A small update to the previous dynamic vlan setup . The goal is the same: a single ssid where each device gets dropped into the vlan assigned by the radius server, based on its mac address.

The change follows switching to a new device (cudy ap3000), with a more recent version of openwrt. The change moves to a single vlan99 interface for the AP’s own management traffic, while other vlan handling is dealt by the dynamic vlan setup.

Packages

Only needed to install the full wpad package (using apk on OpenWrt 24.x):

apk add wpad

Wireless configuration

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option channel '1'
        option band '2g'
        option htmode 'HE20'
        option disabled '0'
        option cell_density '0'
        option country 'FI'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'myssid'
        option encryption 'psk2'
        option key 'xxxxxxxxxxxx'
        option hostapd_options 'macaddr_acl=2'
        option auth_cache '1'
        option dynamic_vlan '2'
        option vlan_bridge 'br-lan'
        option vlan_naming '0'
        option vlan_tagged_interface 'eth0'
        option wps_pushbutton '1'
        option wps_device_name 'OpenWRT AP1'
        option auth_server '192.168.99.1'
        option auth_secret 'xxxxxxxxx'
        option auth_port '1812'

The radius server still assigns vlan ids per mac address. dynamic_vlan '2' enables tagged vlans, and vlan_naming '0' keeps the bridge device names predictable.

Bridge and interface

  • br-lan has vlan filtering enabled
  • vlan 99 is configured as a tagged local vlan on eth0
  • the default lan interface was replaced by vlan99 using dhcp client as protocol

Minor optimization

Disabled the firewall service in luci, since this device is only an AP and doesn’t need to route or filter traffic.

References