http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&action=history&feed=atom Guest Network - Revision history 2024-03-28T17:50:53Z Revision history for this page on the wiki MediaWiki 1.10.1 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=55726&oldid=prev Jeremywh7: add section for no VAP at boot on BCM devices 2020-09-03T17:13:40Z <p>add section for no VAP at boot on BCM devices</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 17:13, 3 September 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 51:</strong></td> <td colspan="2" align="left"><strong>Line 51:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==<del style="color: red; font-weight: bold; text-decoration: none;">Special </del>Notes==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Notes==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">The [[Multiple WLANs]] wiki is deprecated (for old builds) and <del style="color: red; font-weight: bold; text-decoration: none;">only </del>mentioned for reference.</td><td>+</td><td style="background: #cfc; font-size: smaller;">The [[Multiple WLANs]] wiki is deprecated (<ins style="color: red; font-weight: bold; text-decoration: none;">use only </ins>for old builds) and mentioned <ins style="color: red; font-weight: bold; text-decoration: none;">just </ins>for reference.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====No VAP at boot (Broadcom)====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">If the VAP does not work at boot (fixed for some unbridged VAPs since r40564:40566), there are workarounds:</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*''Administration'' -&gt; ''Commands'' and try '''one of these startup commands''' then ''Save Startup''</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> sleep #; stopservice nas;stopservice wlconf;startservice wlconf;startservice nas</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> sleep #; stopservice cron; stopservice wlconf; wlconf eth1 up; wlconf eth2 up; startservice cron</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> sleep #; stopservice nas; wlconf eth1 down; wlconf eth2 down; wlconf eth1 up; wlconf eth2 up; startservice nas</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''where &quot;#&quot; is the ''sleep'' time''' from ~3-20 (sec): start with 10 seconds</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Another option: [https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1145042#1145042 replace wlconf for ARM devices]</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=55569&oldid=prev Jeremywh7: Clarify dnsmasq method steps 2020-04-28T00:17:05Z <p>Clarify dnsmasq method steps</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 00:17, 28 April 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 3:</strong></td> <td colspan="2" align="left"><strong>Line 3:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==DNSMasq method==</td><td> </td><td style="background: #eee; font-size: smaller;">==DNSMasq method==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses <del style="color: red; font-weight: bold; text-decoration: none;">the &quot;23020 and later&quot; method, but with </del>DNSMasq instead of DHCPd. <del style="color: red; font-weight: bold; text-decoration: none;"> For </del>setups [[Linking_Routers|without a WAN]] (e.g. [[Wireless_access_point|WAP]]), iptables (''Firewall'') rules are required for internet access<del style="color: red; font-weight: bold; text-decoration: none;">, as </del>Multiple DHCP Server is not available with the WAN disabled. <del style="color: red; font-weight: bold; text-decoration: none;">See </del>[<del style="color: red; font-weight: bold; text-decoration: none;">[Guest_Network#VAP_with_no_WAN|VAP with no WAN]</del>] <del style="color: red; font-weight: bold; text-decoration: none;">to fix it</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses DNSMasq instead of DHCPd. <ins style="color: red; font-weight: bold; text-decoration: none;">See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] for </ins>setups [[Linking_Routers|without a WAN]] (e.g. [[Wireless_access_point|WAP]]), <ins style="color: red; font-weight: bold; text-decoration: none;">as </ins>iptables (''Firewall'') rules are required for internet access <ins style="color: red; font-weight: bold; text-decoration: none;">(''</ins>Multiple DHCP Server<ins style="color: red; font-weight: bold; text-decoration: none;">'' </ins>is not available with the WAN disabled<ins style="color: red; font-weight: bold; text-decoration: none;">)</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">'''In the DD-WRT GUI:'''</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*''Wireless'' -&gt; ''Basic Settings'': Click ''Add Virtual AP'' under ''Virtual Interfaces'' and change the SSID if needed</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">In </del>the <del style="color: red; font-weight: bold; text-decoration: none;">DD</del>-<del style="color: red; font-weight: bold; text-decoration: none;">WRT Control Panel tab </del>''Services &gt;<del style="color: red; font-weight: bold; text-decoration: none;">&gt; </del>Services &gt;<del style="color: red; font-weight: bold; text-decoration: none;">&gt; </del>DNSMasq'': Enable DNSMasq, but leave other options disabled</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Set ''Network Configuration'' to '''Unbridged'''</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Enable the following options: ''AP Isolation'', ''Net Isolation''</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Enable ''Forced DNS Redirection'' to prevent users from circumventing content filters (</ins>[<ins style="color: red; font-weight: bold; text-decoration: none;">https://en.wikipedia.org/wiki/Public_recursive_name_server see Public DNS</ins>]<ins style="color: red; font-weight: bold; text-decoration: none;">)</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Set the ''Optional DNS Target'' (if needed), ''IP Address'' (e</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">g. 192.168.7.1), and ''Subnet Mask'' (255.255.255.0)</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">''Wireless'' -&gt; ''Wireless Security'' set up </ins>the <ins style="color: red; font-weight: bold; text-decoration: none;">new &quot;Virtual Interface&quot; (e.g. wl1.1), preferably with WPA2</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">AES</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>''Services<ins style="color: red; font-weight: bold; text-decoration: none;">'' -</ins>&gt; <ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>Services<ins style="color: red; font-weight: bold; text-decoration: none;">'' -</ins>&gt; <ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>DNSMasq'': Enable DNSMasq, but leave other options disabled</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> interface=wl0.1</td><td> </td><td style="background: #eee; font-size: smaller;"> interface=wl0.1</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> dhcp-option=wl0.1,3,192.168.7.1</td><td> </td><td style="background: #eee; font-size: smaller;"> dhcp-option=wl0.1,3,192.168.7.1</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"> dhcp-range=wl0.1,192.168.7.<del style="color: red; font-weight: bold; text-decoration: none;">2</del>,192.168.7.<del style="color: red; font-weight: bold; text-decoration: none;">60</del>,255.255.255.0,12h</td><td>+</td><td style="background: #cfc; font-size: smaller;"> dhcp-range=wl0.1,192.168.7.<ins style="color: red; font-weight: bold; text-decoration: none;">100</ins>,192.168.7.<ins style="color: red; font-weight: bold; text-decoration: none;">200</ins>,255.255.255.0,12h</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td></tr> <tr><td colspan="2" align="left"><strong>Line 48:</strong></td> <td colspan="2" align="left"><strong>Line 52:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Special Notes==</td><td> </td><td style="background: #eee; font-size: smaller;">==Special Notes==</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">The [[Multiple WLANs]] wiki is deprecated (for old builds) and only mentioned for reference.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=55375&oldid=prev Jeremywh7: remove dead links, fix code box spaces 2020-01-24T19:55:10Z <p>remove dead links, fix code box spaces</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 19:55, 24 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 5:</strong></td> <td colspan="2" align="left"><strong>Line 5:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== DNSMasq method == <del style="color: red; font-weight: bold; text-decoration: none;"> &lt;!-- Other articles link here. If the section title is changed, the links will be broken. Unfortunately, this ancient version of MediaWiki doesn't support HTML named anchors. --&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">==DNSMasq method==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with DNSMasq instead of DHCPd. For a <del style="color: red; font-weight: bold; text-decoration: none;">Wireless Access Point </del>(WAP), iptables rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. <del style="color: red; font-weight: bold; text-decoration: none;"> </del>See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with DNSMasq instead of DHCPd. For <ins style="color: red; font-weight: bold; text-decoration: none;">setups [[Linking_Routers|without </ins>a <ins style="color: red; font-weight: bold; text-decoration: none;">WAN]] </ins>(<ins style="color: red; font-weight: bold; text-decoration: none;">e.g. [[Wireless_access_point|</ins>WAP<ins style="color: red; font-weight: bold; text-decoration: none;">]]</ins>), iptables <ins style="color: red; font-weight: bold; text-decoration: none;">(''Firewall'') </ins>rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*In the DD-WRT Control Panel tab ''Services &gt;&gt; Services &gt;&gt; DNSMasq'': Enable DNSMasq, but leave other options disabled</td><td> </td><td style="background: #eee; font-size: smaller;">*In the DD-WRT Control Panel tab ''Services &gt;&gt; Services &gt;&gt; DNSMasq'': Enable DNSMasq, but leave other options disabled</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is <del style="color: red; font-weight: bold; text-decoration: none;">usually </del>''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td><td>+</td><td style="background: #cfc; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>interface=wl0.1</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>interface=wl0.1</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>dhcp-option=wl0.1,3,192.168.7.1</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>dhcp-option=wl0.1,3,192.168.7.1</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[http://tips.desipro.de/2013/12/06/guest-wifi-setup-dd-wrt/ </del>Kong added easy Guest Network capability to DD-WRT<del style="color: red; font-weight: bold; text-decoration: none;">], </del>starting with build 23020.</td><td>+</td><td style="background: #cfc; font-size: smaller;">Kong added easy Guest Network capability to DD-WRT starting with build 23020. <ins style="color: red; font-weight: bold; text-decoration: none;">See [[Guest WiFi + abuse control for beginners]]</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Firewall changes should not be needed for a normal gateway router setup</td><td> </td><td style="background: #eee; font-size: smaller;">*Firewall changes should not be needed for a normal gateway router setup</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Wiki setup instructions: [[Guest WiFi + abuse control for beginners]]</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Prior to 23020==</td><td> </td><td style="background: #eee; font-size: smaller;">==Prior to 23020==</td></tr> <tr><td colspan="2" align="left"><strong>Line 36:</strong></td> <td colspan="2" align="left"><strong>Line 35:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">#Firewall Rules to secure the private network and give the guest network internet access:</td><td> </td><td style="background: #eee; font-size: smaller;">#Firewall Rules to secure the private network and give the guest network internet access:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">#*Copy/paste the below, then click '''Save Firewall'''</td><td> </td><td style="background: #eee; font-size: smaller;">#*Copy/paste the below, then click '''Save Firewall'''</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">More Firewall Rules to isolate guest and restrict services' access:</td><td> </td><td style="background: #eee; font-size: smaller;">More Firewall Rules to isolate guest and restrict services' access:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste the below, then click '''Save Firewall'''</td><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste the below, then click '''Save Firewall'''</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 55:</strong></td> <td colspan="2" align="left"><strong>Line 54:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Guest Access to a Network Device====</td><td> </td><td style="background: #eee; font-size: smaller;">====Guest Access to a Network Device====</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">To allow the guest network access to a printer, web server, or other network device, add this rule last:</td><td> </td><td style="background: #eee; font-size: smaller;">To allow the guest network access to a printer, web server, or other network device, add this rule last:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i wl0.1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i wl0.1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Adjusting the virtual interface, bridge, and appropriate IP address</td><td> </td><td style="background: #eee; font-size: smaller;">*Adjusting the virtual interface, bridge, and appropriate IP address</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 62:</strong></td> <td colspan="2" align="left"><strong>Line 61:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*This may depend on the interfaces bridged via br1, so be sure to test</td><td> </td><td style="background: #eee; font-size: smaller;">*This may depend on the interfaces bridged via br1, so be sure to test</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*To be safe, add firewall rules to block br1 from the subnet and router, but ensure the guest has DHCP &amp; DNS:</td><td> </td><td style="background: #eee; font-size: smaller;">*To be safe, add firewall rules to block br1 from the subnet and router, but ensure the guest has DHCP &amp; DNS:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -m state --state NEW -j REJECT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -m state --state NEW -j REJECT</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p udp -m multiport --dports 53,67 -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p udp -m multiport --dports 53,67 -j ACCEPT</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j REJECT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j REJECT</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste these lines to ''Administration-&gt;Commands'', then click ''Save Firewall''</td><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste these lines to ''Administration-&gt;Commands'', then click ''Save Firewall''</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*To allow this ''br1'' access to a printer, web server, or other network device, add this rule last:</td><td> </td><td style="background: #eee; font-size: smaller;">*To allow this ''br1'' access to a printer, web server, or other network device, add this rule last:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====VAP with no WAN====</td><td> </td><td style="background: #eee; font-size: smaller;">====VAP with no WAN====</td></tr> <tr><td colspan="2" align="left"><strong>Line 85:</strong></td> <td colspan="2" align="left"><strong>Line 84:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Settings ''DNS Target'' does not work on a WAP if the primary router has ''Forced DNS Redirection'' enabled. A workaround is if the AP is running DNSCrypt, set it to use OpenDNS &quot;Family Shield DNS&quot;: also see [[Guest WiFi + abuse control for beginners]].</td><td> </td><td style="background: #eee; font-size: smaller;">*Settings ''DNS Target'' does not work on a WAP if the primary router has ''Forced DNS Redirection'' enabled. A workaround is if the AP is running DNSCrypt, set it to use OpenDNS &quot;Family Shield DNS&quot;: also see [[Guest WiFi + abuse control for beginners]].</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54845&oldid=prev Hydrargyrum: /* DNSMasq Method */ 2019-08-13T16:08:28Z <p><span class="autocomment">DNSMasq Method</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:08, 13 August 2019</td> </tr> <tr><td colspan="2" align="left"><strong>Line 5:</strong></td> <td colspan="2" align="left"><strong>Line 5:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==<del style="color: red; font-weight: bold; text-decoration: none;">New </del>DNSMasq <del style="color: red; font-weight: bold; text-decoration: none;">Method</del>==</td><td>+</td><td style="background: #cfc; font-size: smaller;">== DNSMasq <ins style="color: red; font-weight: bold; text-decoration: none;">method </ins>== <ins style="color: red; font-weight: bold; text-decoration: none;"> &lt;!-- Other articles link here. If the section title is changed, the links will be broken. Unfortunately, this ancient version of MediaWiki doesn't support HTML named anchors. --&gt;</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with <del style="color: red; font-weight: bold; text-decoration: none;">dnsmasq </del>instead of <del style="color: red; font-weight: bold; text-decoration: none;">dhcpd</del>. For a Wireless Access Point (WAP), iptables rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with <ins style="color: red; font-weight: bold; text-decoration: none;">DNSMasq </ins>instead of <ins style="color: red; font-weight: bold; text-decoration: none;">DHCPd</ins>. For a Wireless Access Point (WAP), iptables rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*''Services <del style="color: red; font-weight: bold; text-decoration: none;">-</del>&gt; Services<del style="color: red; font-weight: bold; text-decoration: none;">-</del>&gt; DNSMasq'': Enable DNSMasq but leave other options disabled</td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">In the DD-WRT Control Panel tab </ins>''Services <ins style="color: red; font-weight: bold; text-decoration: none;">&gt;</ins>&gt; Services <ins style="color: red; font-weight: bold; text-decoration: none;">&gt;</ins>&gt; DNSMasq'': Enable DNSMasq<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins>but leave other options disabled</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is usually ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is usually ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td></tr> </table> Hydrargyrum http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54755&oldid=prev Jeremywh7: /* VAP with no WAN */ Add net isolation rules 2019-04-02T14:11:15Z <p><span class="autocomment">VAP with no WAN -</span> Add net isolation rules</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 14:11, 2 April 2019</td> </tr> <tr><td colspan="2" align="left"><strong>Line 72:</strong></td> <td colspan="2" align="left"><strong>Line 72:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (like an AP, thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (like an AP, thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), &amp; Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), &amp; Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">''Net Isolation does not work on a WAP so keep it disabled, &amp; to </del>get internet access from the bridge:''</td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">To </ins>get internet access from the bridge:''</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*''Administration-&gt;Commands'': copy/paste these lines then click ''Save Firewall'' ('''Maintain the rules order'''):</td><td> </td><td style="background: #eee; font-size: smaller;">*''Administration-&gt;Commands'': copy/paste these lines then click ''Save Firewall'' ('''Maintain the rules order'''):</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Note that the bridge and/or virtual interface may be different</td><td> </td><td style="background: #eee; font-size: smaller;">*Note that the bridge and/or virtual interface may be different</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*''Net Isolation'' does not work on a WAP so keep it disabled and add this to the firewall:</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Also to isolate the WAP itself from the guest network: [Note: not all firmwares have the ''multiport'' directive]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I INPUT -i wl0.1 -m state --state NEW -j REJECT</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I INPUT -i wl0.1 -p udp -m multiport --dports 53,67 -j ACCEPT</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54643&oldid=prev Ian5142: Added language header. 2019-01-05T21:37:59Z <p>Added language header.</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 21:37, 5 January 2019</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">{{Languages|Guest_Network}}</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td></tr> </table> Ian5142 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54570&oldid=prev Jeremywh7: clarify VAP with no WAN 2018-12-10T18:30:25Z <p>clarify VAP with no WAN</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:30, 10 December 2018</td> </tr> <tr><td colspan="2" align="left"><strong>Line 4:</strong></td> <td colspan="2" align="left"><strong>Line 4:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] <del style="color: red; font-weight: bold; text-decoration: none;">below</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), <ins style="color: red; font-weight: bold; text-decoration: none;">iptables rules are required for internet access, as </ins>Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] <ins style="color: red; font-weight: bold; text-decoration: none;">to fix it</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*''Services -&gt; Services-&gt; DNSMasq'': Enable DNSMasq but leave other options disabled</td><td> </td><td style="background: #eee; font-size: smaller;">*''Services -&gt; Services-&gt; DNSMasq'': Enable DNSMasq but leave other options disabled</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=53579&oldid=prev Ian5142: Changed links. 2018-02-19T13:23:24Z <p>Changed links.</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:23, 19 February 2018</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Also see [[Multiple_WLANs|<del style="color: red; font-weight: bold; text-decoration: none;">Multiple_WLANs</del>]]</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Also see [[Multiple_WLANs|<ins style="color: red; font-weight: bold; text-decoration: none;">Multiple WLANs</ins>]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td></tr> </table> Ian5142 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=53470&oldid=prev Jeremywh7 at 18:41, 23 January 2018 2018-01-23T18:41:37Z <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:41, 23 January 2018</td> </tr> <tr><td colspan="2" align="left"><strong>Line 4:</strong></td> <td colspan="2" align="left"><strong>Line 4:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See <del style="color: red; font-weight: bold; text-decoration: none;">the '''</del>VAP <del style="color: red; font-weight: bold; text-decoration: none;">on an Access Point''' section </del>below.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the &quot;23020 and later&quot; method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See <ins style="color: red; font-weight: bold; text-decoration: none;">[[Guest_Network#VAP_with_no_WAN|</ins>VAP <ins style="color: red; font-weight: bold; text-decoration: none;">with no WAN]] </ins>below.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*''Services -&gt; Services-&gt; DNSMasq'': Enable DNSMasq but leave other options disabled</td><td> </td><td style="background: #eee; font-size: smaller;">*''Services -&gt; Services-&gt; DNSMasq'': Enable DNSMasq but leave other options disabled</td></tr> <tr><td colspan="2" align="left"><strong>Line 67:</strong></td> <td colspan="2" align="left"><strong>Line 67:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">====VAP with <del style="color: red; font-weight: bold; text-decoration: none;">disabled </del>WAN <del style="color: red; font-weight: bold; text-decoration: none;">(like an AP)</del>====</td><td>+</td><td style="background: #cfc; font-size: smaller;">====VAP with <ins style="color: red; font-weight: bold; text-decoration: none;">no </ins>WAN====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">If the router is not used as a gateway (thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td><td>+</td><td style="background: #cfc; font-size: smaller;">If the router is not used as a gateway (<ins style="color: red; font-weight: bold; text-decoration: none;">like an AP, </ins>thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), &amp; Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), &amp; Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*''Net Isolation does not work on a WAP so keep it disabled, &amp; to get internet access from the bridge:''</td><td> </td><td style="background: #eee; font-size: smaller;">*''Net Isolation does not work on a WAP so keep it disabled, &amp; to get internet access from the bridge:''</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=53272&oldid=prev Jeremywh7: /* Special Notes */ 2017-12-01T03:44:33Z <p><span class="autocomment">Special Notes</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 03:44, 1 December 2017</td> </tr> <tr><td colspan="2" align="left"><strong>Line 67:</strong></td> <td colspan="2" align="left"><strong>Line 67:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">====VAP <del style="color: red; font-weight: bold; text-decoration: none;">when WAN is </del>disabled====</td><td>+</td><td style="background: #cfc; font-size: smaller;">====VAP <ins style="color: red; font-weight: bold; text-decoration: none;">with </ins>disabled <ins style="color: red; font-weight: bold; text-decoration: none;">WAN (like an AP)</ins>====</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), &amp; Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), &amp; Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td></tr> <tr><td colspan="2" align="left"><strong>Line 77:</strong></td> <td colspan="2" align="left"><strong>Line 77:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Settings ''DNS Target'' does not work on a WAP if the primary router has ''Forced DNS Redirection'' enabled. A workaround is if the AP is running DNSCrypt, set it to use OpenDNS &quot;Family Shield DNS&quot;: also see [[Guest WiFi + abuse control for beginners]].</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td></tr> </table> Jeremywh7