{"id":14,"date":"2026-04-04T20:33:30","date_gmt":"2026-04-04T20:33:30","guid":{"rendered":"https:\/\/alwaysbenoobing.com\/?p=14"},"modified":"2026-04-09T17:35:09","modified_gmt":"2026-04-09T17:35:09","slug":"vlan-setup-on-tp-link-archer-v7","status":"publish","type":"post","link":"https:\/\/alwaysbenoobing.com\/index.php\/2026\/04\/04\/vlan-setup-on-tp-link-archer-v7\/","title":{"rendered":"VLAN Setup on TP-Link Archer v7 with OpenWRT"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"542\" height=\"179\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/OpenWRTLogo.jpeg\" alt=\"\" class=\"wp-image-39\"\/><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">VLAN Setup<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">General Overview<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create VLANs in Network \u2192 Switch<\/li>\n\n\n\n<li>Create Bridge Devices in Network \u2192 Interfaces \u2192 Devices<\/li>\n\n\n\n<li>Create Interfaces in Network \u2192 Interfaces<\/li>\n\n\n\n<li>Create Firewall Zones \/ Rules<\/li>\n\n\n\n<li>Assign WiFi radios to Interfaces<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Switch Assignment<\/h2>\n\n\n\n<p>TP-Link Archer A7 does not use the DSA technology that is present in more modern OpenWRT router setups. &nbsp;This made it harder to find correct setup information for VLANs on OpenWRT. &nbsp;The VLANs are created in the Network \u2192 Switch section. &nbsp;<\/p>\n\n\n\n<p>VLAN 1 on this router acts as the shared Bridge device that links all of the internal LAN physical ports.<\/p>\n\n\n\n<p>VLAN2 is the WAN device that connects externally.<\/p>\n\n\n\n<p>Click \u201cAdd VLAN\u201d which will bring up VLAN 3, which we can change to any number from 1 &#8211; 4095. &nbsp;I&#8217;ve noted this with the Mgmt description which I will use to manage my routers \/ switches, etc.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1031\" height=\"322\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/VLAN-Setup_image.png\" alt=\"\" class=\"wp-image-29\"\/><\/figure>\n\n\n\n<p>LAN 4 port has been set to untagged. &nbsp;Any device that does not attach VLAN tags to a packet will have VLAN3 &nbsp;tag attached when communicating through this port. &nbsp;All packets with VLAN3 tags attached will also be sent to this network port.<\/p>\n\n\n\n<p>The CPU must be tagged with every VLAN ID that the switch is going to process. &nbsp;If the CPU is not tagged with a VLAN ID, that VLAN&#8217;s packets will not be processed.<\/p>\n\n\n\n<p>Save and Apply settings.<\/p>\n\n\n\n<p>Note: if you change the VLAN of the port you are connected to before correctly setting up Device, Interface, &amp; Firewall, you will be locked out of that port. &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Creating Bridge Devices<\/h2>\n\n\n\n<p>I first assumed that I would be creating 802.1q devices, as that is VLAN designation. &nbsp;This leads to failure. &nbsp;We are making Bridge Devices that allow us to bridge connection to the VLANs we made on the Network \u2192 Switch.<\/p>\n\n\n\n<p>My physical device is eth0 on this router. &nbsp;Sub-interfaces are created to allow network separation.  The LAN and WAN ports are just sub-interfaces of the physical eth0 switch.  A device sub-interface is automatically created for each VLAN when that VLAN is first created. &nbsp;Making VLAN3 on the switch creates the device eth0.3, VLAN20 creates eth0.20. &nbsp;We need to create a bridge device that will allow us to connect to that VLAN.<\/p>\n\n\n\n<p>Click \u201cAdd device configuration\u2026\u201d<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set the options for Device type: Bridge device<\/li>\n\n\n\n<li>Set the Device name: (Arbitrary, I chose br-mgmt)<\/li>\n\n\n\n<li>Set the Port to the device that was created with the VLAN (eth0.3)<\/li>\n\n\n\n<li>I choose to bring up empty bridges.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"770\" height=\"300\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/1_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-19\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Creating Interfaces<\/h2>\n\n\n\n<p>Click on the Interfaces tab. Network \u2192 Interfaces \u2192 Interfaces<\/p>\n\n\n\n<p>This interface serves as the virtual connection point to the Bridge device that was just created.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click \u201cAdd new interface\u2026\u201d<\/li>\n\n\n\n<li>Enter the Name<\/li>\n\n\n\n<li>Set Protocol to Static address<\/li>\n\n\n\n<li>Select the Bridge device you just created (br-mgmt)<\/li>\n\n\n\n<li>Create interface<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"770\" height=\"194\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/2_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-20\"\/><\/figure>\n\n\n\n<p>This will open additional fields in the interface setup menus.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">General Settings<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set Protocol to Static address<\/li>\n\n\n\n<li>Set IPv4 address. 192.168.3.1 to keep the network segment identifiable with the VLAN<\/li>\n\n\n\n<li>Set IPv4 mask 255.255.255.0<\/li>\n\n\n\n<li>Make sure \u2018Bring up on boot\u2019 is selected<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"766\" height=\"468\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/3_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-21\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Firewall Settings<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click Create \/ Assign firewall-zone<\/li>\n\n\n\n<li>Click the Custom dialog box and create an appropriate firewall zone name<\/li>\n\n\n\n<li>Hit Enter<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"778\" height=\"222\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/4_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-22\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">DHCP Server<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click \u201cSet up DHCP Server\u201d<\/li>\n\n\n\n<li>Click IPv4 Settings and set an appropriate range for IP addresses<\/li>\n\n\n\n<li>Click \u201cSave\u201d and &#8220;Save and Apply&#8221;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"804\" height=\"415\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/5_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-23\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Firewall &#8211; Zone Settings<\/h2>\n\n\n\n<p>Trying to connect will fail at this point because the Interface does not have permission to initiate traffic with the internal router and obtain DHCP information. &nbsp;We must set the firewall zone traffic so that the router accepts traffic from the Mgmt interface.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to Network \u2192 Firewall<\/li>\n\n\n\n<li>Under the traffic rules for Mgmt zone, change Input to accept so the router will accept traffic from the Mgmt zone<\/li>\n\n\n\n<li>Click \u201cSave&#8221; and \u201cSave and Apply\u201d<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1041\" height=\"208\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/9_VLAN-Setup_image.png\" alt=\"\" class=\"wp-image-27\"\/><\/figure>\n\n\n\n<p>Connecting to the Switch Port or the Wireless device should now negotiate a proper DHCP IP address.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Internet (WAN) access<\/h3>\n\n\n\n<p>We must be able to forward traffic from a zone to the wan zone in order to access outside networks. &nbsp;WAN access for the Mgmt zone is only for demonstration at this time and should not be used in a real Management VLAN setting.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click &#8220;Edit&#8221; on the Mgmt zone<\/li>\n\n\n\n<li>Change Allow forward <em><strong>TO DESTINATION ZONES<\/strong><\/em> and select wan.<\/li>\n\n\n\n<li>Click \u201cSave\u201d and \u201cSave and Apply\u201d<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"755\" height=\"211\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/10_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-28\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Wireless Setup<\/h2>\n\n\n\n<p>Go to Network \u2192 Wireless<\/p>\n\n\n\n<p>There are two radios listed on this router. One for 5g and for 2.4g.<\/p>\n\n\n\n<p>![](6_VLAN Setup_image.png)<\/p>\n\n\n\n<p>The first radio listed here is the 5g radio, click \u201cAdd\u201d<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set the Country code to your locality<\/li>\n\n\n\n<li>Set Mode to Access Point<\/li>\n\n\n\n<li>Set the ESSID or Network Name<\/li>\n\n\n\n<li>Set Network to the Interface your WiFi radio is associated with (Mgmt)<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"732\" height=\"289\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/7_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-25\"\/><\/figure>\n\n\n\n<p>Note: This Mgmt WiFi is temporary, only for this demonstration. &nbsp;Mgmt network should not be available via WiFi.<\/p>\n\n\n\n<p>Select the \u201cWireless Secuity\u201d tab under Inferface Configuration.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Select the encryption type<\/li>\n\n\n\n<li>Set Key to your password if you are using PSK<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"767\" height=\"320\" src=\"https:\/\/alwaysbenoobing.com\/wp-content\/uploads\/2026\/04\/8_VLAN-Setup_image.jpg\" alt=\"\" class=\"wp-image-26\"\/><\/figure>\n\n\n\n<p>Click \u201cSave\u201d and \u201cSave and Apply\u201d<\/p>\n\n\n\n<p>You may need to click &#8220;Save&#8221; before switching to a new configuration tab.  Some tabs would remember the settings between tabs and some would not.  If your setup isn&#8217;t acting correctly, check back through the config tabs and make sure that all your settings are correct.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Final Thoughts<\/h2>\n\n\n\n<p>OpenWRT is a feature rich platform, but quirky.  More than one person gave me the response that they just gave up on trying to get it working.  The biggest hurdle I faced was the conflicting setup guides due to OpenWRT migrating to their Distributed Switch Architecture (DSA ).  Reading their documentation left me confused, as I did not understand their text-only config files.  After working through this problem in the GUI, the config file makes much more sense.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>VLAN Setup General Overview Switch Assignment TP-Link Archer A7 does not use the DSA technology that is present in more modern OpenWRT router setups. &nbsp;This made it harder to find correct setup information for VLANs on OpenWRT. &nbsp;The VLANs are created in the Network \u2192 Switch section. &nbsp; VLAN 1 on this router acts as [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/posts\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/comments?post=14"}],"version-history":[{"count":11,"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/posts\/14\/revisions"}],"predecessor-version":[{"id":40,"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/posts\/14\/revisions\/40"}],"wp:attachment":[{"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/media?parent=14"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/categories?post=14"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/alwaysbenoobing.com\/index.php\/wp-json\/wp\/v2\/tags?post=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}