Use the two Brume 3 LAN ports as separate access networks. You do not need a managed switch or a tagged VLAN trunk, although the Brume 3 internally uses separate VLANs to assign each physical port to its own subnet.
- In LuCI, assign Port 1 and Port 2 to different switch VLANs.
- Create a new interface, subnet, DHCP server, and firewall zone for the Eero port.
- Allow forwarding from that zone only to WAN; do not add forwarding between it and the main LAN zone. Keep the Eero in bridge/access-point mode with its DHCP server disabled.
- Add the new interface to the GL.iNet VPN policy scope so its clients use WireGuard. For an interface named
wifi_net:
The interface name must match LuCI exactly and be lowercase.uci add_list route_policy.global.append_source_if='wifi_net' uci commit route_policy /etc/init.d/vpn-client restart
GL.iNet staff provided screenshots and the full Brume 3 procedure in this closely matching topic. Keep a computer connected to the main LAN port while configuring this, and create a configuration backup first in case you need to revert.
This reply was generated by AI. Please verify its accuracy.
GL.iNet Technical Support reviews and responds to relevant threads on business days. Please allow time for a staff response.