I have an old router that I managed to install openwrt on it. My router is EdgerouterX from Ubiquiti. I want to use the openwrt router as an AP connected to the Edgerouter. I need the AP to provide internet to Guests so it should be isolated from LAN. I read about the VLAN in EdgerouterX and also Openwrt. I'm confused as it seems the VLAN concept is a bit different in Openwrt.

How do I tag the packets from AP in openwrt so they can be treated correctly in the EdgerouterX?

  • Is the Edgerouter X has two (or more) LAN ports you can use port isolation, which is far far simpler to understand (and therefore to manage). Some devices call these VLANs. Some understand real VLANs and so call this port isolation. – roaima Jan 27 '17 at 21:56

You do not necessarily need to tag the packets on the OpenWRT router (or use a VLAN at all). If you only want it to provide a guest network, you can set it up like any other AP and connect it to one of the LAN ports of your EdgerouterX and configure a separate network for that port on your Edgerouter (as far as I know, the EdgerouterX really has multiple physical interfaces as opposed to your AP, which most likely only has one and an integrated switch). To do so, you can follow this guide, using e.g. "eth2" instead of "eth1 vif 10". Optionally, you can modify the firewall configuration in the OpenWRT AP so that it simply bridges the WiFi without routing it, as the Edgerouter already does NAT for you (saves you from double-NAT).

If you want to use VLANs in OpenWRT, you first need to configure the VLAN on the integrated switch of your OpenWRT device (LuCI: Network->Switch, add) and select "tagged" on the port you connect to the edge router and on the "CPU" port. After this, it is easier to just create a new bridge (Network->Interfaces, Add new), covering "VLAN Interface: eth0.X" and then changing the wireless configuration to bridge to it instead of to the LAN bridge (Network->Wireless->Edit). Since you do not need to route, you do not need to configure firewall rules for the new bridge as everything is handled on the EdgeRouter. The advantage this setup has is that you separate the traffic from OpenWRT into management (untagged) and client traffic (tagged).

  • Thanks for the detailed answer. I think I know what to do now :) – sagool Feb 6 '17 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.