BE6500 Vlans Setup

[DarkJR]

Hello, I am having issues setting up Vlans on the BE6500.
On Luci, going to devices br-lan and enabling vlan filtering. Does not work, like in OpeWRT ( Luci vanilla).
Creating a new bridge Ex br-lan2, and enabling vland filtering, does not work, for me either.
I also tried, following this guide, from Dec 2025:

Guide to setting up a vlan on the GL-iNet routers?

My security camera system is currently on the 2.4 guest network of my GL-iNet MT-6000. The cameras must be on WIFI. I would like to put them on a wireless vlan so I can turn off the guest network. I have four cameras and I don't plan to use a switch though if need be, there are two managed switches on my lan. I also have several other GL-iNet travel routers that I could turn one into an access point if that is a better way to go. I have created a vlan on the Slate Plus travel router and the ssi…

The code makes sense, but SSH into the router, after the last commit and reboot… nothing. I don’t get an IP address from any interface.
I am on GLInet firmware 4.8.8, any help on this will be much appreciated. Thanks

[will.qiu]

Hi

The BE6500 uses swconfig rather than DSA for VLAN management. You may find the following OpenWrt guide helpful:

[OpenWrt Wiki] VLAN

(Mapping between the BE6500 port labels on the chassis and the ports shown in swconfig.)

---

You may also refer to the following forum post:

Flint 3 (GL-BE9300) as AP behind pfSense: multiple SSIDs -> VLAN + Random BSSID

Hi everyone, I’m considering Flint 3 (GL-BE9300) to use as a wired access point behind pfSense (AP/bridge mode, no NAT, no DHCP on BE9300). pfSense will provide VLAN trunk and DHCP/firewall per VLAN. My goal is: 3-4 SSIDs, each mapped to a separate VLAN (SSID → VLAN), e.g. Main / Work / IoT / Guest Randomized BSSID enabled, and I need it to still rotate in AP mode (i.e., change on reboot, not only in router mode) Questions for BE9300 owners: Have you actually achieved multiple SSID…

---

If you're not familiar with these configurations, you may want to provide:

• A detailed network topology diagram, including the relevant ports and IP addresses
• Your planned VLAN layout and requirements

This will make it easier for us or other community members to provide more specific guidance and assistance.

[DarkJR]

Hello, Before I forget, thanks for the reply.
I was able to configue the vlans, and to be honest I been using DSA instead of swconfig.
For others to see this is what I did:
Go to the interfaces and create them attach it to the switch vlan see the attached picture for reference.

[DarkJR]

After that make sure the interfaces are attached to the proper bridge.

[DarkJR]

Last, step is to add the vlan configuration to the switch.

[DarkJR]

For the visual people like me, following these instructions can save you some time.
One last question, Is there a timeline of When will these routers will be upgraded to openwrt 25?

[will.qiu]

Thank you for sharing the detailed VLAN configuration steps.

---

@DarkJR

One last question, Is there a timeline of when these routers will be upgraded to OpenWrt 25?

Since the BE6500 stock firmware is currently based on QSDK, it is likely that we will need to wait for Qualcomm to release a newer platform version before an OpenWrt 25-based firmware can be considered.

At the moment, we do not have any additional information or a timeline that we can share.

[yyuan]

Hello @DarkJR, thanks for your post. You mentioned eth1.20 and eth1.30 devices added in Adding device config section, however in Bridge ports, it shows eth1.1.20 and eth1.1.30 were added, is this correct? Thanks

[DarkJR]

Hello, I end up returning back the router. In the enviroment that I am building, We need Openwrt 25.x vanilla. From all the research I did, support for that version of opeWRT is “planned” that in my opinion is still up in the air. I still do not understand – Why GLiNET releases a new device with very old (ancient) firmware. From a compliance standpoint to me it does not makes any sense.

[yyuan]

For firewall Settings, not sure what to select, guest is selected for now

At this point, after system restarts, VLAN appears not working. Some of steps may not be correct.

It would be much appreciated if someone could offer some guidance or detailed instruction. Thanks!

[yyuan]

Step 4: create new interface “Lan21”

[yyuan]

Step 3: add eth1.21 device to Bridge device: Br-Lan

[yyuan]

Step 2: Create eth1.21 device

[yyuan]

I noticed that, with LuCI , I could not create eth1.21 device without adding vlan21 to switch configuration first, it adds Switch VLAN “eth1.21” in existing device dropdown list for selection.

Step 1: Setup Vlan on Switch

[yyuan]

Hello, I am also having issues setting up Vlans on the BE6500 newly acquired. Thanks for the additional information mentioned in this thread. Due to my limited knowledge, I could not quite follow some of steps mentioned above.

I am on GL-iNet firmware 4.8.8, and here is my planned Vlan environment

- Vlan 1 (default) – untagged for all 4 Lan ports on router

- Vlan 21 – tagged on Lan port 1, off on Lan port 2/3/4, on router

- Lan port 1 (router) serves as a trunk port, connected to another managed switch

- Interface for Vlan 21 runs with a static IP of 192.168.21.1/255.255.255.0

Is it possible to setup this Vlan environment with LuCI utility (in Router’s Advanced Settings) only or more is required?

[yyuan]

After some research from this forum, I was able to make Vlan working for my BE6500 via both SSH/UCI and LuCI GUI. Since I am new to GL product, learning SSH/UCI scripting and understanding how LuCI GUI works for Vlan setup took some time. It is quite an experience (and fun) to work through. Credit and acknowledgment are listed in Reference section later in the post.

BE6500 VLAN Configuration via UCI and LuCI

My GL-BE6500 is on firmware 4.8.8.

Planned Vlan environment

- Lan port 1 (router) serves as a trunk port, connected to downstream managed switch

- Vlan 1 (default) – untagged for all 4 physical Lan ports, on router

- Vlan 21 (IOT) – tagged on physical Lan port 1, off on physical Lan port 2/3/4, on router

- Interface for Vlan 21 runs with a static IP of 192.168.21.1/255.255.255.0

- Vlan 21 can only access Wan/Internet, not to other Vlans

- Vlan 1 (default) can access Vlan 21

Pre-conditions: BE6500 is manufactured reset + basic Wan/Lan settings

As @will.qiu pointed out earlier, the Flint3/BE6500 uses swconfig for VLAN management.

Flint3/BE6500 swconfig Switch 1 Ports mapping to Switch Ports and Physical LAN Ports:

It is observed that the Flint3/BE6500 swconfig switch 1 port # order (Red above) appears different from that mentioned earlier in this thread (also in Reference 1)

Part 1 VLAN Configuration via SSH/UCI script

This is a quite straight forward approach by running a SSH/UCI script.

Use SSH or PuTTY (login as root) and run following UCI script

#
#Create VLAN 21 (IOT)
#

#Setup Physical Lan Port 1 as trunk port for downstream AP/switch
#swconfig Switch 1 Port 3 = cpu
#swconfig Switch 1 Port 7 = Physical Lan Port 1 

uci set network.vlan_iot='switch_vlan'
uci set network.vlan_iot.device='switch1'
uci set network.vlan_iot.vlan='21'
uci set network.vlan_iot.ports='3t 7t'

#Create sub-interface/device for VLAN 21

uci set network.eth1_21='device'
uci set network.eth1_21.name='eth1.21'
uci set network.eth1_21.type='8021q'
uci set network.eth1_21.ifname='eth1'
uci set network.eth1_21.vid='21'

#Create the IOT interface

uci set network.iot='interface'
uci set network.iot.device='eth1.21'
uci set network.iot.proto='static'
uci set network.iot.ipaddr='192.168.21.1'
uci set network.iot.netmask='255.255.255.0'

#Enable DHCP for IOT

uci set dhcp.iot='dhcp'
uci set dhcp.iot.interface='iot'
uci set dhcp.iot.start='100'
uci set dhcp.iot.limit='150'
uci set dhcp.iot.leasetime='12h'


#Create the IOT firewall zone

uci add firewall zone
uci set firewall.@zone[-1].name='iot'
uci set firewall.@zone[-1].network='iot'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci set firewall.@zone[-1].masq='1'
uci set firewall.@zone[-1].mtu_fix='1'

#Allow IOT to access WAN

uci add firewall forwarding
uci set firewall.@forwarding[-1].src='iot'
uci set firewall.@forwarding[-1].dest='wan'

#Allow DHCP and DNS on IOT

uci add firewall rule
uci set firewall.@rule[-1].name='Allow-IOT-DHCP'
uci set firewall.@rule[-1].src='iot'
uci set firewall.@rule[-1].proto='udp'
uci set firewall.@rule[-1].dest_port='67-68'
uci set firewall.@rule[-1].target='ACCEPT'

uci add firewall rule
uci set firewall.@rule[-1].name='Allow-IOT-DNS'
uci set firewall.@rule[-1].src='iot'
uci set firewall.@rule[-1].proto='tcp udp'
uci set firewall.@rule[-1].dest_port='53'
uci set firewall.@rule[-1].target='ACCEPT'

#Commit and Reboot

uci commit
reboot

Part 2 VLAN Configuration via LuCI GUI

This approach uses LuCI GUI only. It has 6 steps and does need some patience to get through.

Step 1 Create VLAN 21 (IOT)

· LuCI->Network->Switch

· Add a new Vlan 21 to Switch 1 - tag CPU and Lan 4 (= Physical Lan 1) as trunk port

· Save and Apply

Step 2 Create VLAN 21 Device

· LuCI->Network->Interfaces->Devices

· Click “Add devices configuration”, and select/input info as below, then click Save

Now Vlan21 device “eth1.21” is created

Step 3 Create VLAN 21 (IOT) Interface

· LuCI->Network->Interfaces

· Click “Add new interface”

· Click “Create interface”

· Add IPv4 address/netmask: 192.168.21.1/255.255.255.0

Do not save the above

Step 4 Setup Firewall Zone for VLAN 21 (IOT) Interface

· Goto Interface>iot->Firewall Settings

· Click firewall-zone dropdown and type “iot” in empty field, then hit ENTER

Do not save the above

· Goto Interface>iot->DHCP Server and enable DHCP

· Click Save to save iot interface

Step 5 Save IOT Interface

· Click Save and Apply to start/activate the IOT interface

Step 6 Setup IOT Firewall Rules for accessing Wan, DHCP and DNS

· LuCI->Network->Firewall

Step 6.1 Setup IOT Wan Access

· Click Edit for iot

· Click two checkmarks

· For “Allow forward to destination zones”, select Wan line from dropdown, then click Save

· Click Save and Apply above to enable IOT Wan access

Step 6.2 Setup IOT Traffic Rules for DHCP and DNS

· LuCI->Network->Firewall->Traffic Rules

· Many existing rules are listed here, goto to bottom of the page

· Click Add for adding new traffic rules

· Add IOT DHCP traffic rule – input info below, then click Save

· Add IOT DNS traffic rule – input info below, then click Save

And here is how the two firewall traffic rules look like in Network->Firewall->Traffic Rules list:

· Click Save and Apply to activate the firewall traffic rules

Up to this point,

· Vlan21 IOT interface should be up and running

· Vlan21 IOT can access to Wan

· Both DHCP and DNS firewall traffic rules should be functional.

· BE6500 physical Lan 1 port, acting as trunk port carrying both Vlan 1 (untagged) and Vlan 21 (tagged), is ready to be connected to a downstream AP or managed switch.

References and Acknowledgment

Significant knowledge/information is learnt and extracted from following references. Credit and appreciation go to linked sites and related authors.

Ref.1 @bruce @will.qiu https://forum.gl-inet.com/t/flint-3-gl-be9300-as-ap-behind-pfsense-multiple-ssids-vlan-random-bssid/66719

Ref.2 WickedYoda: https://www.wickedyoda.com/%f0%9f%9b%a0%ef%b8%8f-vlan-and-guest-network-configuration-on-flint-3-gl-be9300/

Ref.3 OpenWrt: https://openwrt.org/docs/guide-user/network/vlan/switch_configuration

Ref.4 OpenWrt: SSH access for newcomers - https://openwrt.org/docs/guide-quick-start/sshadministration

[bruce]

Thank you so much for sharing this! This is an incredibly valuable guide for swconfig-based VLAN setups. It should work like a charm on most swconfig devices, though you'll definitely want to double-check the port mapping on the router specific switch.
You clearly know your way around OpenWRT now—seriously impressive stuff, much appreciated!

[yyuan]

It is nice to have LuCI GUI to perform Switched Vlan configuration without touching low level SSH/UCI scripting. However, mistakes do happen from time to time due to many manual steps involved, resulting in some part of Vlan related information missing or misconfigured and Vlan function not working. Knowing and understanding how specific Vlan information is stored and present in configuration files really help to identify where Vlan information is missed or misconfigured, so correction could be made accordingly in specific configuration steps.

When Issue happens, just save system configuration file in current state for issue investigation.

· LuCI->System->Backup/Flash Firmware

· Click “Generate archive” save a copy of system configuration files

Below is a table showing my BE6500 specific Vlan21 related configuration information produced by SSH/UCI scripting approach and by LuCI GUI approach, both configurations look almost identical and working.

BE6500 - Vlan21 related Configurations produced by UCI and LuCI

[yyuan]

@bruce Thanks for your kind words and encouragement. Regarding question related to “port mapping on the router specific switch”, this has puzzled me for sometimes. Here is how I ran tests on my BE6500 (firmware 4.8.8).

Test 1 - setup swconfig Switch 1 to Port 3 (cpu) and Port 7

uci set network.vlan_iot='switch_vlan'
uci set network.vlan_iot.device='switch1'
uci set network.vlan_iot.vlan='21'
uci set network.vlan_iot.ports='3t 7t'
uci commit
reboot

This is how it looks like in LuCI GUI:

BE6500 physical Lan port 1 is activated and functional as a trunk port. It appears on BE6500 (firmware 4.8.8):

swconfig Switch 1 Port 7 = Switch “switch1”(RTL8372N) Port 4 = Physical Lan Port 1

Test 2 - setup swconfig Switch 1 to Port 3 (cpu) and Port 4

uci set network.vlan_iot='switch_vlan'
uci set network.vlan_iot.device='switch1'
uci set network.vlan_iot.vlan='21'
uci set network.vlan_iot.ports='3t 4t'
uci commit
reboot

This is how it looks like in LuCI GUI:

BE6500 physical Lan port 4 is activated and functional as a trunk port. It appears on BE6500 (firmware 4.8.8):

swconfig Switch 1 Port 4 = Switch “switch1”(RTL8372N) Port 1 = Physical Lan Port 4

Both tests on BE6500 shows that swconfig Switch 1 Port order is different from swconfig Switch 1 Port order (blue line) for Flint3/BE9300 listed in a diagram, I copied here:

Perhaps there might be some mis-understating in my observations? Any input would be appreciated. Thanks!

[bruce]

Thanks for the catch! It's following the mapping rules you listed, that is correct:

@yyuan

To make it easier for more users to navigate the LuCI interface and get a better grasp of the settings, I have updated the screenshots:

Both the Flint 3 and Flint 3e are built on the same swconfig framework.