Guest Network
From DD-WRT Wiki
Revision as of 20:38, 29 November 2017 (edit) Jeremywh7 (Talk | contribs) m (→Prior to 23020) ← Previous diff |
Revision as of 20:53, 29 November 2017 (edit) (undo) Jeremywh7 (Talk | contribs) m Next diff → |
||
Line 2: | Line 2: | ||
A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security. | A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security. | ||
*Also see [[Multiple_WLANs|Multiple_WLANs]] | *Also see [[Multiple_WLANs|Multiple_WLANs]] | ||
- | |||
- | ====Important Note==== | ||
- | Though isolated from the LAN, a Guest Network needs a ''strong wireless password'' to prevent unauthorized network access, and should be a ''different password'' from your normal Wireless Access Point (WAP). | ||
==The Modern Way== | ==The Modern Way== | ||
- | This uses the "23020 and later" method, but uses dnsmasq instead of dhcpd. For a Wireless Access Point, Multiple DHCP Server is not available with the WAN disabled. See the '''VAP on an Access Point''' section below. | + | This uses the "23020 and later" method, but uses dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See the '''VAP on an Access Point''' section below. |
*Services -> Services-> DNSMasq: Enable DNSMasq but leave other options disabled | *Services -> Services-> DNSMasq: Enable DNSMasq but leave other options disabled | ||
Line 54: | Line 51: | ||
Test the guest network, reboot if not working | Test the guest network, reboot if not working | ||
- | ==Special | + | ==Special Notes== |
+ | |||
+ | ====Guest VAP Passwords==== | ||
+ | To prevent unauthorized network access, you must use a ''different wireless password'' from your normal Wireless Access Point. Though isolated from the LAN, a Guest Network should have a ''strong password'' . | ||
+ | |||
+ | ====Multi-band radios==== | ||
+ | To have guest VAP's from each radio on the same subnet, create a bridge for them. | ||
+ | |||
+ | ====VAP on an [[Wireless_Access_Point|Access Point]] (AP)==== | ||
If the router is used as an AP and not a gateway (meaning the WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for internet access and client access restrictions. | If the router is used as an AP and not a gateway (meaning the WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for internet access and client access restrictions. | ||
*order to get internet access from the VAP, in Administration/Commands save Firewall: | *order to get internet access from the VAP, in Administration/Commands save Firewall: |
Revision as of 20:53, 29 November 2017
Contents |
Introduction
A Guest Network is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.
- Also see Multiple_WLANs
The Modern Way
This uses the "23020 and later" method, but uses dnsmasq instead of dhcpd. For a Wireless Access Point (WAP), Multiple DHCP Server is not available with the WAN disabled. See the VAP on an Access Point section below.
- Services -> Services-> DNSMasq: Enable DNSMasq but leave other options disabled
- In Additional DNSMasq Options, add the IP address and range for the appropriate virtual guest interface
- Examples:
Broadcom:
interface=wl0.1 dhcp-option=wl0.1,3,192.168.7.1 dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h
Atheros:
interface=ath0.1 dhcp-option=ath0.1,3,192.168.7.1 dhcp-range=ath0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h
23020 and later
Kong added easy Guest Network capability to DD-WRT, starting with build 23020.
Wiki setup instructions: Guest WiFi + abuse control for beginners
Prior to 23020
Reference: DD-WRT Guest Wireless
- Section Wireless -> Basic Settings tab
- “Add” a “Virtual Interface”, give this guest network a separate SSID, and “Enable” “AP Isolation”.
- Click Save, then Apply
- Wireless Security tab: also use a separate password, and WPA2 AES security
- Click Save, then Apply
- Section Setup -> Networking tab
- Under “Create Bridge” click “Add”, name it, then set a different subnet
- Under “Assign to Bridge” click “Add", select the new bridge, then assign it to the new virtual interface
- Click Save, then Apply
- Networking tab: under “Multiple DHCP Server” click “Add” and select the new bridge
- Click Save, then Apply
- Section Administration -> Commands tab
- Firewall Rules to secure the private network and give the guest network internet access:
- Copy/paste the below, then click Save Firewall
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr` iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
More Firewall Rules to isolate guest and restrict services' access:
- Copy/paste the below, then click Save Firewall
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
Test the guest network, reboot if not working
Special Notes
Guest VAP Passwords
To prevent unauthorized network access, you must use a different wireless password from your normal Wireless Access Point. Though isolated from the LAN, a Guest Network should have a strong password .
Multi-band radios
To have guest VAP's from each radio on the same subnet, create a bridge for them.
VAP on an Access Point (AP)
If the router is used as an AP and not a gateway (meaning the WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for internet access and client access restrictions.
- order to get internet access from the VAP, in Administration/Commands save Firewall:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
- Net Isolation does not work on a WAP so keep it disabled and also add the this line to the firewall:
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
For more details on this, see this post. For more on various firewall rules' impacts, see this post.