Cheap VLAN Routing

AD7UF, Sep 2025

The traditional way to connect multiple AREDN radios together and connect them to other devices to provide services or access to the mesh network is to use a MikroTik hAP or similar router running the AREDN firmware. Usually there's not a need to run services directly on the router itself (they can be run on one of the other radios that has enough RAM) and the hAP is a fairly expensive way to provide the same services that an VLAN-enabled managed switch can, especially now that the hAP Lite is deprecated for AREDN.

Let's talk a little more about this switch. 

• First off, yes it's a cheap Chinese switch, so it has a few quirks and lacks features of a more expensive switch -- but at $10 each you can buy more than one if you need more complex VLAN handling than it will do.

• Don't let the "cloud managed" bit scare you; while it can do the whole "manage via a smartphone app over the Internet" thing and I'd never trust it 100% not to "phone home" or do other goofy things, but:

  • The current firmware is set to a sane default of conventional management via a web browser on the LAN, and

  • I've never see any misbehavior (aside from overly-exuberant "Hey, I'm at this IP address" replies to ARP inquiries for other devices) in many hours of operation and packet traces.

  • On my own networks, I also set firewall rules prohibiting Internet access from the switch as well as  unknown devices, so unless it spoofs something that's attached to it, it's not getting out.  Call me paranoid. Professionally, I manage a lot of sensitive data for large companies; I'm paid to be paranoid.

• Power supply: Very flexible. It comes with  12V wall wart, but it will run on anything 9-55VDC through the barrel connector. It also accepts standard 48V 802.3af PoE. (Do not try to feed it Ubiquity-style passive POE; if you want to give it 24V, split it out and send it to the barrel connector.

The UI used to set those takes a little getting used to, and the version I've used has display bugs. If you made a change and it did funny things, refresh the page and see if the table redraws correctly. Actually, it's not a bad idea to refresh it after any changes before you leave.

More on trunking / traffic management:

Note that it's not possible to selectively trunk or translate from one VLAN to another (though you could loop one switch port to another for the latter); a trunk always carries all VLANs.

In this example, I'm feeding all traffic into into the home network. This may not be ideal for these reasons:

• It puts unneeded AREDN broadcast traffic on the LAN

• Some devices may respond to tagged traffic when they shouldn't (rare)

• You may want to prevent potential access to AREDN 

The solution to this is to tag all traffic from the AREDN network. In the house,  a 2nd VLAN-enabled switch receives the trunk from the outdoor AREDN station and uses "access" ports to un-tag and pass the normal LAN (AREDN WAN) traffic. Optionally, one or more trunk ports or access ports for other VLANs can provide AREDN LAN or DtD connections.