Flint 2 as "dumb" VLAN (W)AP + OPNsense router

[Pablo_grb]

Hi, I recently got a Flint 2 router, and I wanted to put it behind an OPNsense router to use it as a dumb WAP. Furthermore, I wanted to divide my network as follows:

Step 1: Wireless access point for trusted devices and all Ethernet ports for trusted devices
Step 2: Wireless access point for untrusted devices and one Ethernet port for untrusted devices

Since I want my OPNsense router to manage everything, I thought I would need to use VLANs.

Step 1 worked, but Step 2 failed. When trying to connect my smartphone to the untrusted devices network, it never received an IP address via DHCP. I have already tried a lot of tutorials, talked for hours with AI, and followed forum posts, but nothing seemed to work for me. I unfortunately couldn't find a post covering this exact setup for my devices:

Devices:
OPNsense router: Version 26.7.1_1
Flint 2 router: Default GL.iNet firmware (v4.9.1)

Here is my Setup:

On the OPNsense Router:

1. Create a new VLAN vlan02[testvlan] with VLAN tag 20 (under Intefaces -> Devices -> VLAN)
   

2. Create a new assignment (under Interfaces -> Assignment):
   

3. Enable the new [testvlan] interface and set the static IPv4 address to 172.16.20.1 (my LAN is 172.16.7.1, so I am keeping it consistent).

4. Add DHCP for my new VLAN 20:

Services -> DNSmasq DNS & DHCP -> General -> Interface: added testvlan

Services -> DNSmasq DNS & DHCP -> DHCP ranges: see picture:

5. Add firewall allow rules (since this is just a test, the rules allow everything):
   
   

On the Flint 2:

1. Network -> Network Mode: I selected Access Point.

On the OPNsense Router (last time doing something there):

1. Get the MAC address of the Flint 2 and assign it a static IP:
   
   

Back to the Flint 2:

1. System -> Advanced Settings -> Go To LuCI

2. Network -> Devices -> br-lan: enable VLAN filtering and set up VLAN ID:
   {picture}
   on lan1 is my OPNsense and on lan2 my PC

3. Network -> Interfaces: Delete the default LAN Interface, create 2 new interfaces and configure the interfaces as follows:
   

   
   
   
   

I have given both of these interfaces the firewall rule lan, which was already there. Though I am asking myself why there is even a firewall, because I activated AP mode as the first step on the Flint 2...

Also, on both interfaces, DHCP is set to "Ignore interface". I want to use the DHCP server on my OPNsense.

4. Save and apply to ensure everything is working and to create br-lan.1 and br-lan.20.

5. br-lan.1 should have the same MAC address as the one we set the static IP for in OPNsense.

6. Note: I also gave br-lan.20 a new MAC address, ending with 75, see picture under 3. (not sure if that's needed).

7. Network -> Wireless: Edit SSID GL-MT6000-b71 and set Network to myvlan.

8. Network -> Wireless: Edit SSID GL-MT6000-b71-IoT and set Network to vlan20. I didn't want to create a new Wi-Fi network because, from experience, you have to go to the console to add some code to prevent a "Wireless is not associated" error.

9. Reboot.

On the Smartphone:

1. Connect to GL-MT6000-b71: Get an IP address -> be happy.
2. Connect to GL-MT6000-b71-IoT: Get no IP address -> be confused and write this post.

I'm looking forward to your replies, and I'm interested to see my mistake(s). Also, please let me know if i forgot to share some important information

[charles2]

Hi,

Thank you for providing the detailed configuration and screenshots.

We noticed that your testvlan interface uses the 172.16.20.0/24 subnet, but the DHCP range shown in the screenshot is currently configured as:

Start: 172.16.20.10
End:   172.26.20.200

For the Flint 2 side, you can also compare the Bridge VLAN Filtering configuration with the example below.

This means VLAN 1 is sent untagged to OPNsense, while VLAN 20 is sent as a tagged VLAN on the LAN1 uplink. LAN5 then acts as a normal untagged access port for VLAN 20.

After correcting the DHCP range and VLAN settings, we suggest testing the following two cases separately:

1. Connect a computer directly to LAN5 and check whether it can obtain a 172.16.20.x address from
2. Connect a device to the IoT SSID and check whether it can also obtain a 172.16.20.x address.

If LAN5 can obtain an address but the IoT SSID cannot, the VLAN 20 trunk and OPNsense DHCP are most likely working, and it maybe the IoT SSID/network binding on the Flint 2.

Thank you for your cooperation and support.

[Pablo_grb]

Thank you very much. The typo was the mistake. After changing it to End: 172.16.20.200 it worked and my PC was able to get an 172.16.200 IP as same as my smartphone via the IoT SSID

2 last questions: I added the ra2 to br-lan; (read that somewhere). is that not necessary?

Also when in AP mode can i use the eth1 as lan and plug my OPNsense router in there?

[charles2]

Hi,

Thank you for the update. We are glad to hear that correcting the DHCP range resolved the issue.

For your first question, ra2 is the wireless interface used by the 2.4 GHz IoT SSID in this configuration. Since this SSID belongs to VLAN 20, keeping ra2 in br-lan and setting it as U* for VLAN 20, as shown in your screenshot, is correct. There is no need to remove it.

For your second question, yes, you can also use eth1 (the original WAN port) as a LAN/uplink port in AP mode and connect your OPNsense router to it.
Since you are carrying both VLAN 1 and VLAN 20 to OPNsense, after adding eth1 to br-lan, please configure eth1 in Bridge VLAN Filtering in the same way as your current LAN1 uplink:

VLAN 1  → U*
VLAN 20 → T

Thank you for your feedback and support.