228

FANTASTIC video on configuring Openwrt VLANs (youtu.be)

submitted 3 weeks ago* (last edited 3 weeks ago) by Imaginary_Stand4909 to c/selfhosted@lemmy.world

14 comments fedilink hide all child comments

Just wanted to share this Youtube video (Invidious link here) that explains how to configure Openwrt VLANs for your Wifi network! I was struggling for hours today trying to configure VLANs on my Openwrt AP when I found an old Reddit thread linking to this guy's channel!

He seems to have a whole series on Openwrt, so if you need a complete beginner guide he sounds great!

you are viewing a single comment's thread
view the rest of the comments

[-] NerdsGonnaNerd@sh.itjust.works 2 points 3 weeks ago

Sure, my configs are below, you might have to adapt them to your needs.

I would recommend to backup your files before changing them.

As I said I let an llm generate them, I basically just put in my current version of the files and stated my intend. I dont know if the bellow config is any way optimal, but for now it works. :P

For the IoT Network I had to disable WWM Mode in the GUI afterwards. Furthermore I disabled the 5ghz band for the IoT network. Otherwise my shelly1 devices wouldnt connect to the new wifi.

The rest of the setup I did according to this Guide: beginners-guide-to-set-up-home-network-using-opnsense

/etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'
        option ipv6 '0'

#
***
Bridge VLAN filtering
***
# VLAN 1 = untagged (native/PVID), VLAN 10 = tagged
config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'eth0:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '10'
        list ports 'eth0:t'

# Management interface (VLAN 1)
config interface 'lan'
        option device 'br-lan.1'
        option proto 'static'
        option ipaddr '10.10.10.10'
        option netmask '255.255.255.0'
        option gateway '10.10.10.1'
        list dns '10.10.10.1'
        option delegate '0'

# IoT interface (VLAN 10) — no IP needed, just bridges WiFi to VLAN
config interface 'iot'
        option device 'br-lan.10'
        option proto 'none'

/etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option cell_density '0'
        option disabled '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'NerdFi'
        option encryption 'sae-mixed'
        option key 'SuperSecretPassword'
        option ocv '0'

config wifi-iface 'iot_radio0'
        option device 'radio0'
        option network 'iot'
        option mode 'ap'
        option ssid 'NerdFi-IoT'
        option encryption 'sae-mixed'
        option key 'SuperSecretPassword'
        option ocv '0'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '36'
        option htmode 'HE80'
        option disabled '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'NerdFi'
        option encryption 'sae-mixed'
        option key 'SuperSecretPassword'
        option ocv '0'

config wifi-iface 'iot_radio1'
        option device 'radio1'
        option network 'iot'
        option mode 'ap'
        option ssid 'NerdFi-IoT'
        option encryption 'sae-mixed'
        option key 'SuperSecretPassword'
        option ocv '0'

/etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '0'
        option filterwin2k '0'
        option localise_queries '0'
        option rebind_protection '0'
        option rebind_localhost '0'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '0'
        option nonegcache '0'
        option authoritative '0'
        option readethers '0'
        option leasefile '/tmp/dhcp.leases'
        option nonwildcard '0'
        option localservice '0'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option ignore '1'

config dhcp 'iot'
        option interface 'iot'
        option ignore '1'

/etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'lan'
        list network 'lan'
        list network 'iot'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

this post was submitted on 01 Aug 2026

228 points (100.0% liked)

Selfhosted

61708 readers

420 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world