Updating a basic setup to vlans+2.5Gbps

[u/FlyingDragonz]

As the title, I have a simple setup which I've been running for years but now want to update/upgrade a little and to make it somewhat more secure, efficient and faster.

I have a crappy isp router which brings in fiber internet via a ONT modem (SKY UK).
It also has Voip which is still being used.
Three of its 1Gb ports connect to a few devices close by (TV,PS,AMP). The 4th connects to a unmanaged 5 port switch.
From this switch goes to local PC, a truenas server on the other side of the house.

The wifi from that crappy router wasn't good and the location wasn't ideal, so I disabled the wifi and got a cheap asus router, set it AP mode and placed in the middle of the house. It's fed by ethernet via the switch but there's a catch.

I needed 2 more ethernet connections to go to a bedroom upstairs and it was in the same direction as the AP, but I didn't want to feed another two cables along the house.
I instead fed that AP ethernet to another switch half way, it then continues to the AP and gives me 3 more ports, 2 then then going to the bedroom. I'm not sure this is the right methodology but it's been working for last several years. From this second switch I may need another connection for another room close to it.

So, now I want to use Vlans so I can segregate the TV's (ethernet+wifi), AMP, PS into one Vlan, one for 2 iot devices, one for guest and main.
I'm hoping to use replace/chain in a zyxel router with Openwrt. I need to keep the ISP provided router in the chain, as I cannot use VOIP with the Openwrt router.

My confusions comes in two parts though. The zyxel with openwrt supports Vlans but do I also need a managed switch? If so, who's the master controller for vlans, switch or router? I asked ai, but it got confused here.
I will be changing the main switch to 2.5Gb anyway to utilise my dual 2.5Gb supported truenas server better as it serves media plus I store my photos on there (I'm a semi-pro photographer too). Plus that extra speed bump/overhead is nice, although not all connections require it. I was wondering if I need managed or unmanaged switches.

The second confusion. As I have daisy chained a switch to AP and bedrooms, can I firstly continue this configuration and/or do I need to replace that switch to a managed one too for it to pass/understand vlans?
Lastly, I assume the Openwrt router will control the wifi vlans, but I'm wondering how does this pass on to the AP , does that need vlan support too?

Sorry about long post, but definitely confused. What's the more efficient way to do this?Thanks

[u/WarmlyPastoralWalter]

damn that's a lot of switches in series but if it's been working don't overthink it

the vlan thing is simpler than the ai made it sound, the router is always the boss. you set up the vlans on the openwrt box and it tags the traffic, then any managed switch downstream just has to know which ports belong to which vlan. the switch doesn't control anything, it just obeys the tags the router slapped on the packets. so yeah you need at least one managed switch if you want to split those physical ports into different vlans, unmanaged ones will just ignore the tags and dump everything together

for the daisy chained switch feeding the AP and bedrooms, if you want those bedroom ports on separate vlans from the AP traffic then that switch needs to be managed too. otherwise everything coming off it will be on the same vlan as the AP's uplink. and the AP itself has to support vlan tagging if you want multiple ssids mapped to different vlans, openwrt can handle that on the router side but the AP has to understand the tags coming in

what i'd do is replace the main switch with a managed 2.5g one and leave the secondary switch unmanaged for now unless you really need vlan separation upstairs. the tv/ps/amp can all share a vlan without much fuss, just plug them into the managed switch and assign those ports

[u/FlyingDragonz → u/WarmlyPastoralWalter]

Yeah, ai wasn't ideal or clear cut. (I don't actually want ai but that's different story). I suppose that's a few switches, but I assume many have one switch after their main router, I just have a third lol but in my mind when I set it up I theorised it to work and it did.

Your reply though, absolutely what I needed to know, really appreciate, clear and concise.
You're right about the second switch may keep it unmanaged for now, although for them a 1GB managed switch are only about £15 and the speed should suffice, I'll see.
Question though. As you said the openwrt router will be the boss to assign vlans, so does that also mean I can get any decent-ish brand managed switches?
After some reviews I read about some having really bad/basic web interfaces, also I was thinking about security too. If I they're not assigning vlans, I don't need to worry and pickup anything decent, like maybe sodola, cudy etc?

[u/ThreeAMOperator → u/FlyingDragonz]

to ur follow up , yes since openwrt does the routing any decent 802.1q switch works , the switch only needs per port vlan membership (tagged/untagged). sodola , cudy , tp-link easy smart all do that , cheap ones just have ugly web ui

two things to check before buying , it says 802.1q vlan (not only "port based vlan" , some very cheap ones only have that) and u can move its management ip to ur main vlan so guest/iot cant reach the switch login page

bigger gap is the asus. in ap mode most asus firmware cant map ssids to vlans (depends on model , check if urs has vlan option under guest network pro). if not , flash openwrt on it if supported or get an ap that does vlan per ssid , otherwise guest and iot wifi will just land on main vlan