Dumb-ish AP with VLANs - Xiaomi Mini

I have configured my main router with
VLAN1 for trusted devices and my lan/wlan
VLAN3 for guests and other untrusted devices

so I want the 'blue port' to carry both traffic for VLAN1 and VLAN3,
but the 'white ports' are for trusted devices (lan/VLAN1)

so add a new VLAN, tag CPU and WAN ports in both VLANs.
(! note: depending on how you are connected this has the potential to lock you out so make sure you have a VLAN1/3 port on your 'other' router, or wifi access setup, before you hit apply.)

since we've kept the lan interface (from the dumb AP config) you can setup wifi APs for LAN and connect them to the lan interface.

for the Guest wifi just create it as usual but don't assign a network.
then need to create our guest interface: Network->Interfaces, add new interface
since we won't be 'doing' anything ourselves on this network I set the interface type to unmanaged.



then Physical settings: check Bridge interfaces, and  select the VLAN and your guest wifi.


and we're done!