Setup VLAN on OpenWRT using hardware that has no switch ports

The new versions of OpenWRT (18 and newer) have the ability to add vlan interfaces directly from LuCI (web gui). You can now skip the manual editing of the /etc/config/network file.

Using 802.1q in OpenWRT is very difficult when working on a device that doesn’t have a built-in switch or the when the switch chipset isn’t supported.

Creating VLANS is not possible via the web interface (luci) or using the “config switch_port” options in /etc/config/network. The Luci web gui will not have the “Network -> Switch” option available.

In this example, we add a public interface and vlan 2 on ports eth0 and eth1.

Start by getting into the device:
ssh root@
vi /etc/config/network

config interface 'public'         
        option type 'bridge'       
        option proto 'static'     
        option ifname 'eth0.2 eth1.2'
        option ipaddr ''
        option netmask ''

config device 'eth0_2'       
        option name 'eth0.2' 

config device 'eth1_2' 
        option name 'eth1.2'

This creates three interfaces eth0.2, eth1.2 and both are bridged into the interface br-public.

You can use luci to configure the interface if you use the “custom interface” and manually refer to the vlan like this:

Just be sure you’ve already added the necessary VLAN to /etc/config/network:

config device 'eth0_2' 
        option name 'eth0.2'

After this, the VLAN will be defined but not show up in luci. You will need to specify it using the “custom interface” as shown in the red circle above.


2 responses to “Setup VLAN on OpenWRT using hardware that has no switch ports”

  1. how do you set the vlan id for this trick?

    config interface ‘public’
    option type ‘bridge’
    option proto ‘static’
    option ifname ‘eth0.2 eth1.2’
    option ipaddr ‘’ <<—– should i fill in the vlan ip address here?
    option netmask ''

    thanks by the way.

  2. tito
    the vlan id is “option ifname” and the ip address is “option ipaddr”
    You can also skip the ip address if you don’t care about having a ip for the device on that particular vlan. Like so,
    config interface ‘public’
    option ifname ‘eth0.172’
    option type ‘bridge’
    option proto ‘none’

Leave a Reply

Your email address will not be published. Required fields are marked *