WLAN separate from LAN, with independent dhcp, etc

From DD-WRT Wiki

Jump to: navigation, search

NOTE: This is an old unmaintained and duplicate guide. You should use one of the following currently maintained guides instead.

For a GUI based method see: Separate LAN and WLAN.

If you're separating virtual interfaces then use the instructions from the Multiple WLAN Guide.

Contents

[edit] Introduction

It took me quite a while to make all this work, so i thought i'd share all the hoops i had to jump through to get here with the community.

My goal was to migrate my existing linux box with an ethernet interface and a wifi card which was acting as a crude AP, but keep the same functionality: firewalling, separate subnets for wired and wireless, separate dhcp, etc.

Contrary to popular belief, DHCPMasq is quite capable of serving different ip ranges for different interfaces. The main problem seems to be that iptables(aka the firewall) prevents it in the default configuration.

[edit] Configuration

[edit] Step 1: Remove Wireless interface (eth1) from the LAN bridge (br0)

a) Go to the 'Setup -> VLANs' page.

b) At the bottom of the page change the "Wireless" option from "LAN" to "None"

(Above setting doesn't take place until the next reboot which is good because it kills the WLAN. We'll fix that in the next step.)

[edit] Step 2: Configure startup scripts

a1) Go to the 'Administration -> Diagnostics' page.

a2) (v23) Go to the 'Administration -> Command' page.

b) What you type here may vary, depending on your desired network. I wanted my wifi on a separate subnet from my LAN, with its own DHCP scope. In these examples, lan is 192.168.7.0/24, and wifi is 192.168.8.0/24

The following goes in the text box. Feel free to omit the lines that start with ##, as they are just comments. If you are really pressed for space, you can omit the linebreaks and just separate commands with ';'s

## configure wireless interface
ifconfig eth1 up inet 192.168.8.1 netmask 255.255.255.0

## setup dnsmasq
cat << EOF > /tmp/new.dnsmasq.conf
interface=br0
interface=eth1
resolv-file=/tmp/resolv.conf
leasefile-ro
dhcp-script=/etc/lease_update.sh
dhcp-lease-max=50
dhcp-option=br0,3,192.168.7.1
dhcp-range=br0,192.168.7.100,192.168.7.249,255.255.255.0,1440m
dhcp-option=eth1,3,192.168.8.1
dhcp-range=eth1,192.168.8.100,192.168.8.249,255.255.255.0,1440m
EOF

## restart dnsmasq
killall dnsmasq
dnsmasq --conf-file /tmp/new.dnsmasq.conf 

## configure wireless options
## I set some extra options here, see the docs for the wl command
## this may all be handled by doing 'wlconf eth1 up' instead
wl -i eth1 down
wl -i eth1 ap 1
wl -i eth1 infra 1
wl -i eth1 txpwr 84
wl -i eth1 up

## depending on your wifi settings, this will change. I just copied the existing command and changed the -l option
killall nas
nas -P /tmp/nas.wl0lan.pid -H 34954 -l eth1 -i eth1 -A -m 128 -k secretkey -s yourssid -w 2 -g 3600 &

You should be able to get the nas command line from the output of 'ps' from the shell (ssh/telnet)

c) Click the 'Save Startup' button instead of the 'Cmd' button (Don't close this window yet!)

Configure the necessary iptables rules:

The default firewalling setup is quite specific, and has no knowledge of the eth1 interface (it assumes it will be part of the LAN), so we need to add several rules to make it aware. These work under v23, you may need to tweak parts if you run a different version. Specifically, the rule #s may be different on your system.

a) Paste the following into the same text box used above but this time press the 'Save Firewall' button:

## wan:  vlan1
## lan:  br0
## wifi: eth1
## permit incoming connections from WLAN
iptables -I INPUT 9 -i eth1 -m state --state NEW -j logaccept
## fixup forwarding table
## the lan2wan target didn't work for me, replace it with straight accept
iptables -R FORWARD 6 -i br0  -o vlan1 -j ACCEPT
## permit WLAN -> WAN
iptables -I FORWARD 7 -i eth1 -o vlan1 -j ACCEPT
## permit WLAN -> LAN
iptables -I FORWARD 7 -i eth1 -o br0  -j ACCEPT

[edit] Step 3: Turn off stock DHCPMasq

This step comes third just to make sure we have a way back into the router, since it seems to reboot everytime we save the above configs.

a) Go to the 'Setup -> Basic Setup' page.

b) Change the 'DHCP server' setting to 'disable'

c) uncheck all the DHCP-specific options

The above didn't actually disable DHCPMasq for me. I had to run the following command from the shell (ssh or telnet).

 nvram set dnsmasq_enable=0
 nvram commit


I think that's it. enjoy


Comment recalcitrantyouth 11:01, 23 Jan 2008 (CEST) Thanks for this! In order to make this work with v2.3 SP2 on a WRT54GL 1.1, I needed to make a couple of minor changes.

## configure wireless interface
ifconfig eth1 up inet 192.168.8.1 netmask 255.255.255.0

## setup dnsmasq
cat << EOF > /tmp/new.dnsmasq.conf
interface=br0
interface=eth1
#resolv-file=/tmp/resolv.conf
# RY - incorrect resolv file in 2.3
resolv-file=/tmp/resolv.dnsmasq

leasefile-ro
dhcp-script=/etc/lease_update.sh
dhcp-lease-max=50
dhcp-option=br0,3,192.168.7.1
dhcp-range=br0,192.168.7.100,192.168.7.249,255.255.255.0,1440m
dhcp-option=eth1,3,192.168.8.1
dhcp-range=eth1,192.168.8.100,192.168.8.249,255.255.255.0,1440m
EOF

## restart dnsmasq
killall dnsmasq
dnsmasq --conf-file /tmp/new.dnsmasq.conf 

## configure wireless options
## I set some extra options here, see the docs for the wl command
## this may all be handled by doing 'wlconf eth1 up' instead
wlconf eth1 up

#wl -i eth1 down
#wl -i eth1 ap 1
#wl -i eth1 infra 1
#wl -i eth1 txpwr 84
#wl -i eth1 up

## depending on your wifi settings, this will change. I just copied the existing command and changed the -l option
# RY - if not running authentication, no need for this - the process isn't running
#killall nas
#nas -P /tmp/nas.wl0lan.pid -H 34954 -l eth1 -i eth1 -A -m 128 -k secretkey -s yourssid -w 2 -g 3600 &

I also found that step three was not actually necessary. Since during startup dnsmasq is being restarted anyway, forcing it not to start up shouldn't really matter.

Comment by tech128:

Well to get this to work properly on V24 SP2 I had to modify the firewall and startup somewhat

Also on atheros builds keep in mind there are no vlans (that I saw anyway) so you want to set the wireless interface to unbridged and enable nat instead. And you will need to modify the startup and firewall since the interfaces will be different. I believe it was ath0 for the wireless and eth0 for the wan instead of vlan1

First, the firewall:

## wan:  vlan1
## lan:  br0
## wifi: eth1
## permit incoming connections from WLAN
iptables -I INPUT 2 -i eth1 -m state --state NEW -j logaccept
## fixup forwarding table
## the lan2wan target didn't work for me, replace it with straight accept
iptables -R FORWARD 5 -i br0  -o vlan1 -j ACCEPT
## permit WLAN -> WAN
iptables -I FORWARD 7 -i eth1 -o vlan1 -j ACCEPT
## disallow WLAN -> LAN
iptables -I FORWARD 7 -i eth1 -o br0  -m state --state NEW -j DROP
## disallow LAN -> WLAN
iptables -I FORWARD -i br0 -o eth1 -m state --state NEW -j DROP
## disallow WLAN -> WAN subnet
iptables -I FORWARD -i eth1 -d `nvram get wan_ipaddr`/`nvram get wan_netmask` -m state --state NEW -j DROP
## disallow WLAN -> direct router access
iptables -I INPUT -i eth1 -m state --state NEW -j DROP
## Allow WLAN -> DHCP on the router
iptables -I INPUT -i eth1 -p udp --dport 67 -j ACCEPT
## Allow WLAN -> DNS on the router
iptables -I INPUT -i eth1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i eth1 -p tcp --dport 53 -j ACCEPT

Next, the startup:

## configure wired interface
ifconfig br0 up inet 192.168.7.1 netmask 255.255.255.0
## configure wireless interface
ifconfig eth1 up inet 192.168.8.1 netmask 255.255.255.0

## setup dnsmasq
cat << EOF > /tmp/new.dnsmasq.conf
interface=br0
interface=eth1
#resolv-file=/tmp/resolv.conf
# RY - incorrect resolv file in 2.3
resolv-file=/tmp/resolv.dnsmasq
all-servers

dhcp-script=/etc/lease_update.sh
dhcp-lease-max=50
dhcp-authoritative
dhcp-option=br0,3,192.168.7.1
dhcp-range=br0,192.168.7.100,192.168.7.249,255.255.255.0,1440m
dhcp-option=eth1,3,192.168.8.1
dhcp-range=eth1,192.168.8.100,192.168.8.249,255.255.255.0,1440m
stop-dns-rebind
EOF

## restart dnsmasq
killall dnsmasq
dnsmasq --conf-file=/tmp/new.dnsmasq.conf 

## configure wireless options
## I set some extra options here, see the docs for the wl command
## this may all be handled by doing 'wlconf eth1 up' instead
wlconf eth1 up

[edit] References

Separate LAN and WLAN