keenetic-segments

Creating a segment the router will admit exists

The trap

The obvious way to build an isolated network is a bridge with an address, NAT, and a Wi-Fi network bound to it:

interface Bridge2
interface Bridge2 ip address 192.168.3.1 255.255.255.0
interface Bridge2 up
ip nat Bridge2

This works. Clients associate, get addresses, reach the internet, and stay off the home network. It is also invisible: nothing appears under /access-points, nothing appears in the segment list, and the user cannot manage from the web interface the thing they just asked you to create.

Reported as "it works but I can't see it", which is a much harder bug to find after the fact than before.

What the web interface means by a segment

A segment is VLAN-backed. The bridge is only half of it. Three things are missing from the sequence above:

1. a VLAN subinterface, GigabitEthernet0/VlanN
2. that VLAN trunked over every port of the switch
3. the subinterface bridged into the segment

Do those and the router fills in the rest itself. iseg - the block the web interface reads - is computed, not written:

"iseg": { "vlan": "2", "port": "1,2,3,4,5", "vlan-port": "1,2,3,4,5",
          "free-port": "", "busy-vlan": "1" }

You never set those fields. If they are empty, the VLAN is missing.

Use the tool

create_segment does all of it, picks free identifiers, verifies the result against iseg, and rolls the whole thing back if any step fails:

create_segment { "name": "iot", "ssid": "…", "psk": "…" }
create_segment { "name": "vpn", "permit_interfaces": ["Wireguard1"] }
create_segment { "name": "wired-lab", "subnet": 40 }

list_segments shows what exists and, per bridge, whether uiVisible is true. Run it first: a bridge that is already there but not visible has the same missing VLAN, and is worth mentioning to the user.

Everything below is for doing it by hand through rci_call, which is worth reading anyway, because it is what the tool is doing.