MT7530: Bridge VLAN filtering fails to process untagged ingress traffic on PVID port (post port-disable fix)

[ricardomfmsousa]

Describe the bug

Platform:

• Device: any device with MT7530-like switch (not the OpenWrt One which doesn't have such switch)
• SoC: MediaTek MT7981 (Filogic 820)
• Tested OpenWrt Versions:
  • 24.10.0 - r28427-6df0e3d02a (Port eth1 entered disabled state)
  • 24.10.1 - r28597-0425664679 (Port eth1 stays UP, but traffic fails)

Description:

When configuring bridge VLAN filtering on br-lan with the built-in LAN port (eth1) set as an untagged member of a specific VLAN (e.g., VLAN 10) using PVID, communication with the router via that port fails.

• On older snapshot 24.10.0-r28427, enabling this configuration caused the kernel to put eth1 into a disabled state (see log snippet below).
• On newer snapshot 24.10.1-r28597, the port eth1 remains UP and LOWER_UP, but untagged ingress traffic (e.g., ARP requests from a client) arriving on eth1 is not delivered to the corresponding logical VLAN interface (br-lan.10). This prevents ARP resolution and any communication with the router's IP on that VLAN interface.
• Disabling option vlan_filtering '1' on br-lan and attaching the lan interface directly to br-lan works correctly, allowing communication.

OpenWrt version

r28597-0425664679

OpenWrt release

24.10.1

OpenWrt target/subtarget

mediatek/filogic

Device

? (original author claimed "OpenWrt One", but that was just to get our attention -- the OpenWrt One doesn't have an MT7530 switch)

Image kind

Official downloaded image

Steps to reproduce

1. Factory reset OpenWrt One running a recent snapshot (e.g., 24.10.1).

2. Configure /etc/config/network similar to the following relevant sections:

   config device 'br_lan'
       option type 'bridge'
       option name 'br-lan'
       list ports 'eth1'
       option vlan_filtering '1'
       # Add CPU tags
       list vlan_config 'vid=10 local=1'
       # ... other CPU tags if needed ...
       # Configure eth1 as untagged access port for VLAN 10
       list vlan_config 'vid=10 port=eth1 pvid=1 untagged=1'
   
   config interface 'lan'
       option device 'br-lan.10' # Use VLAN interface
       option proto 'static'
       option ipaddr '192.168.10.1'
       option netmask '255.255.255.0'
       # ... other lan options ...
   

3. Reload network: service network reload

4. Connect a client computer directly to eth1.

5. Configure a static IP on the client (e.g., 192.168.10.10/24, gateway 192.168.10.1).

6. Attempt to ping the router: ping 192.168.10.1

Actual behaviour

• Ping fails (Destination Host Unreachable or timeout).
• tcpdump -i eth1 -n arp shows ARP requests arriving from the client.
• tcpdump -i br-lan.10 -n arp shows no ARP requests arriving on the VLAN interface.
• ip neigh show dev br-lan.10 shows no entries for the client.
• (Secondary Issue) The command ip bridge vlan show fails with "Object 'bridge' is unknown".

Expected behaviour

• Ping should succeed.
• ARP requests seen on eth1 should also be seen on br-lan.10.
• ip neigh show dev br-lan.10 should show the client's entry after successful ARP.
• ip bridge vlan show should ideally display the bridge VLAN configuration.

Additional info

Diagnostic Log Snippet (from older firmware r28427 showing port disable):
kern.info kernel: [ 20.843392] br-lan: port 1(eth1) entered blocking state kern.info kernel: [ 20.848629] br-lan: port 1(eth1) entered disabled state

This appears to be a regression or remaining driver issue specifically related to handling untagged ingress traffic on PVID ports when bridge VLAN filtering is enabled on the MT7981 SoC.

Diffconfig

Terms

• I am reporting an issue for OpenWrt, not an unsupported fork.

[ricardomfmsousa]

The following issues are closely-related but on different hardware:

• Bridge master interface not reachable after enabling VLAN filtering on Banana R3 #14195 – Banana Pi R3 (Filogic 830) “Bridge master interface not reachable after enabling VLAN filtering”
• bridge interface no longer working after latest build r28601-9e9f6875bc #18536 – Linksys EA8300 (IPQ40xx) “bridge interface no longer working after latest build”

[gwaitsi]

i have the same problem with a comfast e395.
you can bridge the lan / wan (eth1) /wifi in untagged and all clients receive their IP from an upstream dhcp server.
if you try to apply vlan to the wifi and lan ports, eth1 loses it's ip.
when i upgraded from 23.05.06 via attended-sysupgrade, i lose connectivity to the box and checked by serial to confirm the above. I am unable to revery back to my working config. even after downgrading to an earlier version of openwrt

[dioni21]

I think I'm having the SAME problem on a qemu VM (over proxmox).

Trying to "downgrade" from SNAPSHOT to 25.12rc or even upgrade to next SNAPSHOT.

[kwilkins9]

---

Confirming this issue on OpenWRT One (MT7981)

Hardware:

• OpenWRT One router (BananaPi Cobalt-One)
• MediaTek MT7981B SoC
• Connected to RealHD SW8-25G-MGV2 managed switch via eth0 (2.5G trunk port)

Software:

• OpenWRT version: [check your version in System → Software]
• Date tested: February 2026

Symptoms:
With vlan_filtering='1' enabled on br-lan and bridge-vlan entries configured for
VLANs 1, 10, 20, 30, 40:

• Router cannot communicate with any device on the network
• ARP resolution fails (all MAC addresses show 00:00:00:00:00:00)
• ping to any IP on any VLAN results in 100% packet loss
• Physical link is up at 2.5Gbps, switch shows packets received from router but
  sends 0 packets back
• Removing all bridge-vlan entries while keeping vlan_filtering='1' also fails
  (all traffic dropped)

Workaround:
Setting vlan_filtering='0' immediately restores full connectivity. All VLANs work
correctly using Linux VLAN interfaces (br-lan.10, br-lan.20, etc.) without bridge
VLAN filtering.

Impact:
Unable to use bridge VLAN filtering for WiFi interface segmentation. Wired VLAN
segmentation works via switch, but WiFi devices cannot be properly isolated into
separate VLANs.

Looking forward to a fix for this issue. Happy to provide additional logs or
testing if needed.