I have this Netgear mesh system that I want to use a wired backhaul (essentially making it non mesh roaming AP's). After some research it seems the main AP (the MR) needs to sit between router and network switch. I have a Protectli with OpnSense and I see no use to put this in between the router and my 16p Netgear smart switch. The MR has one other port, a LAN port, that the satellite (MS) needs to be connected to either directly or through a switch. Connecting them both to the 16p switch doesn´t work. My observations:
- Connecting the MR and MS to the 16p switch causes the whole network to go down. I connected the MR WAN and LAN port both to the switch as the manual states it needs the LAN port for connecting to the other satellite and the WAN port for network traffic. Kind of weird I would think, but connecting the WAN port to my LAN makes it see all kinds of devices.
- Connecting the MR with WAN port to the 16p switch and the MS directly to the MR works. Weird thing is, the MS get it's ip from the main network, that the MR connects to through the WAN port. Together with the previous observation I'm led to believe that while this system is in AP-only mode the WAN and LAN interface are bridged, which would also explain the network going down because of infinite loops.
- Putting the MR between my router with WAN port to router and LAN port to the switch, and the MS directly connected to the switch, works.
I do not want the MR in between the router and switch as their location is very mediocre for an access point ánd I'm fundamentally against having devices handle traffic for no reason - wired-only traffic should pass that device. So I though that this might something a VLAN might solve. Put my whole LAN in VLAN10 and the MR LAN interface and MS in VLAN20. Then seperate them by blocking all traffic between 10 and 20 as the MR bridges these networks anyway. I have questions about doing this. I know about the theory but have no experience in practice and only one network to test this on, being my own house network. So I want to try and get things as right as possible from the start. I found this tutorial:
Dutch - https://privacygear.nl/guides/opnsense-vlan-gids/
English (automtically translated) - https://privacygear-nl.translate.goog/guides/opnsense-vlan-gids/?_x_tr_sl=nl&_x_tr_tl=en&_x_tr_hl=nl&_x_tr_pto=wapp
- Am I correct in thinking that I can skip step 3 for VLAN 20 as device in VLAN 20 will get the ip address through the bridging function of the MR?
- Is there anything missing from that tutorial?
- I currently have a network running on 192.168.1.1/24. I´d like to keep it that way so DHCP for VLAN 10 will need that same range. However, it seems I cannot yet configure this right now as the subnet is already used? Is there any kind of shortcut that makes it easier?
- Can I migrate my static leases to the DHCP service of the VLAN? I didn´t see anything that would suggest this is possible.
I have a Netgear smart switch. I'm thinking of how I should configure this to work with OpnSense. Would I have to configure it like this?
- 802.1Q VLANs
- Port 1 to OpnSense (trunk) - untagged VLAN 10, 20
- Port 2 and 3 to MR LAN and MS - tagged VLAN 20
- The rest, including to MR WAN - tagged vlan 10
- Tagged means assigning membership of the port and not using PVID?
Thanks a lot.
I don't understand why you wouldn't connect the mesh router to the switch. This is the correct location and it should be setup in AP mode. There is no reason for VLANs just to connect a mesh system. You might want VLANS for other purposes, but it is not needed to connect a mesh system.
Quote from: klinebau on September 25, 2026, 09:04:54 PMI don't understand why you wouldn't connect the mesh router to the switch. This is the correct location and it should be setup in AP mode. There is no reason for VLANs just to connect a mesh system. You might want VLANS for other purposes, but it is not needed to connect a mesh system.
Because my whole network goes down or I need to run a cable directly between the MR and MS, while also running a cable between the router and the MR, essentially creating a 1gbps bottleneck between my router, having to run around 30 meters of extra cabling and also I see no reason why all network traffic needs to go through this device. I tried to describe this in the observations, but perhaps you can let me know why they're unclear. I can add more information.
Quote from: prutz0r on September 25, 2026, 09:32:34 PMBecause my whole network goes down or I need to run a cable directly between the MR and MS
I am guessing your Netgear Switch is blocking some kind of protocol that those things use to communicate...
Reason I am saying this is that I have read something similar once, but I can't remember anymore what the exact issue was :(
Can't you just DISABLE MESH functionality and configure all the units like a simple Accesspoint ?!
Another possible issue :
Not having a proper (R)STP setup on your Switches combined with the Mesh functionality of those things can indeed cause serious issues!
Now to answer your question about VLANs partially :
- When your OPNsense Interface is just the Default LAN for example you need to transport it as UNTAGGED to a Switch or Accesspoint.
- When your OPNsense Interface has VLANs assigned to it you need to transport them as TAGGED to a Switch or Accesspoint.
- VLANs between Switches usually go TAGGED too unless you are doing something special for whatever reason.
- VLANs from Switches to Accesspoints go TAGGED too unless you are doing something special for whatever reason.
Simple common example of "Something special" :
Some equipment needs to have it's Management Network transported as UNTAGGED instead of TAGGED.
Since your MESH units probably don't know what to do with VLANs on the "Switch side" you will need to do something like this, because both the regular traffic and management traffic will go via the same connection/network :)
Heel veel succes alvast! ;)