No problem! Have fun with your VLANs and WAP. It’s the most stable Wi-Fi I’ve ever owned. I used to have to reboot my ISP Wi-Fi router once a month or so because it would just stop serving Wi-Fi for no reason. I’ve never had to reboot my ubiquiti gear ever for that reason, and it’s been years.
Let us know what you pick for a router when you get there.
I’m the same way, I don’t do any of the cloud stuff. I run the MGMT software in a docker container, and when it asks to hook up the cloud, I just skip it. It means I have to back up the config by hand, but I’m ok with that. I also turn the auto update off in the config. I am pretty sure the updating needs the MGMT software to be running all the time anyway, but I don’t keep that going, I just shut it down when I’m done configuring things. I don’t use any of their routers, maybe those need cloud stuff?
You know what? Just try downloading their management software right now, it’s free, and see if you can get into the config portion without signing up for their cloud stuff. I’d try it with the latest version of their software myself (I haven’t updated in a while), but I’m not near my gear right now.
Not stupid questions at all.
can I do this all with a single switch?
You could technically do all of this on a cheap WiFi router running dd-wrt firmware. VLANs on ports, multiple WiFi SSIDs, the whole thing. I have. But it is all hacky finicky configuration that is annoying to do, and I will never do it that way again. There is something to be said for owning and using products that “just work”, especially if you have a family that relies on your network and network services being stable.
To answer your question directly, you can do everything VLAN related except the WiFi portion on one wired switch, but you are going to need a router to do anything meaningful with those VLANs.
Do I need a separate access points for each VLAN or can I have multiple vLANs on a single AP?
One AP can serve multiple SSIDs, and can map them each to a particular VLAN. The ability to do this depends on the Access Point.
How many ports should I be looking at on my switch? Would four be enough for my set-up?
Definitely definitely definitely get more than you think you need. You are already doing cool stuff, and will likely add more of it over time as you gather more ideas and experiments. I wouldn’t do less than 10 ports in your case. Nothing is more annoying than running out of ports capable of VLANing and having to upgrade the gear and redo the configuration on a new device. Your time has value, and IMO it is more expensive than just spending a few more bucks on the right gear that is nice to configure and just works.
Also managed is best right?
Absolutely yes. The term managed is going to have different meanings depending on the age of the gear and the “level” of the gear though. An old Cisco switch would be the traditional definition of managed. New ubiquiti gear with its software defined networking would be managed also. Hacking around with the config on a dd-wrt router would be considered “managed” too, in my book. You can’t really achieve VLANs without some way to configure them, and management is that configuration method, when you boil it down.
There is more stuff you need to think about, like how to route between your VLANs, and the filtering you will want to apply to that routing for security reasons. You are going to need a router, and picking one that is right for you is probably going to be the trickiest thing, because you seem like the type that isn’t going to be afraid to do more complex things over time, while also keeping budget in mind.
I’ll cut to the chase. I have the network you are trying to do, and I’ll tell you the gear I’ve settled on, for your reference. I recommend it, but of course I am biased, so really just use this as a reference and make your own decision. I’ve had all kinds of gear over 2 decades, and built and worked on enterprise networks of all kinds, and this is what I’ve settled on for me as good enough for the kind of stuff you and I are into.
I have a 10 port ubiquiti gigabit managed switch with a handful of PoE ports. It’s got PoE to power a (now lightly outdated) ubiquiti WAP. The WAP and switch are configured by a piece of software from ubiquiti I run on a computer (it can run on a pi, do monitoring and all kinds of cool stuff, but I don’t bother because I just use it occasionally to change config here and there). The software lets me config VLANs on the switch and WAP, which also lets me plop WiFi SSIDs on those VLANs. I have multiple separate WiFi SSIDs served from the single WAP; one for guests, another one for home automation and WiFi cameras, another for everything else.
My router is a pfSense that I built from gear from pcEngines, because the official pfSense gear is 3 times the price, and the affordable hardware of theirs is not the most reliable. I chose pfSense because it is a good balance between cheap, and does almost any networking thing possible while being easy enough to achieve it. Updates are also free, which is a big deal. You could pay through the nose to get the simplicity of a ubiquity router, and it still not be able to do everything you want to do that you could with a pfSense. That said, the ubiquity does a lot with ease, you just pay a premium for that convenience. If you like to learn and tinker, I recommend pfSense, because it’s easy enough to mostly point and click, but it doesn’t stop you from making something really intricate just the way you want, if you like. It’s a BSD box under the hood, after all.
Anyway, long story short, my router lets me reach my WiFi cameras and home automation gear that are on their own isolation VLANs from my main VLAN, but those cameras and stuff can’t reach back into my main VLAN nor reach the Internet because of the filtering rules I’ve defined on the router.
You will probably have more questions now. Never fear though, this stuff is doable.
Nice. I dunno if I’d do ARM again for me personally, I always found the throughput lacking, but I suppose there’s newer faster stuff now, and it’s hard to complain about the low power consumption.
If you have any old x86 gear laying around, or even the means to make a VM, consider installing and playing around with pfSense or opnSense. I suppose your goal may be to get into the OpenWrt ecosystem and tinker in there, which I totally get.
For me, I’ve taken to shying away from an “everything device” that can be a router and NAS and server and whatever else device (not to say that’s your intent with OpenWrt), and instead choosing something that is focused on the networking. Do one job and do it well, kinda thing. For instance my spouse would be mad if a video call with friends was jittery because the router was busy transcoding video from its media server to play a show on the TV. Also if the device gives up the ghost years down the line, you don’t have to find some unicorn hardware in a hurry that can do 5 different things; you can just get a router and drop it in. Food for thought.