VLAN Configuration on OpenWrt

What VLANs are for

A VLAN (virtual LAN) splits one physical switch into multiple isolated broadcast domains. Devices on different VLANs cannot talk to each other unless the router explicitly allows it.

Home networks use VLANs to separate trusted devices from guests, IoT gadgets, cameras and network infrastructure. A camera that cannot reach your laptop is one less thing to worry about.

• Trusted LAN: laptops, phones, desktops.
• IoT VLAN: smart plugs, bulbs, sensors.
• Guest VLAN: visitor Wi-Fi, no access to anything local.

Understand tagged and untagged ports

An untagged port carries traffic for exactly one VLAN; the device plugged into it does not need to know VLANs exist. A tagged port carries multiple VLANs, identified by a 12-bit VLAN ID in the Ethernet frame header.

The link between the router and a managed switch is typically tagged (a "trunk"). Access ports for end devices are untagged. A port can be untagged for one VLAN and tagged for others.

• Untagged (access): one VLAN, for end devices.
• Tagged (trunk): many VLANs, for switches and access points.
• PVID: the VLAN assigned to untagged traffic arriving on a port.

Create a VLAN device

In LuCI, go to Network → Devices and click "Add device". Choose type "VLAN (802.1q)", set the base device to your LAN bridge (br-lan), and enter a VLAN ID (for example 10 for IoT). Save and apply.

This creates a new device named br-lan.10 that represents VLAN 10 on top of the LAN bridge. You can now attach an interface to it.

uci set network.iot_vlan=device
uci set network.iot_vlan.type='8021q'
uci set network.iot_vlan.name='br-lan.10'
uci set network.iot_vlan.ifname='br-lan'
uci set network.iot_vlan.vid='10'
uci commit network

Creates a VLAN device br-lan.10 with VLAN ID 10.

Attach an interface to the VLAN

Go to Network → Interfaces → Add new interface. Name it (for example IoT), set the protocol to static address, and select the VLAN device br-lan.10 as the device.

Assign an IPv4 address in a different subnet than the LAN, such as 192.168.10.1/24. Enable the DHCP server on this interface so devices on the IoT VLAN get addresses automatically.

uci set network.iot=interface
uci set network.iot.device='br-lan.10'
uci set network.iot.proto='static'
uci set network.iot.ipaddr='192.168.10.1'
uci set network.iot.netmask='255.255.255.0'
uci commit network

Defines the IoT interface on VLAN 10 with address 192.168.10.1.

Create a firewall zone

A new interface needs a firewall zone to control its traffic. Go to Network → Firewall → Zones → Add. Name the zone, set the input policy to reject (devices should not reach the router directly), output to accept, and forward to reject.

Add a forwarding from the IoT zone to the wan zone so IoT devices can reach the internet. Do not add forwarding to the lan zone. If IoT devices need a specific service on the LAN, add a targeted traffic rule instead of broad forwarding.

• IoT zone input: reject (no router services).
• IoT zone output: accept.
• IoT → wan forwarding: accept (internet access).
• IoT → lan forwarding: none.

Configure the switch ports

For VLANs on the physical ports the method depends on the switch framework. DSA devices (OpenWrt 21.02 and later on many targets) configure VLANs on the bridge ports under Network → Devices, with bridge VLAN filtering. Devices still using swconfig have a Network → Switch page. Check which one your device uses before following switch instructions.

An access port for an IoT device is untagged on VLAN 10 and off on all others. A trunk port to a managed switch is tagged on every VLAN it should carry. Set the PVID of access ports to match their untagged VLAN.

Assign Wi-Fi to a VLAN

To put a wireless network on the IoT VLAN, edit the Wi-Fi interface in Network → Wireless and set its "Network" to the IoT interface. Clients connecting to that SSID get an address from the IoT subnet and are subject to the IoT firewall zone.

This is how guest Wi-Fi is isolated: a separate SSID attached to the guest interface, which lives on the guest VLAN.