OpenWRT 21.02 - Wifi Manual VLAN Filtering (Bug)

I recently moved to a new flat and I am redeploying my home network. Before reconnecting all devices, I have noticed that there was a new OpenWRT version and my devices supported it.

The biggest change I have noticed so far is the new switch configuration that has been migrated to DSA.

The management network configuration was quite simple to migrate after reading the OpenWRT wiki. However, the wifi has been a bit more trickier. It seems that I have found a bug in LuCI.

This article is being written as an attempt to reproduce the bug.

I have asked on OpenWRT forum for confirmation if this behaviour was a bug and surprisingly no it is NOT. As pointed out by the user @mk24 an unmanaged interface should be created before the wifi. Check Step 04 for reference and/or read @mk24's response here

1) Creating a new Wifi Network

I have created a network as seen in the pictures below:

The wifi network has no Network selected because it will be part of a L2 domain only and my pfSense will do the firewalling/routing.

2) VLAN Configuration

The new wifi network has been added as wlan1 and I will disable IPv6.

I has not been listed as an available device in the bridge interfaces list. However, it is not a problem because we can tick custom and insert the Wifi interface name and save & apply the changes.

I am not sure why, but it seems that although the webUI sees the interface as part of the bridge and the webUI shows the device in the VLAN Filtering tab.

The command line shows a diffent scenario.

I will use the webUI to set the VLAN as intended.

And, the command line shows the opposite seen on the webUI. Even after a reboot.

wlan0 is not listed anymore because the iproute2 commands are not persistent.

3) VLAN Manual Configuration

It is possible to manually configure the VLAN as shown below.

brctl addif br-lan wlan0
brctl addif br-lan wlan1
Adding the Wifi interfaces to the Bridge.
root@r1:~# brctl show
bridge name     bridge id               STP enabled     interfaces
br-lan          7fff.xxxxxxxxxxxx       no              lan1
Bridge interfaces.
bridge v s
port              vlan-id  
lan4              4
lan1              20
br-lan            4
wlan1             1 PVID Egress Untagged
wlan0             1 PVID Egress Untagged
Bridge VLAN configuration.
bridge vlan del dev wlan0 vid 1
bridge vlan del dev wlan1 vid 1
Deleting VLAN 1 from the interfaces.
bridge vlan add dev wlan0 vid 20 pvid 20 untagged master
bridge vlan add dev wlan1 vid 20 pvid 20 untagged master
Adding the VLAN config to the bridge.
bridge v s
port              vlan-id  
lan4              4
lan1              20
br-lan            4
wlan1             20 PVID Egress Untagged
wlan0             20 PVID Egress Untagged

The Wifi now works as expected. My network configuration has some complexity. However, DSA came to openWRT and made easier the virtual networking configuration.

It worth mention that the commands above have to be added to System -> Startup -> Local Startup otherwise it will be wiped after a reboot since iproute2 commands are not persistent.

4) Layer 2 WIFI Network with VLAN Filtering

We need to first create an unmanaged interface.

Adjust the VLAN Filtering on the main bridge.

In my case, lan1 is a trunk port that is connected to my switch.

And finally, let's create the wifi network. We need to make sure that we are selecting the newly created network.

The configuration above bridges our wifi network in a Layer 2 broadcast domain allowing our pfSense to control the Layer 3.


Converting to DSA
Converting to DSA Some OpenWrt 21.02 (and newer) devices use DSA for configuring network interfaces. If you are upgrading your router to a firmware version that uses DSA, you should read this page. Note: There is a companion DSA Mini-Tutorial article that you can review.
OpenWRT 21.02 - Wifi Manual VLAN Filtering (Bug) !?
Do it in reverse order from what you did. In other words have everything else ready before creating the wifi AP, so that its network already exists and you can choose it from the wifi page. Do not try to back-reference wifi interfaces from other parts of the configuration, since their names may ch…

Share Tweet Send
You've successfully subscribed to Infoitech - [B]logging
Great! Next, complete checkout for full access to Infoitech - [B]logging
Welcome back! You've successfully signed in
Success! Your account is fully activated, you now have access to all content.