Flint 2 PPSK, ports stop working

kr-nn · August 20, 2026, 9:19pm

I have been wracking my brain for a week trying to figure out PPSK on GL.iNet GL-MT6000

I have a working configuration for PPSK using the below wifi interface.
I cannot make this work alongside the physical ports.
No matter how I configure the bridge for the lan ports they will never work.
It seems like my only option is to use either PPSK or a VLAN trunk on the physical ports, not both.

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'test_ppsk'
        option encryption 'psk2'
        option network 'lan'
        option wpa_psk_file '/etc/hostapd/hostapd.psk'
        option vlad_file '/etc/hostapd/hostapd.vlan'
        option vlan_tagged_interface 'eth1'
        option vlan_bridge 'switch'
        option dynamic_vlan '1'

xize11 · August 20, 2026, 10:09pm

I noticed a typo here:

option vlad_file '/etc/hostapd/hostapd.vlan'

Edit:

Since I thought I was on the OpenWrt forums

Which flavour of the GL-iNet firmware is this?

This should only work properly with op24 and above.

Also worth to note:

If your bridge is just defaults br-lan, then you do not need to specify vlan_bridge that is only needed if you had a different named bridge you want the wifi devices hook in, i also see vlan_tagged_interface but this option is only important if your router is running as a dumbap type of setup and you must tag the vlans back to wan, by default it already tags it correctly as a untagged port to the bridge so it is only necessary if you need to tag it somewhere upstream.

you could use this luci trick for visibility: create a new unmanaged interface and add br-lan then you can see the bridge icon and see also the new wifi phys hook in as 'ports' it cannot be used as a real dsa port though because hostapd manages that for wifi, only use this trick as debug purpose don't let it stay to avoid network issues though.

kr-nn · August 21, 2026, 1:55am

Thanks for pointing out that typo, I tried a bunch of things even without that typo.
I typically use "switch" as my bridge and the vlans are switch.100, switch.110, etc.

My managed switch has a trunk that goes to eth1 so I do need that.
I am using openwrt but I thought this might be a flint specific issue.

xize11 · August 21, 2026, 3:57am

What can help is the output of brctl show (you may need to scroll to right some terminal clients don't show it properly as the bridge contents output are right handed on this command).

What are the contents for vlan_file ?

Maybe this option can be skipped, the problem is kinda... the options you use are kind of ambiguous/rendurant.

OpenWrt came with a newer configuration called wifi-station and wifi-vlan, some of these options like vlan_bridge conflict with the options on vlan_file as they got introduced later for wifi-station/wifi-vlan, only one of the two options can be used, vlan_file can be used for more granular control for multiple bridges.

Can you check between the * symbol for the bridge and switch bridge for the section in that file and check if that makes sense with brctl show?

Format should be:

[VLAN_ID] [Interface_Name] [Bridge_Name]

Also it is worth to note: it is possible the log complains about unable to read these files, then chmod it to 755.

kr-nn · August 21, 2026, 3:33pm

This is everything:

root@OpenWrt:/etc/hostapd# cat hostapd.vlan
100 vlan100
140 vlan140
120 vlan120
130 vlan130

root@OpenWrt:/etc/hostapd# cat hostapd.
hostapd.psk   hostapd.vlan

root@OpenWrt:/etc/hostapd# cat hostapd.psk
vlanid=100 00:00:00:00:00:00 redacted
vlanid=140 00:00:00:00:00:00 redacted
vlanid=120 00:00:00:00:00:00 redacted
vlanid=130 00:00:00:00:00:00 redacted

root@OpenWrt:/etc/hostapd# cat wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option country 'CA'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'It hurts when IP'
        option encryption 'psk2'
        option wpa_psk_file '/etc/hostapd/hostapd.psk'
        option vlan_file '/etc/hostapd/hostapd.vlan'
        option vlan_tagged_interface 'eth1'
        option vlan_bridge 'switch'
        option dynamic_vlan '1

root@OpenWrt:/etc/hostapd# brctl show
bridge name     bridge id               STP enabled     interfaces
switch140               8000.9483c4b0bf4d       no              eth1.140
                                                        vlan140
switch130               8000.9483c4b0bf4d       no              vlan130
                                                        eth1.130
switch120               8000.9483c4b0bf4d       no              vlan120
                                                        eth1.120
switch100               8000.9483c4b0bf4d       no              vlan100
                                                        eth1.100
                                                        phy1-ap0.100

It's not active right now but I typically have for the physical ports:

I'm planning to try again in the following week. When I have this active again I'll get a brctl show and send it here.

xize11 · August 21, 2026, 3:56pm

Hi,

It seems you have multiple bridges with switch naming, this will make this option: option vlan_bridge 'switch' invalid, it must be set in hostapd.vlan in the following format:

#VLAN ID	#Interface	#Bridge
100	vlan100	switch100

# if bridge is not defined br-lan is used.
100 vlan100 switch100
101 vlan101 switch101

# wildcards

# Dynamic wildcard mapping: Instructs hostapd to-
# automatically generate interfaces (like wlan0.100 # for VLAN 100) using wlan0 as the parent base:

* wlan0.#

kr-nn · August 22, 2026, 10:07am

I have tried a few different things. I have not found this documented anywhere. Do you have a link to this?

I think I simply don't understand what arguments to give each file and what the roles of the files are.

This is my current infra (chatgpt helped make this quickly, I changed a couple things to make it clearer)
mermaid diagram: link

This is what I have at the moment of posting this

root@OpenWrt:/etc/hostapd# cat hostapd.psk
vlanid=100 00:00:00:00:00:00 redacted
vlanid=120 00:00:00:00:00:00 redacted
vlanid=130 00:00:00:00:00:00 redacted
vlanid=140 00:00:00:00:00:00 redacted

root@OpenWrt:/etc/hostapd# cat hostapd.vlan
100 eth1.100 br-lan
120 eth1.120 br-lan
130 eth1.130 br-lan
140 eth1.140 br-lan

root@OpenWrt:/etc/hostapd# cat network 

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '0004e1835e8c4574404c8b5dc88e982836f5'
        option ula_prefix 'fd76:51c5:4162::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'lan1'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'

config interface 'emrg'
        option device 'lan2'
        option proto 'static'
        list ipaddr '192.168.1.1/24'
        option ip6assign '60'
        option multipath 'off'

config interface 'lan'
        option device 'br-lan.100'
        option proto 'none'
        option multipath 'off'

config bridge-vlan
        option device 'br-lan'
        option vlan '100'
        list ports 'eth1:t'
        list ports 'lan1:u*'
        list ports 'lan3:u*'
        list ports 'lan4:u*'
        list ports 'lan5:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '120'
        list ports 'eth1:t'

config bridge-vlan
        option device 'br-lan'
        option vlan '130'
        list ports 'eth1:t*'

config bridge-vlan
        option device 'br-lan'
        option vlan '140'
        list ports 'eth1:t'

config interface 'mgmt'
        option proto 'static'
        option device 'br-lan.130'
        list ipaddr '10.0.30.3/24'
        option gateway '10.0.30.1'
        option multipath 'off'
        list dns '1.1.1.1'

root@OpenWrt:/etc/hostapd# cat wireless 

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option country 'CA'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        #option network 'lan'
        option mode 'ap'
        option ssid 'test_psk'
        option encryption 'psk2'
        option wpa_psk_file '/etc/hostapd/hostapd.psk'
        option vlan_file '/etc/hostapd/hostapd.vlan'
        option vlan_tagged_interface 'eth1'
        option dynamic_vlan '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '36'
        option htmode 'HE80'
        option country 'CA'
        option cell_density '0'

config wifi-iface 'default_radio1'
        option device 'radio1'
        #option network 'lan'
        option mode 'ap'
        option ssid 'test_psk'
        option encryption 'psk2'
        option wpa_psk_file '/etc/hostapd/hostapd.psk'
        option vlan_file '/etc/hostapd/hostapd.vlan'
        option vlan_tagged_interface 'eth1'
        option dynamic_vlan '1'

root@OpenWrt:/etc/hostapd# brctl show
bridge name     bridge id               STP enabled     interfaces
br-lan          7fff.9483c4b0bf4d       no              lan4
                                                        eth1
                                                        lan5
                                                        lan3
                                                        lan1

xize11 · August 22, 2026, 10:33am

This configuration seem to look okay.

But what is odd is that I don't see the phy0 or phy1 with their vlan devices being added to the bridge.

Can you check the logs if hostapd can read those hostapd.vlan file and the hostapd.psk file?

As for the link you can visit this topic here:

If you follow this thread you can see slowly the subject changes about wifi-vlan and wifi-station some of these settings override wpa_psk_file aswell.

On the wiki you can also see some useful insights:

I use a different multi psk configuration:

github.com/xize/xsdk-uci-defaults

files/etc/uci-defaults/107_create-wireless

dumbap

#!/bin/sh

. /lib/functions/passwordhelper.sh

if [ "$(uci -q get xsdk.@factory[0].init)" != "1" ]
then
 
    mkdir -p /etc/hostapd
    echo "vlanid=178 00:00:00:00:00:00 $(genpasswd 16)" > /etc/hostapd/ppsk-vlans
    echo "vlanid=179 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    echo "vlanid=90 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    echo "vlanid=52 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    echo "vlanid=62 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    echo "vlanid=133 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    echo "vlanid=50 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    echo "vlanid=51 00:00:00:00:00:00 $(genpasswd 16)" >> /etc/hostapd/ppsk-vlans
    chmod -R 755 /etc/hostapd

uci batch << EOI
set wireless.radio0=wifi-device

This file has been truncated. show original

Essentially if I wanted to I could also remove option wpa_psk_file and use the uncommented data but in this case I was testing a patch for fast roaming, unfortunately without patch clients still hop to vlan 1 regardless which is a issue with hostapd, also this information can be found on the OpenWrt thread.