Mixed untagged and vlan tagged networks, Need help correcting my mistake

[wiggler]

The problem with splitting up the networks physically is that the access point has two SSIDs, one for the guest network and one for the main lan network. Making VLAN tagging pretty much required. Unless I want to get a second access point, but then I'd be dealing with a whole set of different issues I'm sure.

[Patrick M. Hausen]

Tagged an untagged is a property of a link between two devices, not your entire network. You can have e.g.

Access point to switch on a single port:

- guest tagged
- iot tagged
- lan and mangement untagged "because Unifi"

OPNsense to switch:

- guest and iot tagged on one port
- lan and management untagged on a different port

Thus you get the "do not mix tagged and untagged" for OPNsense - all other devices simply do not need to care.

[meyergru]

The problem with splitting up the networks physically is that the access point has two SSIDs, one for the guest network and one for the main lan network. Making VLAN tagging pretty much required. Unless I want to get a second access point, but then I'd be dealing with a whole set of different issues I'm sure.

Actually, that is not a strict requirement. The assigment of "networks" and "WLAN" in Unifi speak is arbitrary. You can have two WLANs on the same network, yet then, they are not separated unless you use the Unifi "client isolation" feature. This comes in handy if you need certain Wifi parameters for a group of clients but not for the other or if you do not want to hand out your "real" Wifi password for a guest network and still allow guests to use your Wifi.

And about what Patrick says: That is completely correct - you can use two or more physical connections to the switch and configure them accordingly, like one port for untagged LAN traffic only and a trunk port for any VLANs.

[wiggler]

Tagged an untagged is a property of a link between two devices, not your entire network. You can have e.g.

...

Thus you get the "do not mix tagged and untagged" for OPNsense - all other devices simply do not need to care.

Right, this is essentially how I have it now after reading the suggestions in this thread. My firewall has one port WAN, one for LAN (untagged), and another port as a VLAN tagged trunk, but that only consists of the guest VLAN.

Actually, that is not a strict requirement...

I'm already using the client isolation feature on the guest WLAN already, but I suppose I wanted to get myself into trouble using VLANs. But also, I was thinking about the option to hardwire "guest" clients. I was doing that for a little while with my work laptop though an old router running openwrt, but decided to just connect it to the guest WLAN and simplify my office setup.

[OPNenthu]

JFYI - I noticed some interesting wording in the "Client Device Isolation" help text in UniFi.  It seems the isolation is per-AP only.

Exact wording is "on the same AP [...]"

You cannot view this attachment.

I interpret that as meaning clients on the same WLAN but on different APs can reach each other.

Still fine in @wiggler's use case though.