Guest Network

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 08:58, 2 November 2015 (edit)
Mile-Lile (Talk | contribs)
(23020 and later)
← Previous diff
Revision as of 20:07, 29 November 2017 (edit) (undo)
Jeremywh7 (Talk | contribs)

Next diff →
Line 1: Line 1:
-A virtual '''Guest Network''' is a separate SSID (wireless network ID) for guests that gives them access to the WAN (Internet) while blocking them from your LAN (local network) thereby protecting your security.+==Introduction==
 +A '''Guest Network''' is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.
 +*A common use of a Guest Network is to provide internet access for an adjacent rental unit or neighbor.
-Another common use of a Guest Network is to provide Internet access for an adjacent rental unit or a neighbor.+====Important Note====
 +Though isolated from the LAN, a Guest Network needs a ''strong wireless password'' to prevent unauthorized network access, and should be a ''different password'' from your normal Wireless Access Point (WAP).
-== Prior to 23020 ==+==The Modern Way==
 +This uses the "23020 and later" method, but uses dnsmasq instead of dhcpd.
 +*Services -> Services-> DNSMasq: Enable DNSMasq but leave other options disabled
 +* In Additional DNSMasq Options, add the IP address and range for the appropriate virtual interface
 +**Examples:
 +'''Broadcom:'''
 + interface=wl0.1
 + dhcp-option=wl0.1,3,192.168.7.1
 + dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h
 +'''Atheros:'''
 + interface=ath0.1
 + dhcp-option=ath0.1,3,192.168.7.1
 + dhcp-range=ath0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h
-See [http://www.alexlaird.com/2013/03/dd-wrt-guest-wireless/ DD-WRT Guest Wireless ]+==23020 and later==
 +Kong added easy Guest Network capability to DD-WRT, starting with build 23020: [http://tips.desipro.de/2013/12/06/guest-wifi-setup-dd-wrt/ instructions].
-== 23020 and later ==+Wiki setup instructions: [[Guest WiFi + abuse control for beginners]]
-Kong added easy Guest Network capability to DD-WRT starting with build 23020.+==Prior to 23020==
 +Ref: [http://www.alexlaird.com/2013/03/dd-wrt-guest-wireless/ DD-WRT Guest Wireless]
 +#Section ''Wireless'' -> ''Basic Settings'' tab
 +#*“Add” a “Virtual Interface”, give this guest network a separate SSID, and “Enable” “AP Isolation”.
 +#*Click '''Save''', then '''Apply'''
 +#''Wireless Security'' tab: also use a separate password, and WPA2 AES security
 +#*Click '''Save''', then '''Apply'''
 +#Section ''Setup'' -> ''Networking'' tab
 +#*Under “Create Bridge” click “Add”, name it, then set a different subnet
 +#*Under “Assign to Bridge” click “Add", select the new bridge, then assign it to the new virtual interface
 +#*Click '''Save''', then '''Apply'''
 +#''Networking'' tab: under “Multiple DHCP Server” click “Add” and select the new bridge
 +#*Click '''Save''', then '''Apply'''
 +#Section ''Administration'' -> ''Commands'' tab
 +#Firewall Rules to secure the private network and give the guest network internet access:
 +**Copy/paste the below, then click '''Save Firewall'''
 + iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
 + iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
 + iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
 +##More Firewall Rules to isolate guest and restrict services' access:
 +#*Copy/paste the below, then click '''Save Firewall'''
 + iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
 + iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
 + iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
 + iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
 + iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
 +#*Test the guest network, reboot if not working
-Instructions for how to set it up: [http://tips.desipro.de/2013/12/06/guest-wifi-setup-dd-wrt/ Guest Wifi Setup DD-WRT] [[Guest WiFi + abuse control for beginners]]+==Special Note for a VAP on an [[Wireless_Access_Point|Access Point]] (AP)==
- +If the router is used as an AP and not a gateway (meaning the WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for internet access and client access restrictions.
-== Important Note ==+*order to get internet access from the VAP, in Administration/Commands save Firewall:
- + iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
-Even though it's isolated from your LAN, your Guest Network should have a ''good network password'' to prevent unauthorized {ab)use of your Internet service, and it should be a ''different password'' from your wireless LAN.+*Net Isolation does not work on a WAP so keep it disabled and also add the this line to the firewall:
 + iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
[[Category:Wlan]] [[Category:Wlan]]

Revision as of 20:07, 29 November 2017

Contents

Introduction

A Guest Network is a separate SSID (wireless network ID) using a virtual access point (VAP) that gives guest access to the WAN (internet) while blocking them from your LAN (local network), thereby protecting your security.

  • A common use of a Guest Network is to provide internet access for an adjacent rental unit or neighbor.

Important Note

Though isolated from the LAN, a Guest Network needs a strong wireless password to prevent unauthorized network access, and should be a different password from your normal Wireless Access Point (WAP).

The Modern Way

This uses the "23020 and later" method, but uses dnsmasq instead of dhcpd.

  • Services -> Services-> DNSMasq: Enable DNSMasq but leave other options disabled
  • In Additional DNSMasq Options, add the IP address and range for the appropriate virtual interface
    • Examples:

Broadcom:

   interface=wl0.1
   dhcp-option=wl0.1,3,192.168.7.1
   dhcp-range=wl0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h

Atheros:

   interface=ath0.1
   dhcp-option=ath0.1,3,192.168.7.1
   dhcp-range=ath0.1,192.168.7.2,192.168.7.60,255.255.255.0,12h

23020 and later

Kong added easy Guest Network capability to DD-WRT, starting with build 23020: instructions.

Wiki setup instructions: Guest WiFi + abuse control for beginners

Prior to 23020

Ref: DD-WRT Guest Wireless

  1. Section Wireless -> Basic Settings tab
    • “Add” a “Virtual Interface”, give this guest network a separate SSID, and “Enable” “AP Isolation”.
    • Click Save, then Apply
  2. Wireless Security tab: also use a separate password, and WPA2 AES security
    • Click Save, then Apply
  3. Section Setup -> Networking tab
    • Under “Create Bridge” click “Add”, name it, then set a different subnet
    • Under “Assign to Bridge” click “Add", select the new bridge, then assign it to the new virtual interface
    • Click Save, then Apply
  4. Networking tab: under “Multiple DHCP Server” click “Add” and select the new bridge
    • Click Save, then Apply
  5. Section Administration -> Commands tab
  6. Firewall Rules to secure the private network and give the guest network internet access:
    • Copy/paste the below, then click Save Firewall
   iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
   iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
   iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
    1. More Firewall Rules to isolate guest and restrict services' access:
    • Copy/paste the below, then click Save Firewall
   iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
   iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
   iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
   iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
   iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
    • Test the guest network, reboot if not working

Special Note for a VAP on an Access Point (AP)

If the router is used as an AP and not a gateway (meaning the WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for internet access and client access restrictions.

  • order to get internet access from the VAP, in Administration/Commands save Firewall:
   iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
  • Net Isolation does not work on a WAP so keep it disabled and also add the this line to the firewall:
   iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT