diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index 462093c..c652e63 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -13,7 +13,22 @@
       { lib, config, ... }:
       {
         options = {
+          wan = {
+            interface = lib.mkOption {
+              type = lib.types.str;
+              description = "Physical WAN port the PPPoE session runs on.";
+            };
 
+            vlanId = lib.mkOption {
+              type = lib.types.nullOr (lib.types.ints.between 1 4094);
+              default = null;
+              description = ''
+                802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
+                null for untagged PPPoE directly on the port. Unrelated to the LAN
+                VLANs — this tag exists only on the WAN port.
+              '';
+            };
+          };
         };
       };