Stefan Hegnauer's Homepage - Create a Guest Network using VLAN

Devices:

• Firewall running FreeBSD 15.1, pf as firewall and dnsmasq for DNS and DHCP
• WiFi router Cudy M3000 running Openwrt 25.12 in AP mode, getting IP adresses over DHCP

Goal:

• have a dedicated WiFi AP for wireless guest or IoT devices
• run over the same Ethernet cable as the main AP using VLAN
• have their own firewall rules
• be isolated from the other local networks

Proceedings:

on the Firewall:

• /etc/rc.conf:

# setup for IoT network on VLAN using interface igc0

vlans_igc0="200"

ifconfig_igc0_200="inet 192.168.200.1/24"

• /etc/pf.conf:

iot_if="igc0.200"

antispoof quick for $iot_if

block drop in log quick on $iot_if to $jailhost/24

block drop in log quick on $iot_if to $wg_clients

block drop in log quick on $iot_if to 192.168.20.1/24

block drop in quick on $int_if to {$multicast,$mdns}

pass in quick on $iot_if

• /etc/hosts:

# add quasi-static entries for AP and IoT devices as required

192.168.200.2            IOT-AP

192.168.200.3            mova_vacuum_r5770a

• /usr/local/etc/dnsmasq.conf

interface=igc0.200

# DHCP: allow 5 dynamic connections on IoT

dhcp-range=192.168.200.5,192.168.200.9,12h

# static dhcp-assignements, get IP from /etc/hosts

dhcp-host=IOT-AP,24h

dhcp-host=mova_vacuum_r5770a,24h

on the Wifi router:

• /etc/config/network

# do not change the existing br-lan that bridges eth0 and eth1

# create VLAN bridge 1 and leave as primary, untagged

config bridge-vlan

	option device 'br-lan'

	option vlan '1'

	list ports 'eth0:u*'

	list ports 'eth1:u*'

# create VLAN bridge 200 for the IoT path, tagged

config bridge-vlan

	option device 'br-lan'

	option vlan '200'

	list ports 'eth0:t'

	list ports 'eth1:t'

# change the 'lan' interface to use VLAN 1

config interface 'lan'

	option device 'br-lan.1'

	option proto 'dhcp'

	option delegate '0'

	option multipath 'off'

# create the IoT interface on VLAN 200

config interface 'IoT'

	option proto 'dhcp'

	option device 'br-lan.200'

	option hostname 'IOT-AP'

	option multipath 'off'

• /etc/config/wireless:

# create additional Wifi interface on device 'radio0' (2.4GHz)

config wifi-iface 'wifinet2'

	option device 'radio0'

	option mode 'ap'

	option ssid 'StefansIOT'

	option encryption 'psk2'

	option key 'xxxxxxxxx'

	option network 'IoT'

back to computing page

back to main page

last edited 2026-07-04 - Stefan Hegnauer