Splitting a home network into VLANs on OpenWrt

2026-07-12 · 9 min read

Everything in the flat used to share one flat /24: laptops, a TV, a printer, a handful of smart plugs and whoever was visiting. This post is how I split that into three networks on a single router.

The plan

VLAN 1 — main. Laptops, phones, the NAS. Full access.
VLAN 20 — IoT. Plugs, TV, printer. Internet only, no access to main.
VLAN 30 — guest. Internet only, client isolation on, bandwidth capped.

Bridge VLAN filtering

Since the switch to DSA, the old swconfig recipes on the forum no longer apply. The switch ports are regular interfaces and VLANs are configured on the bridge:

config bridge-vlan
    option device 'br-lan'
    option vlan '20'
    list ports 'lan3:t'
    list ports 'lan4:u*'

t means tagged, u untagged, and the asterisk marks the PVID for that port. Getting the asterisk wrong is why my printer spent an evening on the wrong network.

Wi-Fi

Each SSID is attached to the bridge VLAN device rather than to br-lan directly. Three SSIDs, three networks, one radio — the throughput cost is real but not noticeable at home.

Firewall

Two extra zones, each with forward=REJECT toward lan and ACCEPT toward wan. One exception rule lets the main network reach the printer on the IoT VLAN, because the alternative was moving the printer back and being sad about it.

Lessons

Do this with a serial cable or at least a scheduled reboot in the background. I locked myself out twice, and the failsafe button is much less convenient than admitting up front that you will need it.