Omnia 4.0.5/6: VLAN configuration for guest network

I have trouble with using VLAN tagging whíthin my guest network.

I have several AP with OpenWRT. VLAN1 is normal LAN. VLAN3 is guest network/wifi.
So I added lan0.3 to br-guest_turris:

config interface 'guest_turris'
    option enabled '1'
    option type 'bridge'
    option proto 'static'
    option netmask ''
    option bridge_empty '1'
    option ipaddr ''
    option _turris_mode 'managed'
    option ifname 'lan0.3'

Now I can ping my APs from turris at

root@turris:~# ping -I192.168.60.1 
PING ( from : 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=64 time=0.329 ms

BUT if I ping from AP ( to turris, the AP gets no ICMP response.
Running tcpdump on turris, I got this error:

IP > ICMP echo request, id 2310, seq 7683, length 64
IP > ICMP protocol 1 port 18250 unreachable, length 92

What’s going wrong?

Which is not best practise. According to the available online Linux documentation VLAN tag management on DSA ports should be handled with the bridge v command.
There are also several threads in this forum and the OpenWrt forum on the subject (DSA VLAN).

Is the TO firewall permitting ingress from the Guest zone to the TO?

No, there is no filewall along the vlan3 interfaces.
In the OpenWRT-forum there is a similar problem:

Using bridge vlan will not solve my problem, with lan0 as br-guest_turris interface

bridge vlan add dev lan0 vid 1 pvid tagged
bridge vlan add dev lan0 vid 3 tagged

root@turris:~# bridge vlan show
port    vlan ids
lan0     1 PVID
lan1     1 PVID Egress Untagged
lan2     1 PVID Egress Untagged
lan3     1 PVID Egress Untagged
lan4     1 PVID Egress Untagged
br-guest_turris  1 PVID Egress Untagged
br-lan   1 PVID Egress Untagged

As per Linux documentation

by default, the bridge does not filter on VLAN and only bridges untagged
traffic. To enable VLAN support, turn on VLAN filtering:

echo 1 >/sys/class/net/<bridge>/bridge/vlan_filtering

or alternatively

ip link set dev <bridge> type bridge vlan_filtering 1

Replace <bridge> with the respective bridge device name.

Of course, I enable this kernel setting and this will not work. the br-guest_turris is still in vlan1

Suppose you meantime changed that (and applied) to

option ifname 'lan0' ?

From the package dump it seems strange that ethertype 802.1Q (0x8100) is not displayed (from both ends). Could you try the tcpdump with -e -vvv options?

perhaps try bridge v a dev br-guest_turris vid 3 tagged self (which you tried to ping from the AP is assigned to the bridge netdev but not the lan0 netdev

after fiddling around with this bridge command, I give it up.
Using eth0.3 will work for for guest devices.
Ping isn’t working, but actually I accept this.

with TOS 5.0 it’s rather simple.

assuming your AP is connected to lan0 :

ip link add link lan0 name lan0.3 type vlan id 3
uci set network.guest_turris.ifname 'lan0.3'
uci commit

obviously your AP will have to tag guest traffic for vlan3.
i’m using Unifi AP’s so it might be that your AP’s are just not tagging correctly.

EDIT: alternatively it can be done with the bridge vlan command. but that seems rather convoluted.