A method for establishing a wireless local area network tunnel performed by an access point device, the method comprising: • receiving a first configuration message sent by an access controller, wherein the first configuration message comprises a first tunnel establishment configuration parameter, and the first tunnel establishment configuration parameter comprises information about binding between an IP address of at least one broadband access server, BRAS, and at least one service set identifier, SSID, and further includes information about binding between the at least one SSID and at least one virtual local area network identifier, VLAN ID (step 200); • establishing a control tunnel with the access controller (step 201); and • sending a data tunnel establishment request to the at least one BRAS according to the first tunnel establishment configuration parameter (step 203); • receiving a data tunnel establishment response message sent by each of the at least one BRAS; • for each of the received data tunnel establishment response messages, if the data tunnel establishment response message includes a verification success indication information indicating that the BRAS successfully verified the access point, establishing a corresponding data tunnel according to the first tunnel establishment configuration parameter with the BRAS, • adding a corresponding VLAN ID for user data according to an SSID selected by a user and the information about binding between the at least one SSID and the at least one VLAN ID; and sending, according to the information about binding between the IP address of the at least one BRAS and the at least one SSID, the user data to a corresponding BRAS by using the data tunnel between the access point and the corresponding BRAS. • receiving a first configuration message sent by an access controller, wherein the first configuration message comprises a first tunnel establishment configuration parameter, and the first tunnel establishment configuration parameter comprises information about binding between an IP address of at least one broadband access server, BRAS, and at least one service set identifier, SSID, and further includes information about binding between the at least one SSID and at least one virtual local area network identifier, VLAN ID (step 200); • establishing a control tunnel with the access controller (step 201); and • sending a data tunnel establishment request to the at least one BRAS according to the first tunnel establishment configuration parameter (step 203); • receiving a data tunnel establishment response message sent by each of the at least one BRAS; • for each of the received data tunnel establishment response messages, if the data tunnel establishment response message includes a verification success indication information indicating that the BRAS successfully verified the access point, establishing a corresponding data tunnel according to the first tunnel establishment configuration parameter with the BRAS, • adding a corresponding VLAN ID for user data according to an SSID selected by a user and the information about binding between the at least one SSID and the at least one VLAN ID; and sending, according to the information about binding between the IP address of the at least one BRAS and the at least one SSID, the user data to a corresponding BRAS by using the data tunnel between the access point and the corresponding BRAS. <EOS>