openwrt/docs/pre-implementation-findings.md

Pre-Implementation Findings

Notes from live router investigation before VLAN implementation begins.

---

DSA and Bridge Architecture

Concern raised: OpenWRT 24.10+ uses DSA (Distributed Switch Architecture) on the MT7621. The implementation plan needed to be validated against the actual router interface naming and bridge support before work begins.

Finding: bridge-per-VLAN approach is confirmed valid.

ip link show output from the live router:

1: lo
2: eth0                          — uplink to MT7621 switch ASIC
3: wan                           — WAN port (PPPoE)
4: lan1@eth0  — UP              — LAN port 1 (wired, device connected)
5: lan2@eth0  — NO-CARRIER      — LAN port 2 (nothing plugged in)
6: lan3@eth0  — UP              — LAN port 3 (Sonos Connect)
7: lan4@eth0  — NO-CARRIER      — LAN port 4 (nothing plugged in)
8: br-guest                      — guest bridge (already live)
9: br-lan                        — main flat LAN bridge
10: pppoe-wan
11: phy0-ap0  → br-lan           — Moonshield (2.4GHz)
12: phy1-ap0  → br-lan           — Moonshield (5GHz)
13: phy0-ap1  → br-guest         — guest SSID (2.4GHz) — already attached
14: phy1-ap1  → br-guest         — guest SSID (5GHz) — already attached

Key conclusions:

• DSA port names are lan1–lan4 — use these in list ports when defining bridge devices in config/network.
• br-guest is already running in production with two wireless VAPs attached — the bridge-per-VLAN pattern is proven on this hardware.
• Both radios support AP and AP/VLAN modes with up to ~4 VAPs per radio, so adding Cloud Connected and Pinball Map SSIDs will not hit hardware limits.
• The config/network entry for br-guest currently has no list ports entry (bridge_empty '1'), confirming that wireless-only bridges work fine without a wired port.

---

Pending Validation Test

Test: assign a physical port to br-guest, connect a device, verify it gets a 10.10.10.x IP.

This validates the full stack — port assignment, bridge isolation and DHCP — using a live but low-risk interface before touching the main VLAN work.

Steps (when physically at the router):

1. Edit config/network — add list ports 'lan4' to the br-guest device block
2. ./scripts/safe-apply.sh network 5
3. Plug a device into LAN 4
4. Confirm it gets an IP in 10.10.10.100–10.10.10.249 (pool: start 100, limit 150)
5. Verify on router: ssh openwrt "cat /tmp/dhcp.leases"
6. Clean up: remove list ports 'lan4' and re-push before starting real implementation

Status: complete — passed 2026-04-02.

Result: device on LAN 4 was issued 10.10.10.101 (within pool 10.10.10.100–10.10.10.249). Port assignment, bridge isolation and DHCP all confirmed working end-to-end.

Next step: remove list ports 'lan4' from the br-guest device block and re-push before starting VLAN implementation.