I presume that the default policy is to drop incoming packets, hence the dhcp discoveries won't reach the dhcp server.
I'll also add the following recommendation:
Set one of the router ports (say port 4) as an access port for your new VLAN (i.e. VLAN 3 untagged on port 4, other VLANs off). This way you can plug a computer directly into the router to make it easy to test the router configuration without having to worry about the other switch. This isolation will help you verify the VLAN functionality and isolate the different potential culprits.
Still no internet on vlan3! It still gets no IP that I have assigned to the vlan on the router, but I assume the dhcp server on the router does not know what IP range I assigned. How can I influence which IPs are assigned to a vlan?
Same result, stuck at "identifying" and then "unidentified network". I tried to assign an ip manually within the IP range I defined for VLAN 3 (192.168.3.2), with the router as the gateway, but that also does not work.
Ok... so now you need to do a wired test on the other switch to make sure the VLANs are configured properly on that device. Setup an access port for VLAN3 (untagged) on one of the ports and make sure that you can connect through that switch.