[seneka21]

Hi,

I use an activated DD-WRT r55678 (dd-wrt_x64_full_vga_2GB) firmware.

Despite multiple hours spent on various guides search and trial - error attempts I didn't manage to create a working VLAN on eth1 (for safety reasons - IoT network).

The Networking configuration settings as in the attached picture (default settings).

It may be helpful to mention that the command "nvram show | grep vlan.*ports"
returns "size: 21553 bytes (109519 left)
vlan3ports=1"

I would be grateful if smn could give me some help in this - preferably through command line.

[lexridge]

A screenshot of your Switch Config tab would also be useful. Did you set that up?

[ho1Aetoo]

x86 do not have a "switch config" tab because they do not have a switch...
VLANs can be easily configured on x86...
See sticky

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1283409#1283409

[seneka21]

Dear ho1Aetoo and lexridge thank you a lot.

By following your instructions I have done some configurations in Networking tab in order to attach any device on physical port Eth1 to VLAN7.(attached picture)

Although everything seems to me OK none of the devices connected on physical port Eth1 gets online.

I have tried a lot to find a way around with no success

I rely on your expertise and your goodwill for some further help:-)

Have a nice day

[ho1Aetoo]

Everything looks right.

A few notes:

disable STP on br1
enable net isolation on br1
delete the additional DHCP server for br0

Which IP address range does the normal LAN network have?
(hopefully a different one than br1)

second question do the devices connected to eth1 get IP addresses in the range 192.168.107.1/24?

and finally the price question, is there a device connected to eth1 that is capable of VLAN7 tagging?

this is a tagged VLAN
only devices that can handle IEEE 802.1q, such as managed switches or other routers, can be connected to a tagged port.

If you want to connect a normal end device to the port that is not capable of tagging, then it will not work.
But then you don't need a tagged VLAN... then you can delete eth1.7 again and bridge eth1 with br1.

[lexridge]

[seneka21]

[ho1Aetoo]

The Asus router is certainly capable of VLAN tagging.
But this is not required for such a simple configuration.
Tagging is required if you want to transport several VLANs via one port and one cable.

The GUI setting "network isolation" only becomes active when a WAN connection is established.
If there is no WAN connection, the networks are not isolated from each other.
If you want to change this, you need manual firewall settings.

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1283412#1283412

This provides better isolation than the GUI switch

[seneka21]

Dear ho1Aetoo, thank you very much.

Your help was invaluable in order to increase the safety in my network.
As for any additional firewall settings that you have mentioned in previous post, according to my limited experience, it would be more like opening up a can of worms

In any case I got a lot of useful knowledge about VLANs, tagging, bridges etc.

Thanks once more!

[broca]

This post is like a gold mine to me. I am in the exact situation as @seneka21 two years ago - tryig to figure out how to use VLAN to create an IoT network and isolated it from my home network. I also tried couple things, but the IoT devices are unable to reach internet and I can't get to the IPCam and NVR from the home network.

Moreover, I would appreciate some help from @ho1Aetoo to locate all the reference documents mentioned in the post. When I follow the link, they all said "The topic or post you requested does not exist".

@seneka21, how is your IoT network working so far? I would love to hear the most current status from you.

Best,

my system:
Router Model: Micro-Star International Co., Ltd. PRO B550M-VC WIFI (MS-7C95)
Firmware Version: DD-WRT v3.0-r63790 std (02/24/26)
Kernel Version: Linux 6.12.74 #833 SMP Tue Feb 24 23:48:40 +07 2026 x86_64
1ea 4 ports 2.5G NIC for home network
1ea 2 ports 2.5G NIC for WAN and IoT
Netgear xr500 as WiFi AP connected to the IoT port (MoBo WiFi 6E not supported by DD-WRT)
TrueNAS connected to Bond0 with two 2.5G slaves using VLAN101.

[ho1Aetoo]

link ..

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1315824#1315824

As I mentioned in a post earlier, you only need VLANs if you want to distribute multiple networks across a single port (e.g., LAN and IoT).

Or if, as shown in the link, a tagged VLAN is required for the WAN port.

If you don’t need a tagged WAN port or tagged LAN+IoT ports, this has nothing to do with VLANs...

I always work with bridges because they offer various advantages and are simpler.

Create a new bridge named br1.
Add an eth port to the br1 bridge.
Assign br1 a different IP address (different subnet) than br0 and add a DHCP server.
Now you can enable “net-isolation,” which isolates the bridges br0 and br1 from each other.
Masquerade must be enabled so that the bridge has internet access.

Or leave “net-isolation” disabled and add manual firewall rules.

https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1315826#1315826

Please note that your firmware version likely uses nftables instead of iptables.

[broca]

@ho1Aetoo,
are you saying I don't even have to use VLAN? I already have all my IPCAM, NVR, Smart TV, Smart appliances connected to my xr500 Wifi AP which is connected to a single port on my X86_64 system.
I could just unbridge that port, assign it to a new bridge with its separate DHCP server instance?

I don't think I will use net-isolation feature but manual firewall rules. How do I determine my box is using nftables or iptables? Where can I learn more about nftables?

Appreciate

[ho1Aetoo]

Do I really have to write this a third time?

VLANs are needed if you want to transmit multiple network segments over a single port and a single cable, e.g., LAN + IoT + GUESTS.
I don't see anywhere in your description that you want to do something like that...
If you only want to transmit one segment per port, then you don't need VLANs.

[broca]

sorry I am being redundant.

"nft list table" returned five tables, ip6 mangle, ip raw, ip mangle, ip nat and ip filter. looks like nftables in available in my DD-WRT verison. I hardly understand iptables and I relied entirely on the Firewall GUI options. I might have to learn nftables now.

I am not 100% sure what I have or need actually. I put together the following to show what my home network looks like. It evolved from a Netgear R9000 gatway. The smart thermostat, smart TVs, IPCam and NVR are my conerns.

=============================================================================
4 ports 2.5G NIC port 1 (eth2) <-LAN-> TrueHAS*
4 ports 2.5G NIC port 2 (eth3) <-LAN-> TrueNAS*
*These two ports formed Bond0 in DD-WRT with balance-alb type, layer3+4 hash and VLAN101
4 ports 2.5G NIC port 3 (eth4) <-LAN-> LinuxMint laptop and printer
4 ports 2.5G NIC port 4 (eth5) <-LAN-> Windows 11 Desktop

2 ports 2.5G NIC port 1 (eth0) <-LAN-> WAN (WAN DNS ignored, use EncryptDNS instead)
2 ports 2.5G NIC port 2 (eth1) <-LAN-> unmanaged switch
|<-LAN-> xr500 WAP #1 <-LAN-> smart TV
|<-LAN-> smart TV
|<-LAN-> BlueRay Player
|<-LAN-> xr500 WAP #2 <-LAN-> Security Cam NVR

the two xr500 has no guest network. They use the same SSID and MAC filter list. They are basically hot standby to each other to cover front and back of the house and allowing lower radio signal.

wlan0 (5g) services mainly Apple devices and two IPCams (access rarely since they are managed/report directly to the NVR wirelessly)
wlan1 (2.4g) service mainly smart appliances, smart light/power switches, and a smart thermostat that requires remote access by the power company.

Currently, I can access to all the 2.4g smart devices and the Security NVR using iOS apps via cellular network.
=================================================================================