# Pre-Implementation Findings

Notes from live router investigation before VLAN implementation begins.

---

## DSA and Bridge Architecture

**Concern raised:** OpenWRT 24.10+ uses DSA (Distributed Switch Architecture) on the MT7621. The implementation plan needed to be validated against the actual router interface naming and bridge support before work begins.

**Finding: bridge-per-VLAN approach is confirmed valid.**

`ip link show` output from the live router:

```
1: lo
2: eth0                          — uplink to MT7621 switch ASIC
3: wan                           — WAN port (PPPoE)
4: lan1@eth0  — UP              — LAN port 1 (wired, device connected)
5: lan2@eth0  — NO-CARRIER      — LAN port 2 (nothing plugged in)
6: lan3@eth0  — UP              — LAN port 3 (Sonos Connect)
7: lan4@eth0  — NO-CARRIER      — LAN port 4 (nothing plugged in)
8: br-guest                      — guest bridge (already live)
9: br-lan                        — main flat LAN bridge
10: pppoe-wan
11: phy0-ap0  → br-lan           — Moonshield (2.4GHz)
12: phy1-ap0  → br-lan           — Moonshield (5GHz)
13: phy0-ap1  → br-guest         — guest SSID (2.4GHz) — already attached
14: phy1-ap1  → br-guest         — guest SSID (5GHz) — already attached
```

**Key conclusions:**

- DSA port names are `lan1`–`lan4` — use these in `list ports` when defining bridge devices in `config/network`.
- `br-guest` is already running in production with two wireless VAPs attached — the bridge-per-VLAN pattern is proven on this hardware.
- Both radios support `AP` and `AP/VLAN` modes with up to ~4 VAPs per radio, so adding Cloud Connected and Pinball Map SSIDs will not hit hardware limits.
- The `config/network` entry for `br-guest` currently has no `list ports` entry (bridge_empty '1'), confirming that wireless-only bridges work fine without a wired port.

---

## Pending Validation Test

**Test: assign a physical port to `br-guest`, connect a device, verify it gets a `10.10.10.x` IP.**

This validates the full stack — port assignment, bridge isolation and DHCP — using a live but low-risk interface before touching the main VLAN work.

**Steps (when physically at the router):**

1. Edit `config/network` — add `list ports 'lan4'` to the `br-guest` device block
2. `./scripts/safe-apply.sh network 5`
3. Plug a device into LAN 4
4. Confirm it gets an IP in `10.10.10.100`–`10.10.10.249` (pool: start 100, limit 150)
5. Verify on router: `ssh openwrt "cat /tmp/dhcp.leases"`
6. **Clean up:** remove `list ports 'lan4'` and re-push before starting real implementation

**Status: complete — passed 2026-04-02.**

Result: device on LAN 4 was issued `10.10.10.101` (within pool `10.10.10.100`–`10.10.10.249`). Port assignment, bridge isolation and DHCP all confirmed working end-to-end.

**Next step:** remove `list ports 'lan4'` from the `br-guest` device block and re-push before starting VLAN implementation.