http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&curid=5450&action=history&feed=atom Guest WiFi + abuse control for beginners - Revision history 2024-03-29T15:12:21Z Revision history for this page on the wiki MediaWiki 1.10.1 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55736&oldid=prev Jeremywh7: add link 2020-10-10T20:33:53Z <p>add link</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 20:33, 10 October 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 5:</strong></td> <td colspan="2" align="left"><strong>Line 5:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This tutorial is for beginners, and therefore before proceeding make sure you have working reset button</td><td> </td><td style="background: #eee; font-size: smaller;">This tutorial is for beginners, and therefore before proceeding make sure you have working reset button</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling Guest WiFi. </td><td>+</td><td style="background: #cfc; font-size: smaller;">and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling Guest WiFi<ins style="color: red; font-weight: bold; text-decoration: none;">. Also see [[Guest Network]] for more details and methods</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55735&oldid=prev Jeremywh7: grammar/spelling and add sections for better reference 2020-10-10T20:31:34Z <p>grammar/spelling and add sections for better reference</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 20:31, 10 October 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 16:</strong></td> <td colspan="2" align="left"><strong>Line 16:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">For that purpose we will first create VAP (Virtual Access Point) for guests. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">For that purpose we will first create VAP(Virtual Access point) for Guests . </del></td><td>+</td><td style="background: #cfc; font-size: smaller;">On '''Wireless<ins style="color: red; font-weight: bold; text-decoration: none;">''' </ins>-&gt; <ins style="color: red; font-weight: bold; text-decoration: none;">'''</ins>Basic Setup''' tab click Add on Virtual Interfaces section. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">On '''Wireless-&gt;Basic Setup''' tab click Add on Virtual Interfaces section. </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Enable AP isolation''' so that guests can not see each others. AP Isolation drops all traffic between clients connected to the VAP. </td><td> </td><td style="background: #eee; font-size: smaller;">'''Enable AP isolation''' so that guests can not see each others. AP Isolation drops all traffic between clients connected to the VAP. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">If you want secure Guest WiFI its recommended to enable this feature to help mitigate Wi-Fi snooping attacks.</td><td> </td><td style="background: #eee; font-size: smaller;">If you want secure Guest WiFI its recommended to enable this feature to help mitigate Wi-Fi snooping attacks.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Set '''Network Configuration to <del style="color: red; font-weight: bold; text-decoration: none;">Unbridged</del>''', '''Enable NAT''' (so that guest can have internet)<del style="color: red; font-weight: bold; text-decoration: none;">.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">Set '''Network Configuration<ins style="color: red; font-weight: bold; text-decoration: none;">''' </ins>to '<ins style="color: red; font-weight: bold; text-decoration: none;">'Unbridged</ins>'', '''Enable NAT''' (so that guest can have internet)<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins>enable '''Net isolation''' (this option creates a couple of firewall rules that blocks guest to reach your private network). Net isolation works ONLY on unbridged <ins style="color: red; font-weight: bold; text-decoration: none;">interface </ins>on newer builds starting from<ins style="color: red; font-weight: bold; text-decoration: none;">: Broadcom </ins>23020, Atheros 24759<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins>and <ins style="color: red; font-weight: bold; text-decoration: none;">Ralink (</ins>Mediatek) 25934.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">enable '''Net isolation''' (this option creates a couple of firewall rules that blocks guest to reach your private network).</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>AP Isolation = Guests can not hack each other on guest VAP</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Net isolation works ONLY on unbridged <del style="color: red; font-weight: bold; text-decoration: none;">inteface </del>on newer builds<del style="color: red; font-weight: bold; text-decoration: none;">, </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>Net isolation = Guests can not hack your private LAN<ins style="color: red; font-weight: bold; text-decoration: none;">/</ins>WLAN </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">for Broadcom </del>starting from <del style="color: red; font-weight: bold; text-decoration: none;">build </del>23020, <del style="color: red; font-weight: bold; text-decoration: none;">for </del>Atheros <del style="color: red; font-weight: bold; text-decoration: none;">starting from build </del>24759 and <del style="color: red; font-weight: bold; text-decoration: none;">for </del>Mediatek <del style="color: red; font-weight: bold; text-decoration: none;">(Ralink</del>) <del style="color: red; font-weight: bold; text-decoration: none;">units starting from build </del>25934.</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">AP Isolation = Guests can not hack each other on guest VAP<del style="color: red; font-weight: bold; text-decoration: none;">,</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Net isolation = Guests can not hack your private LAN<del style="color: red; font-weight: bold; text-decoration: none;">+</del>WLAN </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) </td><td> </td><td style="background: #eee; font-size: smaller;">'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) </td></tr> <tr><td colspan="2" align="left"><strong>Line 40:</strong></td> <td colspan="2" align="left"><strong>Line 32:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients.</td><td> </td><td style="background: #eee; font-size: smaller;">Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">Next step is to '''enable DHCPd''' for the guest wifi. Go to '''Setup''' -&gt; '''Networking''' and on DHCPd section add another dhcp server for the guest network (click add then choose ath0.1 from drop down menu). Select starting IP for guests, max number of IPs and leasetime. Again click Save and Apply. Wait about 30 sec. and try to connect to Guest WiFi. You should be able to browse Internet and shouldn't be able to reach your private network or see other clients on network discovery. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">====Bandwidth Limiting====</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">You can put your private network on Maximum and Guest to bulk. The bulk class is only allocated remaining bandwidth when the remaining classes are idle. If the pipe is full of traffic from other classes, Bulk will only be allocated 1% of total set limit. So, basically your guests will not affect your private speed. Or you can set hardcoded limits with manual entering. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">With '''interface limiting''' both bridged &amp; unbridged, offers ability to rate or priority limit services or ports/port ranges. This can be exceptionally useful to control bandwidth hogs, regulate hotspots, etc. with an interface limit, a guest user can change their ip address &amp; mac address as much as they want trying to get around qos, abusive users can't bypass ur rules without switching off the interface. Examples:</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"> vlan1 512/512 0 ssl manual </td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*This means all traffic on vlan1 interface (lan ports for some routers, others use eth) is not limited or shaped, and can reach global limits, except ssl traffic being limited to 512kbps both up &amp; down (64KB/s).</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Next step is to '''enable DHCPd''' for the guest wifi. </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Multiple </ins>entries are possible<ins style="color: red; font-weight: bold; text-decoration: none;">:</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Go to '''Setup-&gt;Networking''' and on DHCPd section add another dhcp server for the guest network (click add then choose ath0.1 from drop down menu).</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>ath0 512/512 0 ssl manual </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">select starting IP for guests, max number of IPs and leasetime. Again click Save and Apply. Wait about 30 sec. and try to connect to Guest WiFi.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>ath0 2048/512 0 http manual </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">You should be able to browse Internet and shouldn't be able to reach your private network or see other clients on network discovery. </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>ath0 512/512 0 ftp manual </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*This is as </ins>above <ins style="color: red; font-weight: bold; text-decoration: none;">except </ins>for the ath0 wireless interface<ins style="color: red; font-weight: bold; text-decoration: none;">, and </ins>only the listed services are rate limited. <ins style="color: red; font-weight: bold; text-decoration: none;">You </ins>can <ins style="color: red; font-weight: bold; text-decoration: none;">instead </ins>do priority limits, but rate limiting &amp; prioritizing the same service <ins style="color: red; font-weight: bold; text-decoration: none;">simultaneously </ins>is not supported. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Now, lets do some '''bandwidth limiting'''. You can put your private network on Maximum and Guest to bulk. The bulk class is only allocated remaining bandwidth when the remaining classes are idle. If the pipe is full of traffic from other classes, Bulk will only be allocated 1% of total set limit. So, basically your guests will not affect your private speed. Or you can set hardcoded limits with manual entering. </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">With '''interface limiting''' both bridged &amp; unbridged, offers ability to rate or priority limit services or ports/port ranges. This can be exceptionally useful to control bandwidth hogs, regulate hotspots, etc. with an interface limit, a guest user can change their ip address &amp; mac address as much as they want trying to get around qos, abusive users can't bypass ur rules without switching off the interface. </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">example such as: </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">vlan1 512/512 0 ssl manual </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">^this means all traffic on vlan1 interface (lan ports for some routers, others use eth) is not limited or shaped &amp; goes &quot;up to&quot; global limits, except ssl traffic, being limited to 512kbps both up &amp; down (64KB/s). multiple </del>entries are possible <del style="color: red; font-weight: bold; text-decoration: none;">exampled below. </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ath0 512/512 0 ssl manual </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ath0 2048/512 0 http manual </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ath0 512/512 0 ftp manual </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">^with this, the same applies to what said </del>above<del style="color: red; font-weight: bold; text-decoration: none;">, just </del>for the ath0 wireless interface <del style="color: red; font-weight: bold; text-decoration: none;">&amp; </del>only the listed services are rate limited. <del style="color: red; font-weight: bold; text-decoration: none;">u </del>can <del style="color: red; font-weight: bold; text-decoration: none;">also </del>do priority limits, but rate limiting &amp; prioritizing the same service is not supported<del style="color: red; font-weight: bold; text-decoration: none;">, one or the other. </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">You can use [[Access Restrictions]] to block torrents and some VPNs. Determined user is very hard to block because nowdays you have free SSTP VPN services etc. On cheap routers you can not run Proxy, Squid etc so this is all we have... </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">To do some net abuse filtering we will use OpenDNS</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">'''What </del>is <del style="color: red; font-weight: bold; text-decoration: none;">OpenDNS?'''</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Use [[Access Restrictions]] to block torrents and some VPNs. Determined user </ins>is <ins style="color: red; font-weight: bold; text-decoration: none;">very hard to block because nowdays you have free SSTP VPN services etc. On cheap routers you can not run Proxy, Squid etc so this is all we have... </ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">OpenDNS is a free DNS (Domain Name Server) service which makes internet browsing safer and allegedly faster. </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====</ins>OpenDNS<ins style="color: red; font-weight: bold; text-decoration: none;">====</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">By simply using their DNS servers instead of your ISP's you are automatically protected from their list of Phishing websites. </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">OpenDNS can be used for net abuse filtering. It </ins>is a free DNS (Domain Name Server) service which makes internet browsing safer and allegedly faster. By simply using their DNS servers instead of your ISP's you are automatically protected from their list of Phishing websites. However, in order to restrict a variety of adult website content you will need to create a free account with them, register your IP address and select the categories you want restricted (i.e. sexuality, nude, pornography, lingerie, grotesque, etc...). Since most of us have DHCP assigned WAN IP addresses that change periodically we need to instruct our router to tell OpenDNS what our new IP address is when it changes. See [https://www.dd-wrt.com/wiki/index.php/OpenDNS#section2/ DNS-O-MATIC]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">However, in order to restrict a variety of adult website content you will need to create a free account with them, </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">register your IP address and select the categories you want restricted (i.e. sexuality, nude, pornography, lingerie, grotesque, etc...). </td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Since most of us have DHCP assigned WAN IP addresses that change periodically we need to instruct our router to tell OpenDNS</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">what our new IP address is when it changes. See [https://www.dd-wrt.com/wiki/index.php/OpenDNS#section2/ DNS-O-MATIC]</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Reboot router, clear browser cache, and manually set public dns server in your PC NIC adapter to try to avoid restrictions...</td><td> </td><td style="background: #eee; font-size: smaller;">Reboot router, clear browser cache, and manually set public dns server in your PC NIC adapter to try to avoid restrictions...</td></tr> </table> Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55636&oldid=prev Biant at 18:54, 27 May 2020 2020-05-27T18:54:03Z <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:54, 27 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">{{Languages|Guest WiFi + abuse control for beginners}}</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Biant http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55635&oldid=prev Biant at 18:49, 27 May 2020 2020-05-27T18:49:13Z <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:49, 27 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">{{Languages|Guest_WiFi_%2B_abuse_control_for_beginners&amp;actio}}</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Biant http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55634&oldid=prev Biant at 18:48, 27 May 2020 2020-05-27T18:48:35Z <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:48, 27 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">{{Languages|<del style="color: red; font-weight: bold; text-decoration: none;">Guest_Network</del>}}</td><td>+</td><td style="background: #cfc; font-size: smaller;">{{Languages|<ins style="color: red; font-weight: bold; text-decoration: none;">Guest_WiFi_%2B_abuse_control_for_beginners&amp;actio</ins>}}</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td></tr> </table> Biant http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55633&oldid=prev Biant at 18:47, 27 May 2020 2020-05-27T18:47:41Z <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:47, 27 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">{{Languages|Guest_Network}}</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td><td> </td><td style="background: #eee; font-size: smaller;">Note: This page must be reevaluated. Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard-reset my router.. main lan/wlan was not assigning any dhcp leases anymore, yet second wlan (guest) had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Biant http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55621&oldid=prev Ro0ter: formulated better, added details. had to hard-reset my ac68u. please don`t let this happen to anyone else. 2020-05-20T00:02:12Z <p>formulated better, added details. had to hard-reset my ac68u. please don`t let this happen to anyone else.</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 00:02, 20 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">THIS PAGE MUST BE REEVALUATED, JUST BRICKED MY ROUTER! WHILE TRYING TO MAKE VIRTUAL WLAN WORK (ISSUE https</del>:<del style="color: red; font-weight: bold; text-decoration: none;">//svn</del>.<del style="color: red; font-weight: bold; text-decoration: none;">dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt</del>.<del style="color: red; font-weight: bold; text-decoration: none;">com/ticket</del>/<del style="color: red; font-weight: bold; text-decoration: none;">7035)</del>, <del style="color: red; font-weight: bold; text-decoration: none;">I FOLLOWED THIS TUTORIAL. DOES ANYONE HAVE THE IMPRESSION THAT THE INITIAL DNS SERVER </del>(<del style="color: red; font-weight: bold; text-decoration: none;">FOR MAIN LAN/WLAN</del>) <del style="color: red; font-weight: bold; text-decoration: none;">EXISTS IN THE DHCPD?</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Note</ins>: <ins style="color: red; font-weight: bold; text-decoration: none;">This page must be reevaluated</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">Please, someone with better expertise should verify that the main dhcp server still works correctly after adding the insulated wlan dhcpd server. Had to hard</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">reset my router</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">. main lan</ins>/<ins style="color: red; font-weight: bold; text-decoration: none;">wlan was not assigning any dhcp leases anymore</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">yet second wlan </ins>(<ins style="color: red; font-weight: bold; text-decoration: none;">guest</ins>) <ins style="color: red; font-weight: bold; text-decoration: none;">had internet working perfectly and good dhcp server. no chance to telnet/ssh... locked out... admin interface not reachable from guest network. Thank you.</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Ro0ter http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55620&oldid=prev Ro0ter: needs to be reevaluated! 2020-05-19T23:39:29Z <p>needs to be reevaluated!</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 23:39, 19 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">THIS PAGE MUST BE REEVALUATED, JUST BRICKED MY ROUTER! WHILE TRYING TO MAKE VIRTUAL WLAN WORK (ISSUE https://svn.dd-wrt.com/ticket/7035), I FOLLOWED THIS TUTORIAL. DOES ANYONE HAVE THE IMPRESSION THAT THE INITIAL DNS SERVER (FOR MAIN LAN/WLAN) EXISTS IN THE DHCPD?</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This tutorial is for beginners, and therefore before proceeding make sure you have working reset button</td><td> </td><td style="background: #eee; font-size: smaller;">This tutorial is for beginners, and therefore before proceeding make sure you have working reset button</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling Guest WiFi. </td><td> </td><td style="background: #eee; font-size: smaller;">and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling Guest WiFi. </td></tr> </table> Ro0ter http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55555&oldid=prev Timothy: Spelling errors. 2020-04-14T11:14:53Z <p>Spelling errors.</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 11:14, 14 April 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 3:</strong></td> <td colspan="2" align="left"><strong>Line 3:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:DHCPd.PNG|thumbnail|Adding DHCP for <del style="color: red; font-weight: bold; text-decoration: none;">Guets</del>]]</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:DHCPd.PNG|thumbnail|Adding DHCP for <ins style="color: red; font-weight: bold; text-decoration: none;">Guests</ins>]]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:Interface_limiting.PNG|thumbnail|Hardcoded <del style="color: red; font-weight: bold; text-decoration: none;">limitng intefaces</del>]]</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Interface_limiting.PNG|thumbnail|Hardcoded <ins style="color: red; font-weight: bold; text-decoration: none;">limiting interfaces</ins>]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:max_bulk.PNG|thumbnail|Setting priorities]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:max_bulk.PNG|thumbnail|Setting priorities]]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:OpenDNS1.png|thumbnail|Abuse <del style="color: red; font-weight: bold; text-decoration: none;">controling</del>]]</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:OpenDNS1.png|thumbnail|Abuse <ins style="color: red; font-weight: bold; text-decoration: none;">controlling</ins>]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:OpenDNS2.png|thumbnail|Web content filtering]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:OpenDNS2.png|thumbnail|Web content filtering]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:404.png|thumbnail|Content blocked]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:404.png|thumbnail|Content blocked]]</td></tr> <tr><td colspan="2" align="left"><strong>Line 31:</strong></td> <td colspan="2" align="left"><strong>Line 31:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) </td><td> </td><td style="background: #eee; font-size: smaller;">'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">by intercepting DNS queries and forcing them to use the DNS servers you specify. </td><td> </td><td style="background: #eee; font-size: smaller;">by intercepting DNS queries and forcing them to use the DNS servers you specify. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Enter the IP Address and <del style="color: red; font-weight: bold; text-decoration: none;">Subent </del>Mask of yours newly created interface (ath0.1) 172.16.1.1./255.255.255.0 </td><td>+</td><td style="background: #cfc; font-size: smaller;">Enter the IP Address and <ins style="color: red; font-weight: bold; text-decoration: none;">Subnet </ins>Mask of yours newly created interface (ath0.1) 172.16.1.1./255.255.255.0 </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Click Save and Apply. Wait about 30 sec. for interface ath0.1 to be created. </td><td> </td><td style="background: #eee; font-size: smaller;">Click Save and Apply. Wait about 30 sec. for interface ath0.1 to be created. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients.</td><td> </td><td style="background: #eee; font-size: smaller;">Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients.</td></tr> </table> Timothy http://wiki.dd-wrt.com/wiki/index.php?title=Guest_WiFi_%2B_abuse_control_for_beginners&diff=55347&oldid=prev Mile-Lile at 08:41, 17 January 2020 2020-01-17T08:41:39Z <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 08:41, 17 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">{{Languages|Guest WiFi + abuse control </del>for beginners<del style="color: red; font-weight: bold; text-decoration: none;">}}</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">This tutorial is </ins>for beginners<ins style="color: red; font-weight: bold; text-decoration: none;">, and therefore before proceeding make sure you have working reset button</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">'''''Wiki Path''''': [[Main_Page|DD-WRT Wiki Main]] / [[Tutorials]] / [[Guest_Network]] / '''</del>Guest WiFi <del style="color: red; font-weight: bold; text-decoration: none;">+ abuse control for beginners'''</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling </ins>Guest WiFi<ins style="color: red; font-weight: bold; text-decoration: none;">. </ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*Also see [[Multiple_WLANs|Multiple WLANs]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">----</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">__TOC__</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== Introduction ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">This tutorial </del>for <del style="color: red; font-weight: bold; text-decoration: none;">beginners provides the basics of creating and controlling a &quot;guest&quot; Wi-Fi Virtual Access Point (VAP) that allows guest users access to the public Internet while keeping them out of your private network</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:DHCPd.PNG|thumbnail|Adding DHCP </ins>for <ins style="color: red; font-weight: bold; text-decoration: none;">Guets]]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:Interface_limiting.PNG|thumbnail|Hardcoded limitng intefaces]]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:max_bulk.PNG|thumbnail|Setting priorities]]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:OpenDNS1.png|thumbnail|Abuse controling]]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:OpenDNS2.png|thumbnail|Web content filtering]]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">[[Image:404</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">png|thumbnail|Content blocked]]</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">The following procedures assume the basic setup of the router has been completed and Wi-Fi access to your network is functioning. You should also have determined that the router is capable of simultaneously supporting multiple SSIDs. For a method of checking the revision number of your router's chip and thus its multiple-SSID capability, see https://www.howtogeek.com/153827/how-to-enable-a-guest-access-point-on-your-wireless-network/.&lt;!-- The last sentence in this paragraph should be a footnote, but this ancient version of MediaWiki doesn't support the &lt;ref&gt;&lt;/ref&gt; and &lt;references /&gt; tags. --&gt;</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Before proceeding, make sure your router has a working reset button and you have backed up the router's configuration, so if you should get stuck, you can reset it and restore the configuration. (See the '''Administration &gt;&gt; Backup''' tab in the DD-WRT Control Panel.)</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== Instructions ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">For that purpose we will first create </ins>VAP<ins style="color: red; font-weight: bold; text-decoration: none;">(</ins>Virtual <ins style="color: red; font-weight: bold; text-decoration: none;">Access point</ins>) <ins style="color: red; font-weight: bold; text-decoration: none;">for Guests </ins>. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Image:Guest_VAP.PNG|thumbnail|Creating Guest </del>VAP<del style="color: red; font-weight: bold; text-decoration: none;">]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">In the '''Wireless &gt;&gt; Basic Settings''' tab of the DD-WRT Control Panel, click &quot;Add&quot; in the &quot;</del>Virtual <del style="color: red; font-weight: bold; text-decoration: none;">Interfaces&quot; section. A new Virtual Interface is created, with a title like</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">::&lt;font color=&quot;blue&quot;&gt;'''Virtual Interfaces wl0.1 SSID [dd-wrt_vap] HWAddr [22:AA:4B:36:EC:10]'''&lt;/font&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Note the string after &quot;Virtual Interfaces&quot; (&quot;wl0.1&quot; in this example from a Linksys router using a Broadcom chip</del>)<del style="color: red; font-weight: bold; text-decoration: none;">, as it will help you identify the correct section of later Control Panel pages in which settings will be applied</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Change the </del>Wireless <del style="color: red; font-weight: bold; text-decoration: none;">Network Name (SSID) from the default &quot;dd</del>-<del style="color: red; font-weight: bold; text-decoration: none;">wrt_vap&quot; to how you want it to appear to guest users when they connect to your network, </del>''<del style="color: red; font-weight: bold; text-decoration: none;">e.g</del>.''<del style="color: red; font-weight: bold; text-decoration: none;">, &quot;MyNetwork_guest&quot;</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">On '''</ins>Wireless-<ins style="color: red; font-weight: bold; text-decoration: none;">&gt;Basic Setup</ins>''<ins style="color: red; font-weight: bold; text-decoration: none;">' tab click Add on Virtual Interfaces section</ins>. </td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">''<ins style="color: red; font-weight: bold; text-decoration: none;">'Enable AP isolation''' so that guests can not see each others. AP Isolation drops all traffic between clients connected to the VAP. </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">If you want secure Guest WiFI its recommended to enable this feature to help mitigate Wi-Fi snooping attacks</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Set '''<del style="color: red; font-weight: bold; text-decoration: none;">AP isolation</del>''' <del style="color: red; font-weight: bold; text-decoration: none;">to &quot;</del>Enable<del style="color: red; font-weight: bold; text-decoration: none;">&quot; </del>so that guest <del style="color: red; font-weight: bold; text-decoration: none;">users cannot see each other</del>. <del style="color: red; font-weight: bold; text-decoration: none;">AP Isolation drops all traffic between clients connected </del>to <del style="color: red; font-weight: bold; text-decoration: none;">the VAP</del>. <del style="color: red; font-weight: bold; text-decoration: none;"> This is recommended to prevent wireless snooping attacks via the guest Wi-Fi</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;">Set '''<ins style="color: red; font-weight: bold; text-decoration: none;">Network Configuration to Unbridged''', </ins>'''Enable <ins style="color: red; font-weight: bold; text-decoration: none;">NAT''' (</ins>so that guest <ins style="color: red; font-weight: bold; text-decoration: none;">can have internet)</ins>.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">enable '''Net isolation''' (this option creates a couple of firewall rules that blocks guest </ins>to <ins style="color: red; font-weight: bold; text-decoration: none;">reach your private network)</ins>.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Net isolation works ONLY on unbridged inteface on newer builds, </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">for Broadcom starting from build 23020, for Atheros starting from build 24759 and for Mediatek (Ralink) units starting from build 25934</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">''Click on the Save button at the bottom of the page''. If you do not click the Save button, settings you just made will be lost as you switch from one tab to another.</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Go to the '''Wireless &gt;&gt; Wireless Security''' tab to set the security type and wireless network password. Although the VAP </del>can <del style="color: red; font-weight: bold; text-decoration: none;">function with no encryption and password</del>, <del style="color: red; font-weight: bold; text-decoration: none;">it </del>can <del style="color: red; font-weight: bold; text-decoration: none;">lead to abuse and is thus </del>not <del style="color: red; font-weight: bold; text-decoration: none;">recommended. ''Click on the Save button at the bottom of the page''.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">AP Isolation = Guests </ins>can <ins style="color: red; font-weight: bold; text-decoration: none;">not hack each other on guest VAP</ins>,</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Net isolation = Guests </ins>can not <ins style="color: red; font-weight: bold; text-decoration: none;">hack your private LAN+WLAN </ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Set '''Network Configuration''' to '''Unbridged''', '''Enable NAT''' (gives guests Internet access), and '''enable Net isolation''' (creates firewall rules blocking guests from the private network).</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Net isolation works ''only'' on an unbridged interface on newer builds, ''starting from build'':</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Broadcom (23020), Atheros (24759), MediaTek/Ralink (25934)&lt;br /&gt;AP Isolation = Guests cannot see each other on guest VAP&lt;br /&gt;Net isolation = Guests cannot see your private LAN+WLAN </td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) </td><td> </td><td style="background: #eee; font-size: smaller;">'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">by intercepting DNS queries and forcing them to use the DNS servers you specify. </td><td> </td><td style="background: #eee; font-size: smaller;">by intercepting DNS queries and forcing them to use the DNS servers you specify. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Enter the IP Address and <del style="color: red; font-weight: bold; text-decoration: none;">Subnet </del>Mask<del style="color: red; font-weight: bold; text-decoration: none;">, ''e</del>.<del style="color: red; font-weight: bold; text-decoration: none;">g.'', </del>172.16.1.1 / 255.255.255.0<del style="color: red; font-weight: bold; text-decoration: none;">. (Private networks use IP addresses in the range 172.16.1.1 to 172.16.1.255.) </del>Click <del style="color: red; font-weight: bold; text-decoration: none;">the &quot;</del>Save<del style="color: red; font-weight: bold; text-decoration: none;">&quot; button, then click the &quot;</del>Apply<del style="color: red; font-weight: bold; text-decoration: none;">&quot; button at the bottom of the page</del>. <del style="color: red; font-weight: bold; text-decoration: none;"> </del>Wait <del style="color: red; font-weight: bold; text-decoration: none;">approximately </del>30 <del style="color: red; font-weight: bold; text-decoration: none;">seconds </del>for <del style="color: red; font-weight: bold; text-decoration: none;">the new </del>interface <del style="color: red; font-weight: bold; text-decoration: none;">(''e.g.'', wl0</del>.1<del style="color: red; font-weight: bold; text-decoration: none;">) </del>to be created.</td><td>+</td><td style="background: #cfc; font-size: smaller;">Enter the IP Address and <ins style="color: red; font-weight: bold; text-decoration: none;">Subent </ins>Mask <ins style="color: red; font-weight: bold; text-decoration: none;">of yours newly created interface (ath0</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">1) </ins>172.16.1.1<ins style="color: red; font-weight: bold; text-decoration: none;">.</ins>/255.255.255.0 </td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">Click Save <ins style="color: red; font-weight: bold; text-decoration: none;">and </ins>Apply. Wait <ins style="color: red; font-weight: bold; text-decoration: none;">about </ins>30 <ins style="color: red; font-weight: bold; text-decoration: none;">sec. </ins>for interface <ins style="color: red; font-weight: bold; text-decoration: none;">ath0</ins>.1 to be created<ins style="color: red; font-weight: bold; text-decoration: none;">. </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Although this VAP will now show up in a scan of available Wi-Fi access points using your wireless device, you will not yet be able to connect to it. You must enable DHCP for the clients.</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:DHCPd.PNG|thumbnail|Adding DHCP for Guests]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Next step is to '''enable DHCPd''' for the guest Wi-Fi. </td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Go to '''Setup &gt;&gt; Networking''', in the ''DHCPd'' section add a DHCP server for the new guest network (''Add'' then choose the VLAN (e.g., ath0.1) from drop down menu. Select starting and max number of IP address, plus lease time. Click ''Save'' then ''Apply''. Wait about 30sec and try to connect to Guest Wi-Fi. If not working, power cycle the router. You should be able to browse the Internet, but not reach your private network nor see other clients on network discovery.</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">'''Note:''' For a newer method that uses DNSMasq instead of DHCPd, see [[Guest Network#DNSMasq_method|Guest Network § DNSMasq method]].</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== Quality of Service (QoS) ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Next step is to '''enable DHCPd''' for the guest wifi</ins>. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Image:Interface_limiting</del>.<del style="color: red; font-weight: bold; text-decoration: none;">PNG|thumbnail|Hardcoded limiting interfaces]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Go to </ins>'''<ins style="color: red; font-weight: bold; text-decoration: none;">Setup-&gt;Networking</ins>''' and <ins style="color: red; font-weight: bold; text-decoration: none;">on DHCPd section add another dhcp server for the </ins>guest network <ins style="color: red; font-weight: bold; text-decoration: none;">(click add then choose ath0</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">1 </ins>from <ins style="color: red; font-weight: bold; text-decoration: none;">drop down menu).</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Image:max_bulk.PNG|thumbnail|Setting priorities]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">select starting IP for guests</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">max number </ins>of <ins style="color: red; font-weight: bold; text-decoration: none;">IPs and leasetime</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">Again click Save and Apply. Wait about 30 sec. and try to connect to Guest WiFi.</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">'''<del style="color: red; font-weight: bold; text-decoration: none;">Bandwidth limiting</del>''' <del style="color: red; font-weight: bold; text-decoration: none;">puts the private network on &quot;Maximum&quot; </del>and guest network <del style="color: red; font-weight: bold; text-decoration: none;">to &quot;Bulk&quot;</del>. <del style="color: red; font-weight: bold; text-decoration: none;">The Bulk class is only allocated the remaining bandwidth when other classes are idle. If the pipe is full of traffic </del>from <del style="color: red; font-weight: bold; text-decoration: none;">other classes</del>, <del style="color: red; font-weight: bold; text-decoration: none;">Bulk will only be allocated 1% </del>of <del style="color: red; font-weight: bold; text-decoration: none;">total set limit</del>. <del style="color: red; font-weight: bold; text-decoration: none;">This is so your guests will not affect </del>your private network <del style="color: red; font-weight: bold; text-decoration: none;">speed. Alternatively, you can manually set hard-coded limits</del>. </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">You should be able to browse Internet and shouldn't be able to reach </ins>your private network <ins style="color: red; font-weight: bold; text-decoration: none;">or see other clients on network discovery</ins>. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">'''<del style="color: red; font-weight: bold; text-decoration: none;">Interface </del>limiting'''<del style="color: red; font-weight: bold; text-decoration: none;">, both bridged </del>and <del style="color: red; font-weight: bold; text-decoration: none;">unbridged, offers ability </del>to <del style="color: red; font-weight: bold; text-decoration: none;">rate-limit or priority-limit services or port(s) ranges</del>. <del style="color: red; font-weight: bold; text-decoration: none;">This can be exceptionally useful to control </del>bandwidth <del style="color: red; font-weight: bold; text-decoration: none;">hogs</del>, <del style="color: red; font-weight: bold; text-decoration: none;">regulate hotspots, etc</del>. <del style="color: red; font-weight: bold; text-decoration: none;">with an interface limit</del>, <del style="color: red; font-weight: bold; text-decoration: none;">preventing guest users from circumventing QoS limits by changing IP and/or MAC addresses</del>. <del style="color: red; font-weight: bold; text-decoration: none;">Abusive users </del>can<del style="color: red; font-weight: bold; text-decoration: none;">'t bypass your rules without switching off the interface</del>. </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Now, lets do some </ins>'''<ins style="color: red; font-weight: bold; text-decoration: none;">bandwidth </ins>limiting'''<ins style="color: red; font-weight: bold; text-decoration: none;">. You can put your private network on Maximum </ins>and <ins style="color: red; font-weight: bold; text-decoration: none;">Guest </ins>to <ins style="color: red; font-weight: bold; text-decoration: none;">bulk</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">The bulk class is only allocated remaining </ins>bandwidth <ins style="color: red; font-weight: bold; text-decoration: none;">when the remaining classes are idle. If the pipe is full of traffic from other classes</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">Bulk will only be allocated 1% of total set limit</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">So</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">basically your guests will not affect your private speed</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">Or you </ins>can <ins style="color: red; font-weight: bold; text-decoration: none;">set hardcoded limits with manual entering</ins>. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Example:</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">With '''</ins>interface <ins style="color: red; font-weight: bold; text-decoration: none;">limiting''' both bridged &amp; unbridged</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">offers ability </ins>to <ins style="color: red; font-weight: bold; text-decoration: none;">rate or priority limit services or ports/port ranges. This can be exceptionally useful to control bandwidth hogs</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">regulate hotspots</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">etc</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">with an interface limit</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">a guest user can change their ip address &amp; mac address as much as they want trying </ins>to <ins style="color: red; font-weight: bold; text-decoration: none;">get around qos</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">abusive users can't bypass ur rules without switching off </ins>the interface. </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> vlan1 512/512 0 ssl manual </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">This means all traffic on the vlan1 </del>interface <del style="color: red; font-weight: bold; text-decoration: none;">(lan ports for some routers</del>, <del style="color: red; font-weight: bold; text-decoration: none;">others use eth) is not limited nor shaped, and goes &quot;up </del>to<del style="color: red; font-weight: bold; text-decoration: none;">&quot; global limits</del>, <del style="color: red; font-weight: bold; text-decoration: none;">except SSL traffic</del>, <del style="color: red; font-weight: bold; text-decoration: none;">being limited to 512&amp;nbsp;kbps (64&amp;nbsp;kB/s) both up and down</del>. <del style="color: red; font-weight: bold; text-decoration: none;">Multiple entries are also possible</del>, <del style="color: red; font-weight: bold; text-decoration: none;">for example:</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> ath0 512/512 0 ssl manual </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> ath0 2048/512 0 http manual </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> ath0 512/512 0 ftp manual </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">The same applies </del>to <del style="color: red; font-weight: bold; text-decoration: none;">what was said above</del>, <del style="color: red; font-weight: bold; text-decoration: none;">just for </del>the <del style="color: red; font-weight: bold; text-decoration: none;">ath0 wireless </del>interface <del style="color: red; font-weight: bold; text-decoration: none;">and only the listed services are rate-limited. Priority limits can also be used, but simultaneous rate limiting and prioritizing on the same service is not supported</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== Access Restrictions ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">example such as: </ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Access Restrictions]] can be used to block torrents and some VPNs. A determined user is very hard to block, because now there are free SSTP VPN services, etc. On cheap routers you cannot run Proxy, Squid, etc., so to accomplish network abuse filtering we use '''OpenDNS'''.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">== OpenDNS ==</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:OpenDNS1.png|thumbnail|Abuse control]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:OpenDNS2.png|thumbnail|Web content filtering]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:404.png|thumbnail|Content blocked]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">OpenDNS is a free DNS (Domain Name Server) service to make Internet browsing safer and allegedly faster. By using the OpenDNS DNS server instead of the ISP's DNS server, you are automatically protected from their list of phishing Web sites. However, in order to restrict certain content, ''e.g.'', &quot;adult&quot; sites, you will need to create a free account, register your IP address, and select the categories you want restricted&amp;nbsp;— sexuality, nudity, pornography, lingerie, grotesque, etc. Since most of us have DHCP assigned WAN IP addresses that change periodically, we need to instruct our router to tell OpenDNS the new IP address when it changes. See the [[OpenDNS#OpenDns with DNS-O-Matic for users with a Dynamic IP|DNS-O-Matic]] section of the OpenDNS article. Reboot router, clear browser cache, and manually set public DNS server in your PC NIC adapter to try to avoid restrictions.&lt;br clear=&quot;all&quot; /&gt;</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">== References and notes ==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">vlan1 512</ins>/<ins style="color: red; font-weight: bold; text-decoration: none;">512 0 ssl manual </ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">&lt;references </del>/<del style="color: red; font-weight: bold; text-decoration: none;">&gt;&lt;!-- If </del>this &quot;<del style="color: red; font-weight: bold; text-decoration: none;">&lt;references </del>/<del style="color: red; font-weight: bold; text-decoration: none;">&gt; tag </del>is <del style="color: red; font-weight: bold; text-decoration: none;">visible</del>, <del style="color: red; font-weight: bold; text-decoration: none;">it means </del>the <del style="color: red; font-weight: bold; text-decoration: none;">MediaWiki software used by </del>this <del style="color: red; font-weight: bold; text-decoration: none;">site </del>is <del style="color: red; font-weight: bold; text-decoration: none;">at least 15 years out-</del>of-<del style="color: red; font-weight: bold; text-decoration: none;">date</del>. --<del style="color: red; font-weight: bold; text-decoration: none;">&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">^</ins>this <ins style="color: red; font-weight: bold; text-decoration: none;">means all traffic on vlan1 interface (lan ports for some routers, others use eth) is not limited or shaped &amp; goes </ins>&quot;<ins style="color: red; font-weight: bold; text-decoration: none;">up to&quot; global limits, except ssl traffic, being limited to 512kbps both up &amp; down (64KB</ins>/<ins style="color: red; font-weight: bold; text-decoration: none;">s). multiple entries are possible exampled below. </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ath0 512/512 0 ssl manual </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ath0 2048/512 0 http manual </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ath0 512/512 0 ftp manual </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">^with this, the same applies to what said above, just for the ath0 wireless interface &amp; only the listed services are rate limited. u can also do priority limits, but rate limiting &amp; prioritizing the same service </ins>is <ins style="color: red; font-weight: bold; text-decoration: none;">not supported</ins>, <ins style="color: red; font-weight: bold; text-decoration: none;">one or </ins>the <ins style="color: red; font-weight: bold; text-decoration: none;">other. </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">You can use [[Access Restrictions]] to block torrents and some VPNs. Determined user is very hard to block because nowdays you have free SSTP VPN services etc. On cheap routers you can not run Proxy, Squid etc so </ins>this is <ins style="color: red; font-weight: bold; text-decoration: none;">all we have... </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">To do some net abuse filtering we will use OpenDNS.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''What is OpenDNS?'''</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">OpenDNS is a free DNS (Domain Name Server) service which makes internet browsing safer and allegedly faster. </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">By simply using their DNS servers instead </ins>of <ins style="color: red; font-weight: bold; text-decoration: none;">your ISP's you are automatically protected from their list of Phishing websites. </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">However, in order to restrict a variety of adult website content you will need to create a free account with them, </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">register your IP address and select the categories you want restricted (i.e. sexuality, nude, pornography, lingerie, grotesque, etc...). </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Since most of us have DHCP assigned WAN IP addresses that change periodically we need to instruct our router to tell OpenDNS</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">what our new IP address is when it changes. See [https://www.dd</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">wrt</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">com/wiki/index.php/OpenDNS#section2/ DNS</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">O</ins>-<ins style="color: red; font-weight: bold; text-decoration: none;">MATIC]</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Category:Wlan]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Reboot router, clear browser cache, and manually set public dns server in your PC NIC adapter to try to avoid restrictions...</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Category:Basic tutorials]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> </table> Mile-Lile