I'm not sure of the best way to solve this problem, although several solutions (including some really simple "don't worry about it" solutions) probably exist.
My LAN has totally segregated WiFi and wired subnets, on different NICs. (Say, WiFi=10.10.0.0/16, wired=10.20.0.0/16). Firewall rules on the router prevent all traffic arriving at the wifi interface, from passing to the LAN or to any of the router IP's themselves - so WiFi clients can reach the WAN and nothing else.
But the WiFi subnet also includes a single IP for the AP's management systems (webui, ssh). I want to totally segregate this from the less trusted WiFi side, by putting WiFi client traffic in say VLAN 6, and traffic to/from the management IP in VLAN7. And I want VLAN7 reachable from the LAN (ideally, reachable via a LAN IP that's similar to LAN switches and infrastructure services, as seen from the LAN), and not reachable from VLAN6.
I'm using either of pfsense or its close fork, opnsense, they have almost identical capabilities in these areas.
I can imagine I'd set up the VLANs, define a virtual IP on the LAN, and bridge the virtual IP to the WiFi management IP using 1:1 NAT on one or the other interfaces. And then I'd add filter rules on the VLAN interfaces, to ensure only packets from LAN to AP management IP is allowed into VLAN 7. (That last part I'm happy with, no help needed)
But I'm very unclear about the VLAN/NAT specifics at the router. How would I actually do it? (As in, the actual steps)
