How do I add a VLAN with internet access to LAN port 2 on my Brume 3?

[roman]

I have recently installed a Brume 3 GL-MT5000 on my home network and it works great. I have my internet provider in WAN port, a Simpoyo 4G failover in the USB port, and an unmanaged switch with Eero wifi and other devices in LAN port 1 that are assigned IP addresses over DHCP in the 192.168.1.X range.

What I want to do next is plug an unmanaged switch in to LAN port 2 and have any devices connected there isolated from the rest of my network and given addresses in the 192.168.20.X range. They need internet access from the WAN/4G but I do not want them to be able communicate locally with anything connected to LAN port 1.

I am familiar enough with the Gl.inet admin interface, LuCi, and SSH access to carry out whatever work I need to do to make this happen, but I made the mistake of trying to get Claude AI to help me and after hours of trying I didn't ever get there.

I stopped and thought "this must be a pretty common use case, I must be overcomplicating it!" and that is why I find myself here in the forum asking for help

I searched for other posts, but except for one post, I only found some references to the OpenWRT VLAN documentation and trying to follow that confused me. I can provide screenshots of my current config in LuCi if needed, although really I would like to start over.

Is somebody able to help me, step by step, get this working please? Any help much appreciated!

Thank you

[will.qiu]

Hi,

Please follow the steps below:

1. Go to LuCI → Network → Switch and assign different VLAN IDs to LAN 1 and LAN 2:
   

   

2. Go to LuCI → Network → Interfaces → Devices and create a new bridge for LAN 2:
   

   
   
   
   

3. Go to LuCI → Network → Interfaces → Interfaces and configure the new bridge created in the previous step by assigning an IP address, enabling DHCP, and creating a new firewall zone:
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   

4. Go to LuCI → Network → Firewall and create a forwarding rule from this firewall zone to WAN:
   

   
   
   
   

5. Click “Save & Apply” to make the configuration take effect.

[roman]

Thanks very much for this, it worked perfectly!

[g.4xj2c]

Hi @will.qiu

Question - I have the same requirements as the OP. Your solution worked, but the problem is that the AP I have on the LAN 2 port is not respecting the Brume 3 VPN tunnel policies. It seems to be bypassing the VPN routing policies entirely and going straight to ISP. The Brume just updated and is now on 4.9.0. How can I correct this behavior?

Also, the AP devices connected to the poe switch behind Brume’s port 2 was still able to access the Brume admin panel. I want to isolate from accessing LAN and admin portals for extra security.

[will.qiu]

Hi,

If you want to use the created network (VLAN) together with VPN, you also need to add this network to the VPN policy control scope as follows:

@charles2

5. Add the custom interface to GL.iNet route policy.

SSH into the router and run:

uci delete route_policy.global.append_source_if
uci add_list route_policy.global.append_source_if='iot'
uci add_list route_policy.global.append_source_if='custom_net'
uci commit

/etc/init.d/vpn-client restart

Please replace custom_net with your own interface name if you use a different name.

The interface name should be lowercase and should match the name shown in LuCI → Network → Interfaces.

If you have multiple custom interfaces, add each one:

uci add_list route_policy.global.append_source_if='name'

To prevent devices on this network from accessing Brume 3 itself, you need to adjust the firewall settings:

1. Go to LuCI → Network → Firewall and change the default INPUT policy of the firewall zone assigned to this network to DROP:

2. Add Traffic Rules to allow DHCP and DNS requests from this network to Brume 3:

3. After this, it should work as expected:

[g.4xj2c]

Hi @will.qiu ,
I ran the SSH commands and implemented everything precisely as you instructed. However, I was unsuccessful. Topology is as follows:

ISP > Brume 3 >

• Port 1 LAN to admin /
• Port 2 LAN to “server” unmanaged switch.

The ““server/iot” devices connected to switch behind LAN 2 are still not respecting the Brume 3 VPN tunnel policies and are getting direct ISP connection

The firewall works and I cannot access the brume admin portal from those devices. Oddly, I am still able to ping 192.168.20.1 with success.

The ssh vpn commands did not work and “sever/LAN 2” still circumvents the Brume vpn routing tunnels.

[will.qiu]

Hi,

In our previous testing, the device connected to the LAN2 port appeared to be able to forward traffic through the VPN normally without any issues (the tracert result showed 10.64.0.1, which is the tunnel IP address of the WireGuard VPN we used).

Could you please provide a screenshot of Admin Panel → VPN → VPN Dashboard so we can better understand the issue?

(If you have configured any VPN policies, please also provide screenshots of the specific policy settings page.)