This document will overview the process of configuring SSIDs bound to separate VLANs on a DD-WRT access-point
I am in no way affiliated with the DD-WRT project, nor with Asus. DD-WRT may work on your device, or may cause issues. The following is a guide only, and may not work for you exact situation. Reflashing a device may lead to failure, "bricking", unexpected errors, or other issues, and I cannot guarantee that the process described will work for you. By continuing, you agree that to be solely responsible for any potential damage to your router or other attached devices.
Why might you want to do this?
The common usage is to create SSIDs which are all broadcast from the same physical router/access-point connected but are logically separate from each other. This could allow you to create a layer of separation between your wireless devices
Some examples of where you might have separate SSIDs include:
The actual limit of SSIDs/VLANs depends on the capabilities/limits of your hardware and current version of DD-WRT etc
By using VLANs, you can use a single physical connection between your DD-WRT AP and your firewall
Our example device is an Asus AC1900 (RT-AC1900P) router.
The first thing to do with your device is check whether it's actually supported for DD-WRT.
Check here
If there is a minimum build # listed, your device should support DD-WRT. If it's a WIP... then it may require special steps or the build may not be fully functional.
Please note that the list is not exhaustive, and will in fact point you at the forums for more up-to-date information (but it's a good place to start)
Some devices have a link to an install guide, so follow that as needed.
The latest beta builds can be found here
For our device, there are still regular builds. Find the sub-folder for the current year, followed by the latest month/day and build # Grab the current .TRX firmware file
In the case of the RT-1900P, I was able to upload the firmware via the standard Asus WebUI. Doing so, however, put the router into rescue mode. In this mode, the device does not provide a DHCP server and has a limited web interface.
You can also force rescue mode by holding the RESET button (indent at the back) while the device is powered off, then continuing to hold it for approx 20s while you power the device on. In this mode, the power LED will blink on and off
You should end up at a screen like the following:
You can use the "Choose file" button to select new firmware from your PC, then click Upload to load it into the router.
This will take a few moments and you should see a screen like
If this was the first time flashing the device with DD-WRT, you will likely need to re-enter rescue mode and click the "Restore default NVRAM values"
Now click the "Reboot" link. Wait for the device to finish rebooting before you hit continue (you can watch to see when it returns a PING)
The initial loading process may take a few moments.
If things are flashed correctly, you should be able to get a DHCP-assigned IP address. By default the router will also likely using 192.168.1.1 so you could continual with the manual assignment, but I recommend switching back to DHCP at this point
Access the router via the webpage at http://192.168.1.1
You should be at a password change screen. Set your administrative username and a good password (it should not be the same as your wifi password) and click "Change Credentials"
Click on the "Setup" button.
You will be prompted to enter your username and password. Enter the ones you configured earlier. If you messed up on these somehow and locked yourself out... reset the device back to Rescue Mode and restore the default NVRAM values, again.
In this example configuration, we will be setting up 4 SSIDs which attach to 3 VLANs, and a seperate VLAN for the LAN connections:
In the example configuration, we are not using firewall or even routing capabilities of the device. It will function purely as an AP with SSIDs tied to the various VLANs.
In this example configuration, each of these VLANs would lead to a networks with the own DHCP server, firewall, etc.
All networks will be connected through the WAN port on the DD-WRT device.
Your own configuration may diverge from this and you may want to use DHCP on some of the SSIDs and/or use the firewall.
While you are setting things up, you will probably want to keep the router unplugged from the rest of your network (don't plug in the WAN port either)
These are your primary SSIDs which will be tied for VLAN 26 (internal wifi)
"Wireless Interface wl0" sectionBeneath the 2.4Ghz (wl0) interface, find the "Add Virtual AP" button and click it.
This should create a new Virtual Interface wl0.1.
Click the same "Add Virtual AP" (under the 2.4Ghz wl0) button again
This should create a new Virtual Interface wl0.2
Configure these new virtual interfaces
The conf network can be deleted later, but at times during the VLAN and IP changes you may run into issues and this should be helpful to connect
Save, Apply Settings
Beneath the 5Ghz (wl1) interface, find the "Add Virtual AP" button and click it.
This should create a new Virtual Interface wl1.1.
Virtual Interface wl1.1Save, Apply Settings
For each of the interfaces (wl0,wl0.1,wl1,wl1.1), set security mode (i.e. WPA2-PSK), WPA Algorithms, and WPA Shared Key (wifi password)
Save, Apply Settings
At this point, you may wish to connect via wifi to the "dd-conf" network. Make sure you fix your wireless IP to something in the 192.168.1.x network with a netmask of 255.255.255.0
This is the first section that really applies to the VLANs in question. If you are not using the same device as me, this section may look different and you may have more or less ports
The end result will look something like this:
Make sure to "Save" and "Apply Settings"
Interface | Tag Number |
---|---|
eth0 | 1 |
eth0 | 26 |
eth0 | 27 |
eth0 | 55 |
Bridging sub-section
Under this section, create the following bridges using the button in the "Action" column
Create the following configuration
Assignment | Interface |
---|---|
br-vlan26 | vlan26 |
br-vlan26 | eth1 |
br-vlan26 | eth2 |
br-vlan27 | vlan27 |
br-vlan27 | wl1.1 |
br-vlan55 | vlan55 |
br-vlan55 | wl0.1 |
br-vlan1 | vlan1 |
Note, due to some weirdness with DD-WRT and/or this device, wl0 is represented by eth1, and wl1 is represented by eth2
eth0 is an interface that is divided up into the ports via the switch configuration under the "Switch Config" tab
Interface Setup Port Setup sub-section