Separating Guest Wi-Fi with an OpenWrt VLAN Boundary

Guest Wi-Fi is safer with a layer-2 boundary, not merely a different SSID. This model assumes an OpenWrt router/AP and switch or uplink that support VLANs; confirm device names on the actual target.

Example model

Management uses VLAN 10, guests use VLAN 20, and the uplink is a trunk. Guest subnet is 192.168.20.0/24, while LAN is 192.168.1.0/24. Create a guest interface on the correct VLAN, enable its own DHCP scope, and attach the guest SSID to it.

The guest firewall zone forwards only to WAN. Permit DNS/DHCP to the router deliberately, then block guest access to RFC1918/LAN ranges. Do not permit all guest-to-LAN traffic and rely on clients to self-protect.

Verify

Join the guest SSID and confirm 192.168.20.x, gateway, and DNS. Internet access should work, while 192.168.1.1, NAS, and switch management should be blocked. Test both Wi-Fi and the trunk because a native/untagged VLAN mismatch can strand the LAN.

Recovery

A bad VLAN can lock out LuCI. Back up first, change one layer at a time, and keep wired LAN or console access.

Source

OpenWrt Guest Wi-Fi extras .