diff --git a/package/hostapd/files/wpa_supplicant.sh b/package/hostapd/files/wpa_supplicant.sh
index 6112517f3..1ab6c663e 100644
--- a/package/hostapd/files/wpa_supplicant.sh
+++ b/package/hostapd/files/wpa_supplicant.sh
@@ -23,6 +23,15 @@ wpa_supplicant_setup_vif() {
 		config_set "$vif" bridge "$bridge"
 	}
 
+	local mode ifname wds
+	config_get mode "$vif" mode
+	config_get ifname "$vif" ifname
+	config_get_bool wds "$vif" wds 0
+	[ -z "$bridge" ] || [ "$mode" = ap ] || [ "$mode" = sta -a $wds -eq 1 ] || {
+		echo "wpa_supplicant_setup_vif($ifname): Refusing to bridge $mode mode interface"
+		return 1
+	}
+
 	case "$enc" in
 		*none*)
 			key_mgmt='NONE'