I have finally managed to get openWRT flashed onto the WAX620 access point, but I'm a bit stumped with setting up wireless networks that point the the VLANs set up on the router elsewhere on my network. I'm not entirely wrapping my head around how openWRT wants to do this.
Normally I set an SSID to a VLAN ID. I'm not seeing an equivalent for that here and what I'm finding online isn't quite adding up for me either.
The VLANs are defined as part of a bridge structure in /etc/config/network and those bridges are used as the device for network interfaces. The wifi config (in /etc/config/wireless) has a line for the network to which the SSID will be associated.
Since your AP has just a single ethernet port, it's likely that you can define bridges using simple dotted notation (i.e. eth0.10 for VLAN 10 tagged) inside a bridge per VLAN/network (i.e. br-lan and br-guest, etc.).
On an AP, usually you will set one network with an address on the VLAN that is used to manage the device itself (i.e. your trusted lan or management network), and then the others will be unmanaged (option proto 'none').
If you need more directed help, let's start with the configs so we can show you specifically how to do it with your device.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
root@OpenWrt:~# ubus call system board
{
"kernel": "6.12.94",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 4",
"model": "Netgear WAX620",
"board_name": "netgear,wax620",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r33051-f5dae5ece4",
"target": "qualcommax/ipq807x",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option dhcp_default_duid '0004db2c6041915d45b3b615e472cd956296'
option ula_prefix 'fdd6:d770:3773::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
config interface 'lan6'
option device 'br-lan'
option proto 'dhcpv6'
you know, I'm not seeing any reason the AP should have IPv6 access itself. I just want it to pass traffic. other things running through it, fine, IPv6, but the AP, no, so I think I need to fix that too.
So to make this work, you simply need to add the following (in this example, it'll be a guest network on VLAN 10)
config device
option name 'br-guest'
option type 'bridge'
list ports 'lan.10'
config interface 'guest'
option device 'br-guest'
option proto 'none'
Then, create a new SSID and set the associated network to guest.
Obviously adapt for your specific VLANs and network names.
I'm not able to map the SSIDs to the interfaces
Hello, after the Vlans are created, you can go to the wireless interfaces in Luci, select the radio, create the SSID, always make sure to select the proper country ID, network security, channel, and network VLan. If you do not get an IP, check the DHCP server for that interface, the network firewall zone can send packets to the WAN zone ( to get out to the internet)
I hope I did not confuse you, but if you check in that order in Luci, it will make sense.
it doesnt list the other interfaces, even after reboot.
I looked more online and came up with this, which did make for selectable interfaces....
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
option vlan_filtering '1'
config interface 'lan'
option device 'br-lan.1'
option proto 'dhcp'
config bridge-vlan
option device 'br-lan'
option vlan '1'
list ports 'lan:u*'
config bridge-vlan
option device 'br-lan'
option vlan '3'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '4'
list ports 'lan:t'
config bridge-vlan
option device 'br-lan'
option vlan '5'
list ports 'lan:t'
config interface 'guest'
option device 'br-lan.3'
option proto 'none'
config interface 'iot'
option device 'br-lan.4'
option proto 'none'
config interface 'theidiot'
option device 'br-lan.5'
option proto 'none'
This works but performance is.....awful
Bridge VLANs should work just fine, but have you (re)tried the direct dotted notation method I provided earlier?
Also, please describe in what way the performance is bad? For example, is inter-vlan routing the issue? or general throughput to the internet? Have you directly compared this performance on the main lan (i.e. VLAN 1) before and after implementing the bridge-vlans on the AP?
I'm getting about half the performance I would expect over wireless when running speed tests to the internet. I'm running this over the untagged side right now.
playing with channels and channel widths doesnt help. dot notation didn't lead to selectable interfaces in Luci for SSID assignments
The primary question is if the performance decrease is directly related to the vlan config. Try rolling back to your previous config without the VLANs and test.
I didnt have a previous config. I flashed at went right to this so I don't really have anything to compare to. this is the first config that worked.
The config you shared at the beginning of this thread did not have any VLANs configured. That is the one to use as a test case.
Okay I tried that again, even tried testing right under the AP (it's on the ceiling), no difference in performance
So the problem is not related to the VLANs at all. That was one important element to prove/disprove.
Next test -- connect a computer via ethernet to the router/switch port that is currently used for the AP (unplug the AP); ideally use the same ethernet cable that is being used for the AP. Perform the speed test again. This will tell us if the problem is related to AP itself or something upstream (including the cable).
wired: 940down, 925 up
wifi: 306down, 250 up
edit: I noticed in network->wireless, the country code is US, as I set it, but in status->overview->wireless, country code is 00. could that be relevant?
edit again: I'm seeing some other settings I set and saved that somehow reverted. time format and hostname reverted to defaults for some reason.
You should set the correct country code for your location.
The WiFi speeds seem quite reasonable. Don’t forget that WiFi speeds are affected by all sorts of environmental factors in addition to the typical things like distance, radio configuration and capabilities and the client devices.
You can go ahead and restore your vlan config since we know that is not negatively affecting anything.
Once that is done, we can take a look to see if there are any other reasonable optimizations we can do.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
that same device running in the same environment was much faster on stock firmware than openWRT. I realize there some some use cases where that is to be expected, but given it isn't doing any routing at all and the performance isn't just a bit lower but MUCH lower, I'm not convinced this is a wifi<wired issue.
root@OpenWrt:~# ubus call system board
{
"kernel": "6.12.94",
"hostname": "OpenWrt",
"system": "ARMv8 Processor rev 4",
"model": "Netgear WAX620",
"board_name": "netgear,wax620",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "25.12.5",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r33051-f5dae5ece4",
"target": "qualcommax/ipq807x",
"description": "OpenWrt 25.12.5 r33051-f5dae5ece4",
"builddate": "1782737960"
}
}
root@OpenWrt:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
list ipaddr '127.0.0.1/8'
config globals 'globals'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan'
config interface 'lan'
option device 'br-lan'
option proto 'dhcp'
config interface 'lan6'
option device 'br-lan'
option proto 'dhcpv6'
root@OpenWrt:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi'
option band '5g'
option channel 'auto'
option htmode 'HE80'
option country 'US'
option cell_density '1'
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi+1'
option band '2g'
option channel '1'
option htmode 'HE20'
option country 'US'
option cell_density '1'
config wifi-iface 'wifinet2'
option device 'radio1'
option mode 'ap'
option ssid ‘REDACTED’
option encryption 'sae'
option ocv '0'
option key ‘REDACTED’
option disabled '1'
config wifi-iface 'wifinet1'
option device 'radio0'
option mode 'ap'
option ssid ‘REDACTED’
option encryption 'sae'
option ocv '0'
option key ‘REDACTED’
option disabled '1'
config wifi-iface 'wifinet3'
option device 'radio0'
option mode 'ap'
option ssid ‘REDACTED’
option encryption 'sae'
option ocv '0'
option key ‘REDACTED’
option disabled '1'
config wifi-iface 'wifinet4'
option device 'radio1'
option mode 'ap'
option ssid ‘REDACTED’
option encryption 'sae'
option ocv '0'
option network 'lan'
option key ‘REDACTED’
config wifi-iface 'wifinet5'
option device 'radio0'
option mode 'ap'
option ssid ‘REDACTED’
option encryption 'sae'
option ocv '0'
option network 'lan'
option key ‘REDACTED’
What speeds were you seeing with the vendor firmware?
Do you happen to remember what channel and channel width was in use when you were last on the vendor firmware?
I remember somewhere around 800 both ways, a little less on the upload than download, when using a 5Ghz channel 80Mhz wide. I don't remember the specific channel, but it was 149 or higher.
800 seems higher than I would expect. But go ahead and try the channel and width you think was used at the time of the last test on the vendor firmware.