Hello Andrew,
When you use VLANS essentialy what you are doing is creating different networks. So all should have their own ip address range. If not you get problems when you want to connect them via a router which would then see the same ip range on different networks and would be unable to route.
So in this case one could use (and I hope this time it does NOT reformat)
auto eth1 eth1.10 eth1.11
iface eth1 inet static
address 192.168.1.0
broadcast 192.168.1.255
netmask 255.255.255.0
up /etc/network/if-up.d/iptables
iface eth1.10 inet static
address 192.168.10.0
broadcast 192.168.10.255
netmask 255.255.255.0
iface eth1.11 inet static
address 192.168.11.0
broadcast 192.168.11.255
netmask 255.255.255.0
If you have the option, as in this case, it might make sense to use the same number for the VLAN and for the address range. It does not NEED to be so, and most cases it will not be so. But if it is a simple situation like this, one can take advantage of it.
Remember to set the VLANs correctly on the ports to the Debian router / firewall / dhcp server and on the ports to the WiFi APs. In this case untagged VLAN 1, tagged VLAN 10 and 11.
Bonno Bloksma