luci segregated lans

guest.md

1. Select menu item Network > Switch and click Add button under VLAN ID section
2. For the new VLAN, make sure the CPU is tagged, then select untagged for the LAN port(s) you are want to use this new VLAN. Make sure that port is off for all other VLANs. Click Save & Apply
3. In the Network > Interfaces click Add new interface button (under the interface overview section)
4. Name the new interface (Guest), select the new VLAN (likely something like eth0.3); the rest of the defaults are okay. Click Submit.
5. Set your desired IPv4 address (for the router on this VLAN), net mask, and gateway, and any other stuff here you want. Click Save.
6. Click Setup DHCP Server button. Defaults here are fine, but you can change them if you want. Click Save.
7. Select the Firewall Settings tab for the interface. The radio button will default to the unspecified -or- create box. Name your firewall zone (guest). Click Save & Apply.
8. Network > Firewall > Zones section, edit the new (guest) zone. Check wan in the allow forward to destination zones area of inter-zone forwarding. Click Save & Apply.
9. Select Traffic Rules and go to the Open ports on router section. Name a new rule (allow-DHCP-guest), select UDP, click add. Defaults here are good except that the source zone should be the new zone you created (guest) and the destination port should be 67-68. Click Save & Apply.
10. Add another open port for DNS (TCP+UDP, source zone guest, destination zone device (input). dest port 53), click Save & Apply.

From forum.openwrt.org