diff --git a/devices/gl-ar750/default.nix b/devices/gl-ar750/default.nix
index 298b205..c15f642 100644
--- a/devices/gl-ar750/default.nix
+++ b/devices/gl-ar750/default.nix
@@ -38,7 +38,7 @@
     supported by the ath10k driver.
   '';
 
-  module = {pkgs, ... }:
+  module = {pkgs, config, ... }:
     let
       openwrt = pkgs.pkgsBuildBuild.fetchFromGitHub {
         name = "openwrt-source";
@@ -64,6 +64,10 @@
           cp $blobdir/board.bin  $out/ath10k/QCA9887/hw1.0/
         '';
       };
+      mac80211 = pkgs.mac80211.override {
+        drivers = ["ath9k" "ath10k_pci"];
+        klibBuild = config.outputs.kernel.modulesupport;
+      };
       ath10k_cal_data =
         let
           offset = 1024 * 20; # 0x5000
@@ -81,12 +85,25 @@
         down = "true";
       };
       inherit (pkgs.pseudofile) dir symlink;
+      inherit (pkgs.liminix.networking) interface;
     in {
       device = {
         defaultOutput = "tftproot";
         loadAddress = "0x80060000";
         entryPoint  = "0x80060000";
-        radios = ["ath9k" "ath10k_pci"];
+        networkInterfaces = {
+          lan = interface { device = "eth0"; };
+          wan = interface { device = "eth1"; };
+
+          wlan_24 = interface {
+            device = "wlan0";
+            dependencies = [ mac80211 ];
+          };
+          wlan_5 = interface {
+            device = "wlan1";
+            dependencies = [ mac80211 ath10k_cal_data ];
+          };
+        };
       };
       filesystem = dir {
         lib = dir {
diff --git a/devices/qemu/default.nix b/devices/qemu/default.nix
index ab54e31..5c5cc73 100644
--- a/devices/qemu/default.nix
+++ b/devices/qemu/default.nix
@@ -1,7 +1,6 @@
 # This "device" generates images that can be used with the QEMU
 # emulator. The default output is a directory containing separate
 # kernel (uncompressed vmlinux) and initrd (squashfs) images
-
 {
   system = {
     crossSystem = {
@@ -13,7 +12,7 @@
     };
   };
 
-  module = {pkgs, ... }: {
+  module = {pkgs, config, ... }: {
     kernel = {
       src = pkgs.pkgsBuildBuild.fetchurl {
         name = "linux.tar.gz";
@@ -41,9 +40,25 @@
         SERIAL_8250_CONSOLE= "y";
       };
     };
-    device = {
-      defaultOutput = "vmroot";
-      radios = ["mac80211_hwsim"];
-    };
+    device =
+      let
+        mac80211 =  pkgs.mac80211.override {
+          drivers = ["mac80211_hwsim"];
+          klibBuild = config.outputs.kernel.modulesupport;
+        };
+        inherit (pkgs.liminix.networking) interface;
+      in {
+        defaultOutput = "vmroot";
+        networkInterfaces = {
+          lan = interface { device = "eth0"; };
+          wan = interface { device = "eth1"; };
+
+          wlan_24 = interface {
+            device = "wlan0";
+            dependencies = [ mac80211 ];
+          };
+        };
+      };
+
   };
 }
diff --git a/modules/base.nix b/modules/base.nix
index ad221ab..a142b88 100644
--- a/modules/base.nix
+++ b/modules/base.nix
@@ -75,6 +75,9 @@ in {
         default = [];
         example = ["ath9k" "ath10k"];
       };
+      networkInterfaces = mkOption {
+        type = types.attrsOf types.anything;
+      };
     };
   };
   config = {
diff --git a/modules/wlan.nix b/modules/wlan.nix
index 8fcd3a8..c92ec02 100644
--- a/modules/wlan.nix
+++ b/modules/wlan.nix
@@ -3,15 +3,8 @@ let
   inherit (lib) mkEnableOption mkOption types isDerivation hasAttr ;
   inherit (pkgs.pseudofile) dir symlink;
   inherit (pkgs) busybox;
-  mac80211 = pkgs.mac80211.override {
-    drivers = config.device.radios;
-    klibBuild = config.outputs.kernel.modulesupport;
-  };
-
 in {
   config = {
-    services.wlan_module = mac80211;
-
     kernel = rec {
       config = {
         # Most of this is necessary infra to allow wireless stack/
diff --git a/pkgs/liminix-tools/networking/default.nix b/pkgs/liminix-tools/networking/default.nix
index d0444ca..0423173 100644
--- a/pkgs/liminix-tools/networking/default.nix
+++ b/pkgs/liminix-tools/networking/default.nix
@@ -8,7 +8,7 @@ let
   inherit (liminix.services) oneshot longrun;
   inherit (lib) concatStringsSep optional;
 in {
-  interface = { type, device, primary ? null, dependencies ? [] }  @ args:
+  interface = { type ? "hardware", device, primary ? null, dependencies ? [] }  @ args:
     let ups =
           []
           ++ optional (type == "bridge")
@@ -25,10 +25,10 @@ in {
     } // {
       inherit device;
     };
-  address = interface: { family, prefixLength, address } @ args:
+  address = interface: { family, dependencies ? [], prefixLength, address } @ args:
     let inherit (builtins) toString;
     in oneshot {
-      dependencies = [ interface ];
+      dependencies = [ interface ] ++ dependencies;
       name = "${interface.device}.addr.${address}";
       up = "ip address add ${address}/${toString prefixLength} dev ${interface.device} ";
       down = "ip address del ${address}/${toString prefixLength} dev ${interface.device} ";
diff --git a/rotuer.nix b/rotuer.nix
index bb85897..9ed0266 100644
--- a/rotuer.nix
+++ b/rotuer.nix
@@ -11,7 +11,7 @@ let
   secrets = import ./rotuer-secrets.nix;
   inherit (pkgs.liminix.networking)
     address
-    bridge
+#    bridge
     dnsmasq
     hostapd
     interface
@@ -83,28 +83,7 @@ in rec {
     };
   };
 
-  services.lan =
-    let iface = interface {
-          type = "bridge";
-          device = "lan";
-        };
-    in address iface {
-      family = "inet4"; address ="10.8.0.1"; prefixLength = 16;
-    };
-
-  services.wireless = interface {
-    type = "hardware";
-    device = "wlan0";
-    dependencies = [ config.services.wlan_module ];
-  };
-
-  services.wired = interface {
-    type = "hardware";
-    device = "eth0";
-    primary = services.lan;
-  };
-
-  services.hostap = hostapd (services.wireless) {
+  services.hostap = hostapd (config.device.networkInterfaces.wlan_24) {
     params = {
       ssid = "liminix";
       country_code = "GB";
@@ -121,14 +100,52 @@ in rec {
     };
   };
 
-  services.bridgewlan =
-    let dev = services.wireless.device;
-    in oneshot {
-      name = "add-wlan2-to-bridge";
-      up = "${ifwait}/bin/ifwait -v ${dev} running && ip link set dev ${dev} master ${services.lan.device}";
-      down = "ip link set dev ${dev} nomaster";
-      dependencies = [ services.wireless ];
+  services.hostap5 = hostapd (config.device.networkInterfaces.wlan_5) {
+    params = rec {
+      ssid = "liminix_5";
+      country_code = "GB";
+      hw_mode="a";
+      channel = 36;
+      ht_capab = "[HT40+]";
+      vht_oper_chwidth = 1;
+      vht_oper_centr_freq_seg0_idx = channel + 6;
+      ieee80211ac = 1;
+
+      wmm_enabled = 1;
+      inherit (secrets) wpa_passphrase;
+      auth_algs = 1; # 1=wpa2, 2=wep, 3=both
+      wpa = 2;       # 1=wpa, 2=wpa2, 3=both
+      wpa_key_mgmt = "WPA-PSK";
+      wpa_pairwise = "TKIP CCMP";   # auth for wpa (may not need this?)
+      rsn_pairwise = "CCMP";        # auth for wpa2
     };
+  };
+
+  services.int =
+    let iface = interface {
+          type = "bridge";
+          device = "int";
+        };
+    in address iface {
+      family = "inet4"; address ="10.8.0.1"; prefixLength = 16;
+    };
+
+  services.bridge =
+    let
+      primary = services.int;
+      addif = dev: oneshot {
+        name = "add-${dev.device}-to-bridge";
+        up = "${ifwait}/bin/ifwait -v ${dev.device} running && ip link set dev ${dev.device} master ${primary.device}";
+        down = "ip link set dev ${dev} nomaster";
+        dependencies = [ primary dev ];
+      };
+    in bundle {
+      name = "bridge-members";
+      contents = map addif [
+        config.device.networkInterfaces.wlan_24
+        config.device.networkInterfaces.lan
+        config.device.networkInterfaces.wlan_5
+      ];
     };
 
   users.dnsmasq = {
@@ -144,13 +161,13 @@ in rec {
   services.dns =
     dnsmasq {
       resolvconf = services.resolvconf;
-      interface = services.lan;
+      interface = services.int;
       ranges = ["10.8.0.10,10.8.0.240"];
       domain = "fake.liminix.org";
     };
 
   services.wan =
-    let iface = interface { type = "hardware"; device = "eth1"; };
+    let iface = config.device.networkInterfaces.wan;
     in pppoe iface {
       ppp-options = [
         "debug" "+ipv6" "noauth"
@@ -196,14 +213,14 @@ in rec {
     name = "default";
     contents = with services; [
       loopback
-      wired
-      wireless
-      lan
+      config.device.networkInterfaces.lan
+      int
+      bridge
       hostap
+      hostap5
       defaultroute4
       packet_forwarding
       dns
-      bridgewlan
       resolvconf
     ];
   };
diff --git a/tests/wlan/configuration.nix b/tests/wlan/configuration.nix
index 2a49785..36f8462 100644
--- a/tests/wlan/configuration.nix
+++ b/tests/wlan/configuration.nix
@@ -15,8 +15,7 @@ in rec {
 
   imports = [ ../../modules/wlan.nix ];
 
-
-  services.wlan = interface { type = "hardware"; device = "wlan0"; };
+  services.wlan = config.device.networkInterfaces.wlan_24;
 
   services.hostap = hostapd (services.wlan) {
     params = {
@@ -40,7 +39,6 @@ in rec {
     contents = with config.services; [
       loopback
       hostap
-      wlan_module
     ];
   };
   defaultProfile.packages = with pkgs;  [ tcpdump ] ;