VLANs with WRT54GS

Dynamic VLAN is for Enterprise authentication. Users will all connect to the same SSID but end up potentially attached to different VLANs based on the RADIUS server looking at their username or other credentials.

This sounds like not what you want.

If you want two separate SSIDs on the radio, with everyone using a SSID in their same VLAN, but isolated from the users on the other SSID and VLAN, that is commonly called a guest network configuration.

There you create two network bridges, one for each VLAN. The wifi APs are in those separate bridges, as well as a VLAN tagged Ethernet port.

The different classes of wifi users, connected to their different SSID, all end up going out on the same Ethernet cable but with different VLAN tags. Your main router (pfsense) will handle that.

I would suggest starting with two APs with different SSIDs but both simply connected to the LAN bridge. This will show that the radio driver can at least do that.

@mk24: I've the configuration with an internal WLAN and a second WLAN (guest) already running with my new Netgear and Linksys. I didn't succeed with my old WRT54GS. I'm not sure if I tried 2 SSIDs on the same LAN bridge. My WRT54GS is currently "retired", I've no chance to test it any more.