Going from no VLAN to VLAN to get mesh system to work

[prutz0r]

I have this Netgear mesh system that I want to use a wired backhaul (essentially making it non mesh roaming AP's). After some research it seems the main AP (the MR) needs to sit between router and network switch. I have a Protectli with OpnSense and I see no use to put this in between the router and my 16p Netgear smart switch. The MR has one other port, a LAN port, that the satellite (MS) needs to be connected to either directly or through a switch. Connecting them both to the 16p switch doesn´t work. My observations:

• Connecting the MR and MS to the 16p switch causes the whole network to go down. I connected the MR WAN and LAN port both to the switch as the manual states it needs the LAN port for connecting to the other satellite and the WAN port for network traffic. Kind of weird I would think, but connecting the WAN port to my LAN makes it see all kinds of devices.
• Connecting the MR with WAN port to the 16p switch and the MS directly to the MR works. Weird thing is, the MS get it's ip from the main network, that the MR connects to through the WAN port. Together with the previous observation I'm led to believe that while this system is in AP-only mode the WAN and LAN interface are bridged, which would also explain the network going down because of infinite loops.
• Putting the MR between my router with WAN port to router and LAN port to the switch, and the MS directly connected to the switch, works.

I do not want the MR in between the router and switch as their location is very mediocre for an access point ánd I'm fundamentally against having devices handle traffic for no reason - wired-only traffic should pass that device. So I though that this might something a VLAN might solve. Put my whole LAN in VLAN10 and the MR LAN interface and MS in VLAN20. Then seperate them by blocking all traffic between 10 and 20 as the MR bridges these networks anyway. I have questions about doing this. I know about the theory but have no experience in practice and only one network to test this on, being my own house network. So I want to try and get things as right as possible from the start. I found this tutorial:
Dutch - https://privacygear.nl/guides/opnsense-vlan-gids/
English (automtically translated) - https://privacygear-nl.translate.goog/guides/opnsense-vlan-gids/?_x_tr_sl=nl&_x_tr_tl=en&_x_tr_hl=nl&_x_tr_pto=wapp

• Am I correct in thinking that I can skip step 3 for VLAN 20 as device in VLAN 20 will get the ip address through the bridging function of the MR?
• Is there anything missing from that tutorial?
• I currently have a network running on 192.168.1.1/24. I´d like to keep it that way so DHCP for VLAN 10 will need that same range. However, it seems I cannot yet configure this right now as the subnet is already used? Is there any kind of shortcut that makes it easier?
• Can I migrate my static leases to the DHCP service of the VLAN? I didn´t see anything that would suggest this is possible.

I have a Netgear smart switch. I'm thinking of how I should configure this to work with OpnSense. Would I have to configure it like this?

• 802.1Q VLANs
• Port 1 to OpnSense (trunk) - untagged VLAN 10, 20
• Port 2 and 3 to MR LAN and MS - tagged VLAN 20
• The rest, including to MR WAN - tagged vlan 10
• Tagged means assigning membership of the port and not using PVID?

Thanks a lot.

[klinebau]

I don't understand why you wouldn't connect the mesh router to the switch.  This is the correct location and it should be setup in AP mode.  There is no reason for VLANs just to connect a mesh system.  You might want VLANS for other purposes, but it is not needed to connect a mesh system.

[prutz0r]

I don't understand why you wouldn't connect the mesh router to the switch.  This is the correct location and it should be setup in AP mode.  There is no reason for VLANs just to connect a mesh system.  You might want VLANS for other purposes, but it is not needed to connect a mesh system.

Because my whole network goes down or I need to run a cable directly between the MR and MS, while also running a cable between the router and the MR, essentially creating a 1gbps bottleneck between my router, having to run around 30 meters of extra cabling and also I see no reason why all network traffic needs to go through this device. I tried to describe this in the observations, but perhaps you can let me know why they're unclear. I can add more information.

[nero355]

Because my whole network goes down or I need to run a cable directly between the MR and MS

I am guessing your Netgear Switch is blocking some kind of protocol that those things use to communicate...
Reason I am saying this is that I have read something similar once, but I can't remember anymore what the exact issue was :(

Can't you just DISABLE MESH functionality and configure all the units like a simple Accesspoint ?!

Another possible issue :
Not having a proper (R)STP setup on your Switches combined with the Mesh functionality of those things can indeed cause serious issues!



Now to answer your question about VLANs partially :
- When your OPNsense Interface is just the Default LAN for example you need to transport it as UNTAGGED to a Switch or Accesspoint.
- When your OPNsense Interface has VLANs assigned to it you need to transport them as TAGGED to a Switch or Accesspoint.
- VLANs between Switches usually go TAGGED too unless you are doing something special for whatever reason.
- VLANs from Switches to Accesspoints go TAGGED too unless you are doing something special for whatever reason.

Simple common example of "Something special" :
Some equipment needs to have it's Management Network transported as UNTAGGED instead of TAGGED.
Since your MESH units probably don't know what to do with VLANs on the "Switch side" you will need to do something like this, because both the regular traffic and management traffic will go via the same connection/network :)



Heel veel succes alvast! ;)

[prutz0r]

Because my whole network goes down or I need to run a cable directly between the MR and MS

I am guessing your Netgear Switch is blocking some kind of protocol that those things use to communicate...
Reason I am saying this is that I have read something similar once, but I can't remember anymore what the exact issue was :(

Can't you just DISABLE MESH functionality and configure all the units like a simple Accesspoint ?!

Another possible issue :
Not having a proper (R)STP setup on your Switches combined with the Mesh functionality of those things can indeed cause serious issues!

I read about loop prevention being able to cause all kinds of trouble so that's disabled. I really think the WAN and LAN interface are bridged in AP mode thus causing lot's of issues when connecting both to a switch on the same subnet. I think it's looping. That theory does fit my observations so far. Assuming mesh means using a wireless connection as backhaul and automatically finding the best path and considering roaming a seperate feature, mesh is disabled automatically when connecting the satellite, MS, wired to the MR. However the MR interfaces still seem bridged. To stop the loop I think I can solve the puzzle by isolating the connection between the MS and MR as networking is taken care of by the bridge. The MS have their own web interface but there is almost nothing you can configure. Rebooting, perhaps syncing for wireless mesh and that's about it. They really depend on the MR.

Now to answer your question about VLANs partially :
- When your OPNsense Interface is just the Default LAN for example you need to transport it as UNTAGGED to a Switch or Accesspoint.

That would be the situation without VLANs that I have right now I think?

- When your OPNsense Interface has VLANs assigned to it you need to transport them as TAGGED to a Switch or Accesspoint.

My default LAN will be VLAN 10 so that would mean connection from router to switch is tagged?

- VLANs between Switches usually go TAGGED too unless you are doing something special for whatever reason.

I have only one switch.

- VLANs from Switches to Accesspoints go TAGGED too unless you are doing something special for whatever reason.

Simple common example of "Something special" :
Some equipment needs to have it's Management Network transported as UNTAGGED instead of TAGGED.
Since your MESH units probably don't know what to do with VLANs on the "Switch side" you will need to do something like this, because both the regular traffic and management traffic will go via the same connection/network :)

This system is completely unaware of VLANs, it's not like Ubiquity where you apply a VLAN to an SSID so I would think the traffic is untagged anyway to the MR interface that connects the access points to the rest of the network and the internet? And then apply a fixed PVID to the relevant switch port?

Heel veel succes alvast! ;)

Bedankt, interessante puzzel, alleen wil ik niet voor iedereen in het huis dagen lang het netwerk uit de lucht hebben ;)

[nero355]

Now to answer your question about VLANs partially :
- When your OPNsense Interface is just the Default LAN for example you need to transport it as UNTAGGED to a Switch or Accesspoint.

That would be the situation without VLANs that I have right now I think?

Yup!

- When your OPNsense Interface has VLANs assigned to it you need to transport them as TAGGED to a Switch or Accesspoint.

My default LAN will be VLAN 10 so that would mean connection from router to switch is tagged?

Yup!

- VLANs from Switches to Accesspoints go TAGGED too unless you are doing something special for whatever reason.

Simple common example of "Something special" :
Some equipment needs to have it's Management Network transported as UNTAGGED instead of TAGGED.
Since your MESH units probably don't know what to do with VLANs on the "Switch side" you will need to do something like this, because both the regular traffic and management traffic will go via the same connection/network :)

This system is completely unaware of VLANs, it's not like Ubiquity where you apply a VLAN to an SSID so I would think the traffic is untagged anyway to the MR interface that connects the access points to the rest of the network and the internet? And then apply a fixed PVID to the relevant switch port?

Sounds like a plan! :)

But I was thinking...

Any chance that there is some kind of alternative firmware available for these things ?!
Slapping OpenWRT on them for example would solve the whole issue pretty easily! :)

[prutz0r]

But I was thinking...

Any chance that there is some kind of alternative firmware available for these things ?!
Slapping OpenWRT on them for example would solve the whole issue pretty easily! :)

Great idea. But then I searched for the model numbers and openwrt and no result unfortunately.

[BoNetTech]

Your last idea (untagged + fixed PVID for the mesh ports) is the right one. You can make it even simpler, and avoid the "network down for days" scenario, because you don't need VLAN 10 at all, and OPNsense doesn't need to change.

VLAN 20 only has to be a "virtual cable" inside the switch between the MR LAN port and the MS. Since the MR bridges WAN↔LAN in AP mode, the MS clients get their IP from your main network through that bridge, exactly as you observed when you cabled them directly.

So, on the switch only:

VLAN 1 (default): leave everything as it is: OPNsense port, MR WAN, all other devices. Untagged, PVID 1.
VLAN 20: the two ports for MR LAN and MS as untagged members with PVID 20, removed from VLAN 1.
The OPNsense port is not a member of VLAN 20, and no VLAN 20 interface/DHCP on OPNsense.

Your 192.168.1.1/24 LAN, DHCP and static leases stay untouched, so no subnet conflict and nothing to migrate.

Two tips:

Configure from a PC on a port you're not changing, in this order: add the two ports to VLAN 20 → set PVID 20 → remove them from VLAN 1. That way you won't lock yourself out, and if something goes wrong you only need to revert two ports.
Leave loop prevention/STP off for this change. Most smart switches run a single STP instance that isn't VLAN-aware, so if the MR passes BPDUs across its bridge, the switch may see VLAN 1 → MR → VLAN 20 as a loop and block one of those ports. If you want STP back later as a safety net, disable it on the MR WAN port and the two VLAN 20 ports.