802.11s - Simple VLAN trunk

If you intend to set a Mesh network to distribute more than one subnet, the only way to achieve this with plain 802.11s is by setting a new mesh interface for every subnet. This is not optimal as you for example crow radio frequency spectrum and your devices will need to create many vifs, at least two per subnet.

Using this way to insert multiple networks inside one mesh network is the most simple one perfect for domestic or any network where there is only just one wan access node. You can set any amount of nodes you want but usually when there is a large amount of nodes, is practical to configure more than 1 node to bring wan connectivity, so you avoid having many HOPs till Internet access. That's the only reason this setup is perfect for domestic or any only one wan node environment. In the future perhaps this guide could add multiwan setup, but only when a simple way to setup with pure LuCI is possible.

A mesh with VLAN works exactly like a ethernet VLAN trunk. It seems that not all WiFi chipsets are able to support this and at the moment are know to work mt76 devices like the MT7915E using OpenWrt 23.05 and later.

WIP.

The steps to insert 802.1q VLAN bridge is quite simple, the mesh vif becames just one more port in the bridge.

Main node is referred to that node that usually has wan connectivity and dhcp, ra, dns server...

First you must have wpad mesh or full variants installed, basic ones doesn't support 802.11s networks.

Second a mesh network, go into Network → Wi-Fi and simply add one 802.11s network with the ID and security setting you want. Do not assign any network. Enable the network and take a look to the id it gets, usually some kind of wl0-mesh0 or phy0-mesh0, and remember it.

Third set up the VLAN bridge by going to Network → Interfaces → Devices. Select configure in the br-lan device and in bridge ports drop down the combo and in Custom write the id of the mesh network. Go into VLAN filtering tag and Add the VLANs you need and check all the VLANs you want to insert into the mesh as Tagged for the mesh port, now Save.

DO NOT apply the changes yet as you will lost access to the router needing to rollback o accessing IPv6 Link Local to it. Instead return to Interfaces tab and edit the lan interface. Drop down the device combo and select Software VLAN: br-lan.##. ## is the VLAN you are going to use for you normal network. Now you can safely apply changes.

Secondary nodes are referred to any other node not being the main one. There is a important difference with the secondary ones and the main one. The main one must be part of the VLAN as it supply DHCP, wan access and so on. The secondary nodes instead can be or not be part of the different VLANs. Be aware that if you don't make it part of any VLAN, at least the one corresponding to your main lan you will lost access to the node itself and you will have to use IPv6 Link Local. Also, not letting the node to be part of the Layer 3 in a VLAN will make it to unable use 802.11v Proxy ARP (if you try to enable it the vif won't even start) or use active steering like usteer or dawn.

Install wpad mesh or full and set up the mesh wifi network as in the main one, use the same mash id and security settings and do not assign any network, take note of the id it gets wl0-mesh0, phy0-mesh0... the one that gets for you.

Go into Network → Interfaces → Devices and configure br-lan, as in the main router add the mesh as a port by setting is in the Custom field and go to VLAN filtering replicating the same VLANs you setted up in the main node and tag all of them in the mesh port, you can for the VLANs that you don't want this particular node to be present at Layer 3 deselect the Local checkbox. The recommendation is to leave at least Local in one of the VLANs usually the VLAN corresponding to your main lan. For other VLANs you can uncheck it if you are not going to use Proxy ARP or active steering in the VLANs you uncheck.

Again DO NOT save yet, go to Interfaces tab and configure the lan interface, set a static IP to not conflict with the main node one or DHCP and the device from br-lan to br-lan.## being ## your main VLAN (you should have let the Local tick at least for this VLAN). This step must be done with careful, as the IP will change so you will have to access the new IP in the browser.

If your mesh backhaul mixes an 802.11ax (HE) capable radio with an older 802.11ac (VHT)-only radio, make sure both sides use the same htmode (e.g. VHT80 on both), even if one radio supports HE80.

This is for two VLANs main lan 10 and guest 20 but you can add as many as you want. Guest can only access the internet but you can set the forwarding rules you want and need. In the example lan is in all the physical ports, you an assign guest to them if you wish.

Set the mesh id (YourMesh) and password (YourMeshPassword) you want, but be sure to match it in all the nodes also the encryption. The most safe is to have the exact same configuration in every node for the mesh vif. Also keep in mind that you must must the wifi radio htmode for every node, so, if any node support BE but other only arrives till AC you must use AC mode for all. Also you must match the channel used, usually is better to use non-DFS channels but if you are in a area where all the nodes are not in radar zone should be also safe, keeping in mind your mesh nodes will last over one minute to be active.

config wifi-iface 'wifinet_mesh'
	option device 'radio1'
	option mode 'mesh'
	option encryption 'sae'
	option mesh_id 'YourMesh'
	option mesh_fwding '1'
	option mesh_rssi_threshold '0'
	option key 'YourMeshPassword'
	option ifname 'mesh'

(main node and secondary nodes that you want to be present in VLAN's layer3, to avoid secondary nodes to be preset use option local '0' in the particular bridge vlan, beware that setting local 0 to your administration VLAN will complicate that particular node administration to use IPv6 Link Local or recovery environment. Also the main node, the one with the DHCP, DNS server and so and the gateway must not be used with local 0. If you want to use 802.11v Proxy ARP and /or steering daemons are also a reason to not use local 0)

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'mesh'

config bridge-vlan
	option device 'br-lan'
	option vlan '10'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'mesh:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '20'
	list ports 'mesh:t'

Set the static corresponding IP for main node, usually .1.

config interface 'lan'
	option device 'br-lan.10'
	option proto 'static'
	list ipaddr '192.168.10.1/24'
	option ip6assign '64'

config interface 'guest'
	option device 'br-lan.20'
	option proto 'static'
	list ipaddr '192.168.20.1/24'
	option ip6assign '64'

Set the static corresponding IP for each node, usually every secondary node get a sequential IP.

config interface 'lan'
	option device 'br-lan.10'
	option proto 'static'
	list ipaddr '192.168.10.2/24'
	option gateway '192.168.10.1'
	list dns '192.168.10.1'

config interface 'lan6'
	option device 'br-lan.10'
	option proto 'dhcpv6'

config interface 'guest'
	option device 'br-lan.20'
	option proto 'static'
	list ipaddr '192.168.20.2/24'
	option gateway '192.168.20.1'
	list dns '192.168.20.1'

config interface 'guest6'
	option device 'br-lan.20'
	option proto 'dhcpv6'

config dhcp 'guest'
	option interface 'guest'
	option start '100'
	option limit '150'
	option leasetime '1h'
	option dhcpv4 'server'
	option ra 'server'
	option ra_preference 'medium'
	list ra_flags 'none'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option ignore '1' (just add this option)

Is better to use static IPs for infrastructure devices like nodes, but if you prefer to assign their IP by DHCP use this instead. Beware that if you try to set this from LuCI you will need to access the need IP in a window time or, apply it without checking.

config interface 'lan'
	option device 'br-lan.10'
	option proto 'dhcp'

config interface 'lan6'
	option device 'br-lan.10'
	option proto 'dhcpv6'

config interface 'guest'
	option device 'br-lan.20'
	option proto 'dhcp'

config interface 'guest6'
	option device 'br-lan.20'
	option proto 'dhcpv6'

Assume lan is already configured as default

config zone
	option name 'guest'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'

config forwarding
	option src 'guest'
	option dest 'wan'

config rule
	option name 'Guest-Allow-DHCPv4'
	option src 'guest'
	option family 'ipv4'
	list proto 'udp'
	option src_port '68'
	option dest_port '67'
	option target 'ACCEPT'

config rule
	option name 'Guest-Allow-DNSv4'
	option src 'guest'
	option family 'ipv4'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'Guest-Allow-DHCPv6'
	option src 'guest'
	option family 'ipv6'
	list proto 'udp'
	option src_port '546'
	option dest_port '547'
	option target 'ACCEPT'

config rule
	option name 'Guest-Allow-ICMPv6-Input'
	option src 'guest'
	option family 'ipv6'
	list proto 'icmp'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option target 'ACCEPT'

config rule
	option name 'Guest-Allow-DNSv6'
	option src 'guest'
	option family 'ipv6'
	list proto 'tcp'
	list proto 'udp'
	option dest_port '53'
	option target 'ACCEPT'

Assume lan is already configured as default if you want to bring out the main lan from lan zone, include lan and lan6 (if using dhcpv6 for node's ip assignment) into the vlan zone. The vlan zone is valid for every VLAN the node is going to be present in layer 3 without local '0'. Every VLAN interface can be assigned to this zone if you don't want a esoteric configuration. Beware that SLAAC address can take several minutes from boot to be assgined if the main router is the first one to boot. Also using DFS channels for the mesh affect this.

config zone
	option name 'vlan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'guest'
	list network 'guest6'

config rule
	option name 'VLAN-Allow-RA-NDP'
	option src 'vlan'
	option family 'ipv6'
	list proto 'icmp'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option target 'ACCEPT'