Manual VLAN Manager

LAN VLAN Manager

Location: Connection → VLAN

The LAN VLAN Manager lets you split your LAN into multiple isolated networks — for example a Guest VLAN, an IoT VLAN, and a trusted "Default LAN" — each with its own subnet, its own DHCP range, and fine-grained control over which VLANs are allowed to talk to each other. This is one of the larger networking features added on top of upstream Gargoyle, and it's only available on DSA-based hardware (see the Hardware VLAN Model note below).

Every save on this page uses Gargoyle's safe-apply mechanism. Because a VLAN mistake can lock you out of the router (for example, reassigning the port your management PC is plugged into to a VLAN with no route back to it), every save gives you 60 seconds to confirm the change actually worked before it's automatically reverted. If your browser doesn't come back with a "Keep these settings?" prompt within a minute, don't panic — the router will undo the change on its own.

Hardware VLAN Model

The top of the page shows which switch architecture your router uses:

• DSA (Distributed Switch Architecture) — the modern OpenWrt switch driver. The full VLAN Manager described below is available.
• swconfig (legacy switch) — an older switch driver used by some older devices. If your router reports this, the page shows a notice: "VLAN management is only supported on DSA-based hardware. This device uses the older swconfig switch driver, which this feature does not manage." You won't be able to use this feature — check whether an updated build for your device has moved to DSA.
• No hardware switch detected — single-port devices with no internal switch.

1. VLANs (defining your networks)

This table lists every VLAN you've created. To add a new one, fill in:

Field	Meaning
VLAN ID	A number from 2–4094. VLAN ID 1 is reserved — it's always the "Default LAN", the network that exists on the router already.
Name	A friendly label (e.g. "Guest", "IoT", "Cameras") shown throughout the rest of the page instead of a bare number.
Subnet	The VLAN's network in CIDR form, e.g. 192.168.20.0/24. The router takes the first usable address as its own IP on that VLAN.
DHCP	Checked by default — the router runs a DHCP server on this VLAN so devices get an address automatically. Uncheck it if you'll assign addresses another way.

Validation catches the mistakes you'd expect: VLAN ID 1 or an out-of-range/duplicate ID is rejected, and a subnet must be between a /8 and a /30 (small enough to be a real network, large enough to fit at least one device) and must not overlap the Default LAN or another VLAN you've already defined.

2. Port Assignment

This is the section most worth reading carefully before you click Save.

Every physical LAN port on the router gets a row here, with two controls:

• Native VLAN — the VLAN that port's untagged traffic belongs to. This is the right choice for a plain device that has no VLAN awareness of its own — a printer, a basic unmanaged switch, a game console. Pick "Default LAN (untagged)" or one of your defined VLANs.
• Tagged VLANs — any number of VLANs that port carries at the same time as tagged traffic, on top of its one native VLAN. Use this for a trunk link — plugging in a managed switch or a VLAN-aware access point (e.g. one running separate SSIDs per VLAN) that needs to see multiple VLANs down a single cable.

Guardrail: the router refuses to save if doing so would leave no port on the Default LAN. Gargoyle won't let you tag every port away from the trusted network at once — that's the one mistake serious enough that even the safe-apply auto-revert might not save you from being locked out before it fires.

3. Inter-VLAN Access

A matrix: rows are the source network, columns are the destination. Check a box to allow traffic from that row's network into that column's network.

• Every VLAN can always reach the internet, regardless of this table — this grid only controls whether VLANs can see each other.
• Leave everything unchecked to keep every VLAN fully isolated from every other VLAN (and from the Default LAN) — the safe default for something like a Guest or IoT network.
• The matrix only appears once you have at least two networks defined (your Default LAN plus one VLAN, or more); with only the Default LAN it shows "Add at least one VLAN to configure access between networks."

4. Exceptions (pinholes)

Sometimes you want almost-total isolation with one narrow hole punched through it — for example, letting devices on the Guest VLAN print to one specific printer on the Default LAN, without opening the whole Default LAN up to guests. That's what this section is for. Each exception is a single allowed path:

Field	Meaning
From	The source network (a VLAN or Default LAN).
Destination IP	The one specific device's address the exception applies to.
Destination Port	Optional — leave blank to allow any port to that device, or specify one (e.g. 9100 for a network printer) to narrow it further.
Protocol	TCP or UDP.
Description	A note to remind you later what this exception is for.

The destination IP must fall inside the Default LAN's subnet or one of your defined VLAN subnets — Gargoyle validates that the address actually belongs to a known network before accepting the rule. Exceptions between the same source and destination network are rejected too (that traffic is already allowed by definition).

Practical example: adding a Guest VLAN

1. In VLANs, add ID 20, name Guest, subnet 192.168.20.0/24, DHCP checked.
2. In Port Assignment, set the port your guest access point plugs into: if the AP itself handles the Guest SSID as an internally-tagged VLAN, add 20 to that port's Tagged VLANs (keep its Native VLAN as Default LAN so the AP's own management traffic stays on your trusted network); if you'd rather dedicate a whole physical port to guests, set that port's Native VLAN to Guest instead.
3. Leave Inter-VLAN Access with no boxes checked for the Guest row — guests get internet access automatically but can't reach your other devices.
4. If guests need to print, add one Exception: From Guest, Destination IP = your printer's address, Destination Port = 9100, Protocol TCP.
5. Click Save Changes, then confirm the "Keep these settings?" prompt once you've verified you can still reach the router.

See also

• WAN Multi-VLAN — the equivalent tagging control for the WAN side (ISP-delivered internet/IPTV/VoIP on separate VLANs), a separate feature from the LAN VLAN Manager on this page.