Guest Network
From DD-WRT Wiki
Revision as of 20:30, 29 November 2017 (edit) Jeremywh7 (Talk | contribs) ← Previous diff |
Revision as of 20:38, 29 November 2017 (edit) (undo) Jeremywh7 (Talk | contribs) m (→Prior to 23020) Next diff → |
||
Line 27: | Line 27: | ||
==Prior to 23020== | ==Prior to 23020== | ||
- | + | Reference: [http://www.alexlaird.com/2013/03/dd-wrt-guest-wireless/ DD-WRT Guest Wireless] | |
#Section ''Wireless'' -> ''Basic Settings'' tab | #Section ''Wireless'' -> ''Basic Settings'' tab | ||
#*“Add” a “Virtual Interface”, give this guest network a separate SSID, and “Enable” “AP Isolation”. | #*“Add” a “Virtual Interface”, give this guest network a separate SSID, and “Enable” “AP Isolation”. | ||
Line 41: | Line 41: | ||
#Section ''Administration'' -> ''Commands'' tab | #Section ''Administration'' -> ''Commands'' tab | ||
#Firewall Rules to secure the private network and give the guest network internet access: | #Firewall Rules to secure the private network and give the guest network internet access: | ||
- | + | #*Copy/paste the below, then click '''Save Firewall''' | |
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr` | iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr` | ||
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT | iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT | ||
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP | iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP | ||
- | + | More Firewall Rules to isolate guest and restrict services' access: | |
- | + | *Copy/paste the below, then click '''Save Firewall''' | |
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP | iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP | ||
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset | iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset | ||
Line 52: | Line 52: | ||
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset | iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset | ||
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset | iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset | ||
- | + | Test the guest network, reboot if not working | |
==Special Note for a VAP on an [[Wireless_Access_Point|Access Point]] (AP)== | ==Special Note for a VAP on an [[Wireless_Access_Point|Access Point]] (AP)== |
Revision as of 20:38, 29 November 2017
Contents |
Introduction
A Guest Network is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.
- Also see Multiple_WLANs
Important Note
Though isolated from the LAN, a Guest Network needs a strong wireless password to prevent unauthorized network access, and should be a different password from your normal Wireless Access Point (WAP).
The Modern Way
This uses the "23020 and later" method, but uses dnsmasq instead of dhcpd. For a Wireless Access Point, Multiple DHCP Server is not available with the WAN disabled. See the VAP on an Access Point section below.
- Services -> Services-> DNSMasq: Enable DNSMasq but leave other options disabled
- In Additional DNSMasq Options, add the IP address and range for the appropriate virtual guest interface
- Examples:
Broadcom:
interface=wl0.1 dhcp-option=wl0.1,3,192.168.7.1 dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h
Atheros:
interface=ath0.1 dhcp-option=ath0.1,3,192.168.7.1 dhcp-range=ath0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h
23020 and later
Kong added easy Guest Network capability to DD-WRT, starting with build 23020.
Wiki setup instructions: Guest WiFi + abuse control for beginners
Prior to 23020
Reference: DD-WRT Guest Wireless
- Section Wireless -> Basic Settings tab
- “Add” a “Virtual Interface”, give this guest network a separate SSID, and “Enable” “AP Isolation”.
- Click Save, then Apply
- Wireless Security tab: also use a separate password, and WPA2 AES security
- Click Save, then Apply
- Section Setup -> Networking tab
- Under “Create Bridge” click “Add”, name it, then set a different subnet
- Under “Assign to Bridge” click “Add", select the new bridge, then assign it to the new virtual interface
- Click Save, then Apply
- Networking tab: under “Multiple DHCP Server” click “Add” and select the new bridge
- Click Save, then Apply
- Section Administration -> Commands tab
- Firewall Rules to secure the private network and give the guest network internet access:
- Copy/paste the below, then click Save Firewall
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr` iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
More Firewall Rules to isolate guest and restrict services' access:
- Copy/paste the below, then click Save Firewall
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
Test the guest network, reboot if not working
Special Note for a VAP on an Access Point (AP)
If the router is used as an AP and not a gateway (meaning the WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for internet access and client access restrictions.
- order to get internet access from the VAP, in Administration/Commands save Firewall:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
- Net Isolation does not work on a WAP so keep it disabled and also add the this line to the firewall:
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
For more details on this, see this post. For more on various firewall rules' impacts, see this post.