I have installed OpenWrt on a MikroTik Routerboard RB750UP (AR7240 CPU with AR9330 built in switch). I have included additional details below, but my question is:

How do I configure an untagged and tagged vlan on the same port?

I have successfully configured non-tagged vlans and tagged vlans independently, but not for the same port. The reason why I want to do this is because I have a Ubiquiti NanoStation loco M2 plugged into a port providing a wireless lan (which requires untagged frames), but I also want to configure a tagged vlan for managing the loco (i.e. accessing its management ip via tagged van).

Here are some further details:


  • MikroTik RouterBoard RB750UP
  • Ubiquiti NanoStation loco M2

swconfig output:

swconfig dev eth0 help
switch0: eth0(AR7240/AR9330 built-in switch), ports: 5 (cpu @ 0), vlans: 16

Here's a link to a diagram of (what I believe to be) the layout of the RB750's AR7240/AR9330 switch.

Operating System

OpenWrt BARRIER BREAKER (Bleeding Edge, r36085), built with a custom configuration

# uname -a
Linux OpenWrt 3.8.3 #3 Wed Mar 27 04:09:04 PDT 2013 mips GNU/Linux

Network Diagram

Here's a link to a diagram of my Network Setup.

As the image shows, the NanoStation loco is plugged into port 3 and has a management IP of configured on a vlan with vid=3. It also acts as a wireless bridge/access point for the network.

Accordingly, port 3 on the router has an untagged vlan configured for the network and a tagged vlan for the management network (with vid=3).

Network Configuration

Here's what I'm trying to achieve with the below config:

  • Tagged VLAN 3 (vid=3) on port 3 (virtual interface eth0.3)
  • Untagged VLAN 4 on port 3 (virtual interface eth0.4)
  • Default vlan pvid=4 on port 3 (to handle incoming untagged frames)

And the actual contents of /etc/config/network:


config interface 'loco'
        option proto 'static'
        option ifname 'eth0.3'
        option ipaddr ''
        option netmask ''

config interface 'locolan'
       option proto 'static'
       option ifname 'eth0.4'
       option ipaddr ''
       option netmask ''


config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option vid '1'
        option ports '0t 2 4'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option vid '2'
        option ports '0t 1'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option vid '3'
        option ports '0t 3t'

config switch_vlan
       option device 'switch0'
       option vlan '4'
       option vid '4'
       option ports '0t 3'

config switch_port
    option port '3'
    option pvid '4'

After rebooting the router, swconfig shows the following switch configuration. Note the missing '3t' from VLAN 3.

# swconfig dev switch0 show
Global attributes:
    enable_vlan: 1
Port 0:
    pvid: 0
    link: port:0 link:up speed:1000baseT full-duplex txflow rxflow 
Port 1:
    pvid: 2
    link: port:1 link:up speed:100baseT full-duplex auto
Port 2:
    pvid: 1
    link: port:2 link:down
Port 3:
    pvid: 4
    link: port:3 link:up speed:100baseT full-duplex auto
Port 4:
    pvid: 1
    link: port:4 link:up speed:100baseT full-duplex auto
    vid: 0
    ports: 0t 
    vid: 1
    ports: 0t 2 4 
    vid: 2
    ports: 0t 1 
    vid: 3
    ports: 0t    <----- no tagged port 3!
    vid: 4
    ports: 0t 3

As a result, I cannot ping the loco's management IP.

I've also tried manually configuring the vlan/port assignment and tags using swconfig, but in each permutation, it either leaves port 3 out of one of the vlans, or it forces port 3 to be tagged in both vlans.


  1. How do I configure an untagged and tagged vlan on the same port? I'm specifically trying to configure this for OpenWrt, but even understanding how to do this for Linux in general would be helpful.
  2. Are there any known bugs/issues with swconfig or the AR7240/AR9330 OpenWrt switch driver that could be causing this? (None came up in my searches.)
  • I'm confused with your goals: (2) Untagged VLAN 4 on port 3 (virtual interface eth0.4) and (3) Default vlan pvid=4 on port 3 (to handle incoming untagged frames). If you have untagged VLAN 4 on port 3, it will already handle incoming untagged frames, isn't it? Why do you need extra default vlan pvid=4 on port 3 then? Feb 13, 2015 at 10:53

4 Answers 4


Generally speaking, even untagged ports need to be assigned a NATIVE VLAN id AND only if this is different from the default id of 1. This is to help the switch understand how to forward packets. If you do not provide a vlan and it is bridged, it's considered a routed interface. You should not generally specify subinterfaces (ie tags) on interfaces unless you expect it to be bound on that system with an IP on that interface.

  1. Configure the vlan routed interfaces (not the physical/bridged)
  2. Specify the tagging protocol used on the physical bridged interfaces (ie. dot1q)
  3. Choose AND specify the native VLAN id on all interfaces (if NOT vlan 1)

Another point. Generally speaking, tagging only occurs when a L2 packet moves from one vlan to the core switch engine and only if it needs to be carried over another trunk. When a packet flows out of the switch engine it is stripped of the tag and forwarded via standard Ethernet frames.

  • "If you do not provide a vlan and it is bridged" - something is wrong with that statement. I think you mean if it's not bridged then it's routed.
    – hookenz
    May 13, 2015 at 20:39
  • Bridging does not imply tagging (vlan) and either can be routed (or not). L2 and L3 are not the same. One is related physical packet switching (L2) and the other is protocol routing (L3). The problem is that the term "bridge" is used quite loosely. Technically bridging describes a physical connection (L1) and happens before any framing. This can be thought of as the connection between two interfaces. VLANs (aka dot1q tagging in this case) is a special L2 state in which all L2 packets are marked with an ID which should be handled as a separate logical L2 network by both endpoints. Jan 25, 2017 at 21:02

I don't think it is possible to have a port with tagging enable AND without..

Either you are in access mode with an id configured (no tagging),

Either you configure multiple id on the port in access mode.

Either you are tagging on that port,with à single id

Either you are tagging multiple id to isolate trafic, it is called a trunk

I think what you need here is a trunk on your interface with your admin and data vlan configured on. Keep in mind the port configured on the other equipement must accept tagged frame on the specific id vehiculate by the trunk


I think the common point of confusion (in this situation, and for users who are somewhat new to VLANs) is that access points by default do not tag the management interface on the AP itself to any VLAN id, so you can lose the ability to configure the AP from a web interface if the managed switch port that the AP is connected to is changed to tagged with a few VLANs (trunk).

The solution is to setup the VLAN IDs on the AP first, then test them by temporarily changing the managed switch port to a trunk port with the tagged VLANs, to test if the VLANs actually work and are setup correctly in the router.

If the VLANs seem to be working ok (connect to the SSIDs one at a time), then temporarily change the trunk port back to untagged (regular port) and find the setting in the Access Point web interface that ties the management interface on the AP itself to whatever VLAN you want. If you are sure the VLAN actually works ok (you should have just tested it), you can set the AP management interface to this VLAN. Finally, change the switch port back to a trunk port, tagging each VLAN you want, one for each SSID, and/or the management VLAN if that's not on Wifi. Now, you should have VLANs working and access to the AP web interface at the same time.



For this.. Best practice is to assign the Native VLAN or PortVlan ID on that specific port to VLAN for the NanoStation. Than TAG all your other VLANs if you want them passed on that port. Not all devices can pass tagged frames. Also you do not have to assign all members to those ports. Only assign the vlan members to ports that you want the traffic passed on. (Saves Bandwidth).

Your other ports can be see to there appropriate PVID / Physical Vlan and be tagged. If you only need to pass one vlan then set it as untagged for a device that only needs that vlan.

Keeps you config simple.

Hope this helps.. Cheers..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.