"
Your last idea (untagged + fixed PVID for the mesh ports) is the right one. You can make it even simpler, and avoid the "network down for days" scenario, because you don't need VLAN 10 at all, and OPNsense doesn't need to change.
VLAN 20 only has to be a "virtual cable" inside the switch between the MR LAN port and the MS. Since the MR bridges WAN↔LAN in AP mode, the MS clients get their IP from your main network through that bridge, exactly as you observed when you cabled them directly.
So, on the switch only:
VLAN 1 (default): leave everything as it is: OPNsense port, MR WAN, all other devices. Untagged, PVID 1.
VLAN 20: the two ports for MR LAN and MS as untagged members with PVID 20, removed from VLAN 1.
The OPNsense port is not a member of VLAN 20, and no VLAN 20 interface/DHCP on OPNsense.
Your 192.168.1.1/24 LAN, DHCP and static leases stay untouched, so no subnet conflict and nothing to migrate.
Two tips:
Configure from a PC on a port you're not changing, in this order: add the two ports to VLAN 20 → set PVID 20 → remove them from VLAN 1. That way you won't lock yourself out, and if something goes wrong you only need to revert two ports.
Leave loop prevention/STP off for this change. Most smart switches run a single STP instance that isn't VLAN-aware, so if the MR passes BPDUs across its bridge, the switch may see VLAN 1 → MR → VLAN 20 as a loop and block one of those ports. If you want STP back later as a safety net, disable it on the MR WAN port and the two VLAN 20 ports.
VLAN 20 only has to be a "virtual cable" inside the switch between the MR LAN port and the MS. Since the MR bridges WAN↔LAN in AP mode, the MS clients get their IP from your main network through that bridge, exactly as you observed when you cabled them directly.
So, on the switch only:
VLAN 1 (default): leave everything as it is: OPNsense port, MR WAN, all other devices. Untagged, PVID 1.
VLAN 20: the two ports for MR LAN and MS as untagged members with PVID 20, removed from VLAN 1.
The OPNsense port is not a member of VLAN 20, and no VLAN 20 interface/DHCP on OPNsense.
Your 192.168.1.1/24 LAN, DHCP and static leases stay untouched, so no subnet conflict and nothing to migrate.
Two tips:
Configure from a PC on a port you're not changing, in this order: add the two ports to VLAN 20 → set PVID 20 → remove them from VLAN 1. That way you won't lock yourself out, and if something goes wrong you only need to revert two ports.
Leave loop prevention/STP off for this change. Most smart switches run a single STP instance that isn't VLAN-aware, so if the MR passes BPDUs across its bridge, the switch may see VLAN 1 → MR → VLAN 20 as a loop and block one of those ports. If you want STP back later as a safety net, disable it on the MR WAN port and the two VLAN 20 ports.
