http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&action=history&feed=atomGuest Network - Revision history2024-03-28T17:50:53ZRevision history for this page on the wikiMediaWiki 1.10.1http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=55726&oldid=prevJeremywh7: add section for no VAP at boot on BCM devices2020-09-03T17:13:40Z<p>add section for no VAP at boot on BCM devices</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 17:13, 3 September 2020</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 51:</strong></td>
<td colspan="2" align="left"><strong>Line 51:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">==<del style="color: red; font-weight: bold; text-decoration: none;">Special </del>Notes==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Notes==</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">The [[Multiple WLANs]] wiki is deprecated (for old builds) and <del style="color: red; font-weight: bold; text-decoration: none;">only </del>mentioned for reference.</td><td>+</td><td style="background: #cfc; font-size: smaller;">The [[Multiple WLANs]] wiki is deprecated (<ins style="color: red; font-weight: bold; text-decoration: none;">use only </ins>for old builds) and mentioned <ins style="color: red; font-weight: bold; text-decoration: none;">just </ins>for reference.</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"> </td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====No VAP at boot (Broadcom)====</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">If the VAP does not work at boot (fixed for some unbridged VAPs since r40564:40566), there are workarounds:</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*''Administration'' -> ''Commands'' and try '''one of these startup commands''' then ''Save Startup''</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> sleep #; stopservice nas;stopservice wlconf;startservice wlconf;startservice nas</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> sleep #; stopservice cron; stopservice wlconf; wlconf eth1 up; wlconf eth2 up; startservice cron</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> sleep #; stopservice nas; wlconf eth1 down; wlconf eth2 down; wlconf eth1 up; wlconf eth2 up; startservice nas</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''where "#" is the ''sleep'' time''' from ~3-20 (sec): start with 10 seconds</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Another option: [https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1145042#1145042 replace wlconf for ARM devices]</ins></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td></tr>
</table>Jeremywh7http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=55569&oldid=prevJeremywh7: Clarify dnsmasq method steps2020-04-28T00:17:05Z<p>Clarify dnsmasq method steps</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 00:17, 28 April 2020</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 3:</strong></td>
<td colspan="2" align="left"><strong>Line 3:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td><td colspan="2"> </td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==DNSMasq method==</td><td> </td><td style="background: #eee; font-size: smaller;">==DNSMasq method==</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses <del style="color: red; font-weight: bold; text-decoration: none;">the "23020 and later" method, but with </del>DNSMasq instead of DHCPd. <del style="color: red; font-weight: bold; text-decoration: none;"> For </del>setups [[Linking_Routers|without a WAN]] (e.g. [[Wireless_access_point|WAP]]), iptables (''Firewall'') rules are required for internet access<del style="color: red; font-weight: bold; text-decoration: none;">, as </del>Multiple DHCP Server is not available with the WAN disabled. <del style="color: red; font-weight: bold; text-decoration: none;">See </del>[<del style="color: red; font-weight: bold; text-decoration: none;">[Guest_Network#VAP_with_no_WAN|VAP with no WAN]</del>] <del style="color: red; font-weight: bold; text-decoration: none;">to fix it</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses DNSMasq instead of DHCPd. <ins style="color: red; font-weight: bold; text-decoration: none;">See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] for </ins>setups [[Linking_Routers|without a WAN]] (e.g. [[Wireless_access_point|WAP]]), <ins style="color: red; font-weight: bold; text-decoration: none;">as </ins>iptables (''Firewall'') rules are required for internet access <ins style="color: red; font-weight: bold; text-decoration: none;">(''</ins>Multiple DHCP Server<ins style="color: red; font-weight: bold; text-decoration: none;">'' </ins>is not available with the WAN disabled<ins style="color: red; font-weight: bold; text-decoration: none;">)</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">'''In the DD-WRT GUI:'''</ins></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*''Wireless'' -> ''Basic Settings'': Click ''Add Virtual AP'' under ''Virtual Interfaces'' and change the SSID if needed</ins></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">In </del>the <del style="color: red; font-weight: bold; text-decoration: none;">DD</del>-<del style="color: red; font-weight: bold; text-decoration: none;">WRT Control Panel tab </del>''Services ><del style="color: red; font-weight: bold; text-decoration: none;">> </del>Services ><del style="color: red; font-weight: bold; text-decoration: none;">> </del>DNSMasq'': Enable DNSMasq, but leave other options disabled</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Set ''Network Configuration'' to '''Unbridged'''</ins></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Enable the following options: ''AP Isolation'', ''Net Isolation''</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Enable ''Forced DNS Redirection'' to prevent users from circumventing content filters (</ins>[<ins style="color: red; font-weight: bold; text-decoration: none;">https://en.wikipedia.org/wiki/Public_recursive_name_server see Public DNS</ins>]<ins style="color: red; font-weight: bold; text-decoration: none;">)</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">**Set the ''Optional DNS Target'' (if needed), ''IP Address'' (e</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">g. 192.168.7.1), and ''Subnet Mask'' (255.255.255.0)</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">''Wireless'' -> ''Wireless Security'' set up </ins>the <ins style="color: red; font-weight: bold; text-decoration: none;">new "Virtual Interface" (e.g. wl1.1), preferably with WPA2</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">AES</ins></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>''Services<ins style="color: red; font-weight: bold; text-decoration: none;">'' -</ins>> <ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>Services<ins style="color: red; font-weight: bold; text-decoration: none;">'' -</ins>> <ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>DNSMasq'': Enable DNSMasq, but leave other options disabled</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;">*In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"> interface=wl0.1</td><td> </td><td style="background: #eee; font-size: smaller;"> interface=wl0.1</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"> dhcp-option=wl0.1,3,192.168.7.1</td><td> </td><td style="background: #eee; font-size: smaller;"> dhcp-option=wl0.1,3,192.168.7.1</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"> dhcp-range=wl0.1,192.168.7.<del style="color: red; font-weight: bold; text-decoration: none;">2</del>,192.168.7.<del style="color: red; font-weight: bold; text-decoration: none;">60</del>,255.255.255.0,12h</td><td>+</td><td style="background: #cfc; font-size: smaller;"> dhcp-range=wl0.1,192.168.7.<ins style="color: red; font-weight: bold; text-decoration: none;">100</ins>,192.168.7.<ins style="color: red; font-weight: bold; text-decoration: none;">200</ins>,255.255.255.0,12h</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td></tr>
<tr><td colspan="2" align="left"><strong>Line 48:</strong></td>
<td colspan="2" align="left"><strong>Line 52:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==Special Notes==</td><td> </td><td style="background: #eee; font-size: smaller;">==Special Notes==</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;">The [[Multiple WLANs]] wiki is deprecated (for old builds) and only mentioned for reference.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td><td> </td><td style="background: #eee; font-size: smaller;">====Guest VAP Passwords====</td></tr>
</table>Jeremywh7http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=55375&oldid=prevJeremywh7: remove dead links, fix code box spaces2020-01-24T19:55:10Z<p>remove dead links, fix code box spaces</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 19:55, 24 January 2020</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 5:</strong></td>
<td colspan="2" align="left"><strong>Line 5:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">== DNSMasq method == <del style="color: red; font-weight: bold; text-decoration: none;"> <!-- Other articles link here. If the section title is changed, the links will be broken. Unfortunately, this ancient version of MediaWiki doesn't support HTML named anchors. --></del></td><td>+</td><td style="background: #cfc; font-size: smaller;">==DNSMasq method==</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the "23020 and later" method, but with DNSMasq instead of DHCPd. For a <del style="color: red; font-weight: bold; text-decoration: none;">Wireless Access Point </del>(WAP), iptables rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. <del style="color: red; font-weight: bold; text-decoration: none;"> </del>See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the "23020 and later" method, but with DNSMasq instead of DHCPd. For <ins style="color: red; font-weight: bold; text-decoration: none;">setups [[Linking_Routers|without </ins>a <ins style="color: red; font-weight: bold; text-decoration: none;">WAN]] </ins>(<ins style="color: red; font-weight: bold; text-decoration: none;">e.g. [[Wireless_access_point|</ins>WAP<ins style="color: red; font-weight: bold; text-decoration: none;">]]</ins>), iptables <ins style="color: red; font-weight: bold; text-decoration: none;">(''Firewall'') </ins>rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*In the DD-WRT Control Panel tab ''Services >> Services >> DNSMasq'': Enable DNSMasq, but leave other options disabled</td><td> </td><td style="background: #eee; font-size: smaller;">*In the DD-WRT Control Panel tab ''Services >> Services >> DNSMasq'': Enable DNSMasq, but leave other options disabled</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is <del style="color: red; font-weight: bold; text-decoration: none;">usually </del>''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td><td>+</td><td style="background: #cfc; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>interface=wl0.1</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>interface=wl0.1</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>dhcp-option=wl0.1,3,192.168.7.1</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>dhcp-option=wl0.1,3,192.168.7.1</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td><td> </td><td style="background: #eee; font-size: smaller;">==23020 and later==</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[http://tips.desipro.de/2013/12/06/guest-wifi-setup-dd-wrt/ </del>Kong added easy Guest Network capability to DD-WRT<del style="color: red; font-weight: bold; text-decoration: none;">], </del>starting with build 23020.</td><td>+</td><td style="background: #cfc; font-size: smaller;">Kong added easy Guest Network capability to DD-WRT starting with build 23020. <ins style="color: red; font-weight: bold; text-decoration: none;">See [[Guest WiFi + abuse control for beginners]]</ins></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Firewall changes should not be needed for a normal gateway router setup</td><td> </td><td style="background: #eee; font-size: smaller;">*Firewall changes should not be needed for a normal gateway router setup</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">Wiki setup instructions: [[Guest WiFi + abuse control for beginners]]</td><td colspan="2"> </td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==Prior to 23020==</td><td> </td><td style="background: #eee; font-size: smaller;">==Prior to 23020==</td></tr>
<tr><td colspan="2" align="left"><strong>Line 36:</strong></td>
<td colspan="2" align="left"><strong>Line 35:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">#Firewall Rules to secure the private network and give the guest network internet access:</td><td> </td><td style="background: #eee; font-size: smaller;">#Firewall Rules to secure the private network and give the guest network internet access:</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">#*Copy/paste the below, then click '''Save Firewall'''</td><td> </td><td style="background: #eee; font-size: smaller;">#*Copy/paste the below, then click '''Save Firewall'''</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">More Firewall Rules to isolate guest and restrict services' access:</td><td> </td><td style="background: #eee; font-size: smaller;">More Firewall Rules to isolate guest and restrict services' access:</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste the below, then click '''Save Firewall'''</td><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste the below, then click '''Save Firewall'''</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td><td> </td><td style="background: #eee; font-size: smaller;">Test the guest network, reboot if not working</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td colspan="2" align="left"><strong>Line 55:</strong></td>
<td colspan="2" align="left"><strong>Line 54:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">====Guest Access to a Network Device====</td><td> </td><td style="background: #eee; font-size: smaller;">====Guest Access to a Network Device====</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">To allow the guest network access to a printer, web server, or other network device, add this rule last:</td><td> </td><td style="background: #eee; font-size: smaller;">To allow the guest network access to a printer, web server, or other network device, add this rule last:</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i wl0.1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i wl0.1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Adjusting the virtual interface, bridge, and appropriate IP address</td><td> </td><td style="background: #eee; font-size: smaller;">*Adjusting the virtual interface, bridge, and appropriate IP address</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td colspan="2" align="left"><strong>Line 62:</strong></td>
<td colspan="2" align="left"><strong>Line 61:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*This may depend on the interfaces bridged via br1, so be sure to test</td><td> </td><td style="background: #eee; font-size: smaller;">*This may depend on the interfaces bridged via br1, so be sure to test</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*To be safe, add firewall rules to block br1 from the subnet and router, but ensure the guest has DHCP & DNS:</td><td> </td><td style="background: #eee; font-size: smaller;">*To be safe, add firewall rules to block br1 from the subnet and router, but ensure the guest has DHCP & DNS:</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -m state --state NEW -j REJECT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -m state --state NEW -j REJECT</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I INPUT -i br1 -p udp -m multiport --dports 53,67 -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I INPUT -i br1 -p udp -m multiport --dports 53,67 -j ACCEPT</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j REJECT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j REJECT</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste these lines to ''Administration->Commands'', then click ''Save Firewall''</td><td> </td><td style="background: #eee; font-size: smaller;">*Copy/paste these lines to ''Administration->Commands'', then click ''Save Firewall''</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*To allow this ''br1'' access to a printer, web server, or other network device, add this rule last:</td><td> </td><td style="background: #eee; font-size: smaller;">*To allow this ''br1'' access to a printer, web server, or other network device, add this rule last:</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">====VAP with no WAN====</td><td> </td><td style="background: #eee; font-size: smaller;">====VAP with no WAN====</td></tr>
<tr><td colspan="2" align="left"><strong>Line 85:</strong></td>
<td colspan="2" align="left"><strong>Line 84:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Settings ''DNS Target'' does not work on a WAP if the primary router has ''Forced DNS Redirection'' enabled. A workaround is if the AP is running DNSCrypt, set it to use OpenDNS "Family Shield DNS": also see [[Guest WiFi + abuse control for beginners]].</td><td> </td><td style="background: #eee; font-size: smaller;">*Settings ''DNS Target'' does not work on a WAP if the primary router has ''Forced DNS Redirection'' enabled. A workaround is if the AP is running DNSCrypt, set it to use OpenDNS "Family Shield DNS": also see [[Guest WiFi + abuse control for beginners]].</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td></tr>
</table>Jeremywh7http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54845&oldid=prevHydrargyrum: /* DNSMasq Method */2019-08-13T16:08:28Z<p><span class="autocomment">DNSMasq Method</span></p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:08, 13 August 2019</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 5:</strong></td>
<td colspan="2" align="left"><strong>Line 5:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Also see [[Multiple_WLANs|Multiple WLANs]]</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">==<del style="color: red; font-weight: bold; text-decoration: none;">New </del>DNSMasq <del style="color: red; font-weight: bold; text-decoration: none;">Method</del>==</td><td>+</td><td style="background: #cfc; font-size: smaller;">== DNSMasq <ins style="color: red; font-weight: bold; text-decoration: none;">method </ins>== <ins style="color: red; font-weight: bold; text-decoration: none;"> <!-- Other articles link here. If the section title is changed, the links will be broken. Unfortunately, this ancient version of MediaWiki doesn't support HTML named anchors. --></ins></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the "23020 and later" method, but with <del style="color: red; font-weight: bold; text-decoration: none;">dnsmasq </del>instead of <del style="color: red; font-weight: bold; text-decoration: none;">dhcpd</del>. For a Wireless Access Point (WAP), iptables rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the "23020 and later" method, but with <ins style="color: red; font-weight: bold; text-decoration: none;">DNSMasq </ins>instead of <ins style="color: red; font-weight: bold; text-decoration: none;">DHCPd</ins>. For a Wireless Access Point (WAP), iptables rules are required for internet access, as Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] to fix it.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">*''Services <del style="color: red; font-weight: bold; text-decoration: none;">-</del>> Services<del style="color: red; font-weight: bold; text-decoration: none;">-</del>> DNSMasq'': Enable DNSMasq but leave other options disabled</td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">In the DD-WRT Control Panel tab </ins>''Services <ins style="color: red; font-weight: bold; text-decoration: none;">></ins>> Services <ins style="color: red; font-weight: bold; text-decoration: none;">></ins>> DNSMasq'': Enable DNSMasq<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins>but leave other options disabled</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td><td> </td><td style="background: #eee; font-size: smaller;">* In ''Additional DNSMasq Options'', add the IP address and range for the appropriate virtual guest interface</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is usually ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td><td> </td><td style="background: #eee; font-size: smaller;">**Example for Broadcom (5 GHz is ''wl1.1''), Atheros is usually ''ath0.1'' or ''ath1.1'', '''but depends on the router''':</td></tr>
</table>Hydrargyrumhttp://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54755&oldid=prevJeremywh7: /* VAP with no WAN */ Add net isolation rules2019-04-02T14:11:15Z<p><span class="autocomment">VAP with no WAN -</span> Add net isolation rules</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 14:11, 2 April 2019</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 72:</strong></td>
<td colspan="2" align="left"><strong>Line 72:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (like an AP, thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (like an AP, thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), & Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), & Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">''Net Isolation does not work on a WAP so keep it disabled, & to </del>get internet access from the bridge:''</td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">To </ins>get internet access from the bridge:''</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*''Administration->Commands'': copy/paste these lines then click ''Save Firewall'' ('''Maintain the rules order'''):</td><td> </td><td style="background: #eee; font-size: smaller;">*''Administration->Commands'': copy/paste these lines then click ''Save Firewall'' ('''Maintain the rules order'''):</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Note that the bridge and/or virtual interface may be different</td><td> </td><td style="background: #eee; font-size: smaller;">*Note that the bridge and/or virtual interface may be different</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;">*''Net Isolation'' does not work on a WAP so keep it disabled and add this to the firewall:</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;">*Also to isolate the WAP itself from the guest network: [Note: not all firmwares have the ''multiport'' directive]</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I INPUT -i wl0.1 -m state --state NEW -j REJECT</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I INPUT -i wl0.1 -p udp -m multiport --dports 53,67 -j ACCEPT</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td></tr>
</table>Jeremywh7http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54643&oldid=prevIan5142: Added language header.2019-01-05T21:37:59Z<p>Added language header.</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 21:37, 5 January 2019</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 1:</strong></td>
<td colspan="2" align="left"><strong>Line 1:</strong></td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;">{{Languages|Guest_Network}}</td></tr>
<tr><td colspan="2"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td></tr>
</table>Ian5142http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=54570&oldid=prevJeremywh7: clarify VAP with no WAN2018-12-10T18:30:25Z<p>clarify VAP with no WAN</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:30, 10 December 2018</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 4:</strong></td>
<td colspan="2" align="left"><strong>Line 4:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the "23020 and later" method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] <del style="color: red; font-weight: bold; text-decoration: none;">below</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the "23020 and later" method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), <ins style="color: red; font-weight: bold; text-decoration: none;">iptables rules are required for internet access, as </ins>Multiple DHCP Server is not available with the WAN disabled. See [[Guest_Network#VAP_with_no_WAN|VAP with no WAN]] <ins style="color: red; font-weight: bold; text-decoration: none;">to fix it</ins>.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*''Services -> Services-> DNSMasq'': Enable DNSMasq but leave other options disabled</td><td> </td><td style="background: #eee; font-size: smaller;">*''Services -> Services-> DNSMasq'': Enable DNSMasq but leave other options disabled</td></tr>
</table>Jeremywh7http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=53579&oldid=prevIan5142: Changed links.2018-02-19T13:23:24Z<p>Changed links.</p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:23, 19 February 2018</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 1:</strong></td>
<td colspan="2" align="left"><strong>Line 1:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td><td> </td><td style="background: #eee; font-size: smaller;">==Introduction==</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td><td> </td><td style="background: #eee; font-size: smaller;">A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Also see [[Multiple_WLANs|<del style="color: red; font-weight: bold; text-decoration: none;">Multiple_WLANs</del>]]</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Also see [[Multiple_WLANs|<ins style="color: red; font-weight: bold; text-decoration: none;">Multiple WLANs</ins>]]</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td></tr>
</table>Ian5142http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=53470&oldid=prevJeremywh7 at 18:41, 23 January 20182018-01-23T18:41:37Z<p></p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:41, 23 January 2018</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 4:</strong></td>
<td colspan="2" align="left"><strong>Line 4:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td><td> </td><td style="background: #eee; font-size: smaller;">==New DNSMasq Method==</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">This uses the "23020 and later" method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See <del style="color: red; font-weight: bold; text-decoration: none;">the '''</del>VAP <del style="color: red; font-weight: bold; text-decoration: none;">on an Access Point''' section </del>below.</td><td>+</td><td style="background: #cfc; font-size: smaller;">This uses the "23020 and later" method, but with dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See <ins style="color: red; font-weight: bold; text-decoration: none;">[[Guest_Network#VAP_with_no_WAN|</ins>VAP <ins style="color: red; font-weight: bold; text-decoration: none;">with no WAN]] </ins>below.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*''Services -> Services-> DNSMasq'': Enable DNSMasq but leave other options disabled</td><td> </td><td style="background: #eee; font-size: smaller;">*''Services -> Services-> DNSMasq'': Enable DNSMasq but leave other options disabled</td></tr>
<tr><td colspan="2" align="left"><strong>Line 67:</strong></td>
<td colspan="2" align="left"><strong>Line 67:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">====VAP with <del style="color: red; font-weight: bold; text-decoration: none;">disabled </del>WAN <del style="color: red; font-weight: bold; text-decoration: none;">(like an AP)</del>====</td><td>+</td><td style="background: #cfc; font-size: smaller;">====VAP with <ins style="color: red; font-weight: bold; text-decoration: none;">no </ins>WAN====</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">If the router is not used as a gateway (thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td><td>+</td><td style="background: #cfc; font-size: smaller;">If the router is not used as a gateway (<ins style="color: red; font-weight: bold; text-decoration: none;">like an AP, </ins>thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), & Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), & Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*''Net Isolation does not work on a WAP so keep it disabled, & to get internet access from the bridge:''</td><td> </td><td style="background: #eee; font-size: smaller;">*''Net Isolation does not work on a WAP so keep it disabled, & to get internet access from the bridge:''</td></tr>
</table>Jeremywh7http://wiki.dd-wrt.com/wiki/index.php?title=Guest_Network&diff=53272&oldid=prevJeremywh7: /* Special Notes */2017-12-01T03:44:33Z<p><span class="autocomment">Special Notes</span></p>
<table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;">
<tr>
<td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td>
<td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 03:44, 1 December 2017</td>
</tr>
<tr><td colspan="2" align="left"><strong>Line 67:</strong></td>
<td colspan="2" align="left"><strong>Line 67:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td><td> </td><td style="background: #eee; font-size: smaller;"> iptables -I FORWARD -i br1 -o br0 -d {IP address} -m state --state NEW -j ACCEPT</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;">====VAP <del style="color: red; font-weight: bold; text-decoration: none;">when WAN is </del>disabled====</td><td>+</td><td style="background: #cfc; font-size: smaller;">====VAP <ins style="color: red; font-weight: bold; text-decoration: none;">with </ins>disabled <ins style="color: red; font-weight: bold; text-decoration: none;">WAN (like an AP)</ins>====</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td><td> </td><td style="background: #eee; font-size: smaller;">If the router is not used as a gateway (thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), & Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td><td> </td><td style="background: #eee; font-size: smaller;">*Examples: Access Point (AP), Repeater Bridge (RB), & Dual-band Client Bridge + AP: see [[Linking_Routers|here]]</td></tr>
<tr><td colspan="2" align="left"><strong>Line 77:</strong></td>
<td colspan="2" align="left"><strong>Line 77:</strong></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td><td> </td><td style="background: #eee; font-size: smaller;">*Finally, reboot the router.</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td><td> </td><td style="background: #eee; font-size: smaller;">For more details on this, see [http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143 this post]. For more on various firewall rules' impacts, see [https://www.dd-wrt.com/phpBB2/viewtopic.php?p=1064894#1064894 this post].</td></tr>
<tr><td>-</td><td style="background: #ffa; font-size: smaller;"> </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Settings ''DNS Target'' does not work on a WAP if the primary router has ''Forced DNS Redirection'' enabled. A workaround is if the AP is running DNSCrypt, set it to use OpenDNS "Family Shield DNS": also see [[Guest WiFi + abuse control for beginners]].</ins></td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Wlan]]</td></tr>
<tr><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Category:Basic tutorials]]</td></tr>
</table>Jeremywh7