Main thing to bear in mind when setting up these devices is that conceptually the wifi AP needs to seen as quite separate from the setting up of the switch for the vlans etc. So the creating of the vlans etc is one job, the assigning the various APs to subnets, with bridging, is another.

Having used E1000 APs for some time (100mbit switch, single 2.4ghz G wifi ap), this post develops on that by utilizing gigabit based switches. Linksys/Cisco hardware used for this so far:
E2000 1000mbit switch, single, selectable 2.4ghz or 5.0ghz N wifi ap
WRT610n v2 1000mbit switch (aka E3000), dual 2.4ghz and 5.0ghz N wifi ap

Here’s my set up of: Linksys-Cisco E2000 (and explanatory recap on the command lines settings needed).

When initially flashed with DD WRT (small build tailored to exact model needed before upgrade to a full build needed btw):

telnet IP
from within the subnet to access CLI of the router

root@megstemp:~# nvram show | grep vlan.*ports
vlan2ports=0 8
vlan1ports=4 3 2 1 8*

Explanation:
So, 2 vlans: 1 is for lan – main ports (1-4, numbering reversed). 2 is for wan, port 0. The CPU internal port, 8, must be included on any VLAN that must be visible to the CPU. The asterisk (*) signifies that the VLAN it is attached to is the default VLAN (only put this in one VLAN). If the switch receives a packet on the CPU internal port that is not tagged then it is put into the VLAN where the * is configured; always make sure this is the LAN VLAN.

root@megstemp:~# nvram show | grep port.*vlans | sort
size: 28660 bytes (32780 left)
port0vlans=2
port1vlans=1
port2vlans=1
port3vlans=1
port4vlans=1
port5vlans=1 2 16

Explanation:
The port#vlans variables contain a list of VLAN’s that the port is in. The variables control what the GUI displays. ports 0-5 relate to the 6 port switch which virtually all these router devices contain – 5 physical external ports plus the ‘internal’ port ‘hardwired'(?) on the processor chip.

The port5vlans is a bit odd. It corresponds to the internal port regardless of whether you have 100mbit or gigabit ports. ie. gigabit models do not have a port8vlans variable. It is also essential to set it correctly if you are enabling additional VLAN’s. It must be set to include every active VLAN and be tagged because it tag-trunks everything into the CPU internal port.

The =numbers above mean the following in the GUI:

0 = VLAN 0 is checked
1 = VLAN 1 is checked
…
15 = VLAN 15 is checked
16 = Tagged is checked
17 = Auto-Negotiate is unchecked
18 = 100 Mbit is unchecked or greyed because Auto-Negotiate is checked
19 = Full-Duplex is unchecked or greyed because Auto-Negotiate is checked
20 = Enabled is unchecked.

802.1q VLAN Trunk:
For every VLAN that you want to be trunked you must put the trunk port into the VLAN and add a “t” after the port number to indicate that it will be tagged.

A “t” after a port number means to tag the VLAN ID using 802.1q spec.

Application of above:

The example here will:
1. make the wan port and port1 trunked ports for vlans 1,12,13 (all tagged vlans)
2. make port 2 an untagged port for vlan1
3. make ports 3 and 4 untagged ports for vlan12


nvram set vlan1ports="0t 1t 2 8*"
nvram set vlan12ports="0t 1t 3 4 8"
nvram set vlan13ports="0t 1t 8"
[note: running this set command does not change what shows in the gui!]

nvram set port0vlans="1 12 13 16 18 19"
nvram set port1vlans="1 12 13 16 18 19"
nvram set port2vlans="1 18 19"
nvram set port3vlans="12 18 19"
nvram set port4vlans="12 18 19"
nvram set port5vlans="1 12 13 16"
[use the above set command to update the gui in line with port/vlan settings]

If the additional vlans haven’t already been created ‘declare’ them:
nvram set vlan12hwname=et0
nvram set vlan13hwname=et0

nvram commit
reboot

Setting up the bridging:
For the two vlans 12 and 13 we need the DD WRT AP to keep them in different subnets. The settings in the Setup–> Networking –> Bridging –> Create Bridge seem a bit fiddly. After creating you need to press ‘Apply Settings’ (NOT ‘Save’) using the buttons at the bottom of the gui page. Only by doing this do the IP address and Subnet Mask for the new bridge appear.(?) Add the IP addresses etc.
Next, assign the interfaces to the bridges. eth1 is (I think) the primary wifi IF, this has usually been used with SSID Methodist_inhouse, on the ’12’ vlan/subnet. Bridge this to vlan12. wl0.1 is a virtual IF that is created when adding wireless ‘virtual interfaces’, so wl0.1 is bridged to vlan13.

Other DD WRT General/Various settings:
Security –> Firewall –> Firewall Protection –> SPI ‘Disable’

WAN Connection type: Disabled

Assign WAN port to switch: yes

Advanced Routing –> Operating mode = router. These switches are not internet gateways.

DHCP – I’m unclear whether I’m doing this right. I have set DHCP to ‘forwarder’ on the main settings page, but I get the impression this only relates to vlan1. DHCP for all three vlans is via these routers is coming from the pfsense router so in that sense it works OK. I note in this e2000 there are additional