Guest WiFi + abuse control for beginners

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 16:22, 8 January 2020 (edit)
Jeremywh7 (Talk | contribs)
(add links)
← Previous diff
Revision as of 08:41, 17 January 2020 (edit) (undo)
Mile-Lile (Talk | contribs)

Next diff →
(One intermediate revision not shown.)
Line 1: Line 1:
-{{Languages|Guest WiFi + abuse control for beginners}}+This tutorial is for beginners, and therefore before proceeding make sure you have working reset button
-'''''Wiki Path''''': [[Main_Page|DD-WRT Wiki Main]] / [[Tutorials]] / [[Guest Network]] / '''Guest WiFi + abuse control for beginners'''+and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling Guest WiFi.
-*Also see [[Multiple WLANs]]+
-----+
-__TOC__+
-==Introduction==+[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]
-This tutorial provides the basics to create a "guest" wireless Virtual Access Point (VAP) to provide Internet access, but prevent private network access to guest users.+[[Image:DHCPd.PNG|thumbnail|Adding DHCP for Guets]]
 +[[Image:Interface_limiting.PNG|thumbnail|Hardcoded limitng intefaces]]
 +[[Image:max_bulk.PNG|thumbnail|Setting priorities]]
 +[[Image:OpenDNS1.png|thumbnail|Abuse controling]]
 +[[Image:OpenDNS2.png|thumbnail|Web content filtering]]
 +[[Image:404.png|thumbnail|Content blocked]]
-Before proceeding, ensure the router has functional wireless and Internet access, with a working reset button. Backup the router configuration ('''Administration >> Backup''' tab in the DD-WRT Control Panel) in case of issues. 
-'''Note:''' very old Broadcom SoC's may be incapable of multiple simultaneous SSIDs, so check the chip revision ([[Corerev|''corerev'']]): 
-*0-4 '''does not''' support multiple SSIDs (regardless of unique identifiers) 
-*5-8 supports multiple SSIDs (''but not with unique identifiers'') 
-*9+ supports multiple SSIDs (with unique identifiers) 
-''Reference:'' [https://www.howtogeek.com/153827/how-to-enable-a-guest-access-point-on-your-wireless-network/ howtogeek.com] 
-==Instructions==+For that purpose we will first create VAP(Virtual Access point) for Guests .
-[[Image:Guest_VAP.PNG|thumbnail|Creating Guest VAP]]+
-Go to '''Wireless->Basic Settings''' in the DD-WRT Control Panel and click "Add" in the "Virtual Interfaces" section. A new Virtual Interface is created, with a title like:+
-::<font color="blue">'''Virtual Interfaces wl0.1 SSID [dd-wrt_vap] HWAddr [22:AA:4B:36:EC:10]'''</font>+
-Note the string after "Virtual Interfaces" (e.g. "wl0.1" is from a Broadcom device) to help identify the correct section of later Control Panel pages to apply settings.+
-Change the Wireless Network Name (SSID) from the default "dd-wrt_vap" to how you want it to appear to guest users when they connect to your network, ''e.g.'', "MyNetwork_guest".+On '''Wireless->Basic Setup''' tab click Add on Virtual Interfaces section.
 +'''Enable AP isolation''' so that guests can not see each others. AP Isolation drops all traffic between clients connected to the VAP.
 +If you want secure Guest WiFI its recommended to enable this feature to help mitigate Wi-Fi snooping attacks.
-Enable ''AP isolation'' so guest users cannot see each other. AP Isolation drops all traffic between clients connected to the VAP. This is recommended to prevent wireless snooping attacks via the guest Wi-Fi. '''Click on the ''Save'' button at the bottom of the page''' otherwise these settings will be lost when switching tabs.+Set '''Network Configuration to Unbridged''', '''Enable NAT''' (so that guest can have internet).
 +enable '''Net isolation''' (this option creates a couple of firewall rules that blocks guest to reach your private network).
 +Net isolation works ONLY on unbridged inteface on newer builds,
 +for Broadcom starting from build 23020, for Atheros starting from build 24759 and for Mediatek (Ralink) units starting from build 25934.
-Go to '''Wireless->Wireless Security''' to set the security type and wireless network password. Although the VAP can function with no encryption and password, it can lead to abuse and is thus not recommended. '''Click ''Save'' again.''' 
-Set '''Network Configuration''' to '''Unbridged''', '''Enable NAT''' (gives guests Internet access), and enable '''Net Isolation''' (creates firewall rules blocking guests from the private network). Net isolation ''only'' works on an unbridged interface with newer builds, ''starting from build'': 23020 (Broadcom), 24759 (Atheros), 25934 (MediaTek/Ralink)<br>+AP Isolation = Guests can not hack each other on guest VAP,
-*AP Isolation = Guests cannot see each other on guest VAP<br>+
-*Net isolation = Guests cannot see your private LAN+WLAN +Net isolation = Guests can not hack your private LAN+WLAN
 + 
'''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) '''Enable Forced DNS Redirection''' and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering)
by intercepting DNS queries and forcing them to use the DNS servers you specify. by intercepting DNS queries and forcing them to use the DNS servers you specify.
 +Enter the IP Address and Subent Mask of yours newly created interface (ath0.1) 172.16.1.1./255.255.255.0
 +Click Save and Apply. Wait about 30 sec. for interface ath0.1 to be created.
 +Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients.
-Enter the '''IP Address''' and '''Subnet Mask''' ''e.g. 172.16.1.1 / 255.255.255.0'' (see [https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses Private Networks]). '''Click ''Apply''''' for the new interface to be created ''e.g. wl0.1''. This VAP will now be visible in a wireless scan, but DHCP is required for clients to connect. 
-[[Image:DHCPd.PNG|thumbnail|Adding DHCP for Guests]] 
-Go to '''Setup >> Networking''' in the ''DHCPd'' section and ''Add'' a DHCP server for the new guest network then choose the VLAN (''e.g. ath0.1'') from drop down menu. Select starting and max number of IP address, plus lease time. '''Click ''Apply''''' and wait about 30sec and connecting to Guest Wi-Fi. If not working, power cycle the router. The Internet should be accessible but not the private network nor other clients on network discovery. 
-'''Note:''' There is a newer method [[Guest Network#DNSMasq_method|using DNSmasq]] versus DHCPd. 
-==Quality of Service (QoS)==+Next step is to '''enable DHCPd''' for the guest wifi.
-[[Image:Interface_limiting.PNG|thumbnail|Hardcoded limiting interfaces]]+Go to '''Setup->Networking''' and on DHCPd section add another dhcp server for the guest network (click add then choose ath0.1 from drop down menu).
-[[Image:max_bulk.PNG|thumbnail|Setting priorities]]+select starting IP for guests, max number of IPs and leasetime. Again click Save and Apply. Wait about 30 sec. and try to connect to Guest WiFi.
-'''Bandwidth limiting''' puts the private network on "Maximum" and guest network to "Bulk". The Bulk class is only allocated the remaining bandwidth when other classes are idle. If the pipe is full of traffic from other classes, Bulk will only be allocated 1% of total set limit. This is so your guests will not affect your private network speed. Alternatively, you can manually set hard-coded limits. +You should be able to browse Internet and shouldn't be able to reach your private network or see other clients on network discovery.
-'''Interface limiting''', both bridged and unbridged, offers ability to rate-limit or priority-limit services or port(s) ranges. This can be exceptionally useful to control bandwidth hogs, regulate hotspots, etc. with an interface limit, preventing guest users from circumventing QoS limits by changing IP and/or MAC addresses. Abusive users can't bypass your rules without switching off the interface. +Now, lets do some '''bandwidth limiting'''. You can put your private network on Maximum and Guest to bulk. The bulk class is only allocated remaining bandwidth when the remaining classes are idle. If the pipe is full of traffic from other classes, Bulk will only be allocated 1% of total set limit. So, basically your guests will not affect your private speed. Or you can set hardcoded limits with manual entering.
-Example:+With '''interface limiting''' both bridged & unbridged, offers ability to rate or priority limit services or ports/port ranges. This can be exceptionally useful to control bandwidth hogs, regulate hotspots, etc. with an interface limit, a guest user can change their ip address & mac address as much as they want trying to get around qos, abusive users can't bypass ur rules without switching off the interface.
- vlan1 512/512 0 ssl manual +
-This means all traffic on the vlan1 interface (lan ports for some routers, others use eth) is not limited nor shaped, and goes "up to" global limits, except SSL traffic, being limited to 512&nbsp;kbps (64&nbsp;kB/s) both up and down. Multiple entries are also possible, for example:+
- ath0 512/512 0 ssl manual +
- ath0 2048/512 0 http manual +
- ath0 512/512 0 ftp manual +
-The same applies to what was said above, just for the ath0 wireless interface and only the listed services are rate-limited. Priority limits can also be used, but simultaneous rate limiting and prioritizing on the same service is not supported.+
-==Access Restrictions==+example such as:
-[[Access Restrictions]] can be used to block torrents and some VPNs. A determined user is very hard to block, because now there are free SSTP VPN services, etc. Cheap consumer routers may not be able to run Proxy, Squid, etc., so to accomplish network abuse filtering '''OpenDNS''' can be used.+
-Wikipedia has a [https://en.wikipedia.org/wiki/Public_recursive_name_server '''comparison of public DNS resolver services'''] including protocol support and filtering capabilities. 
-==OpenDNS==+vlan1 512/512 0 ssl manual
-[[Image:OpenDNS1.png|thumbnail|Abuse control]]+ 
-[[Image:OpenDNS2.png|thumbnail|Web content filtering]]+^this means all traffic on vlan1 interface (lan ports for some routers, others use eth) is not limited or shaped & goes "up to" global limits, except ssl traffic, being limited to 512kbps both up & down (64KB/s). multiple entries are possible exampled below.
-[[Image:404.png|thumbnail|Content blocked]]+ 
-OpenDNS is a free DNS (Domain Name Server) service to make Internet browsing safer and allegedly faster. By using the OpenDNS DNS server instead of the ISP's DNS server, you are automatically protected from their list of phishing Web sites. However, in order to restrict certain content, ''e.g.'', "adult" sites, you will need to create a free account, register your IP address, and select the categories you want restricted&nbsp;— sexuality, nudity, pornography, lingerie, grotesque, etc. Since most of us have DHCP assigned WAN IP addresses that change periodically, we need to instruct our router to tell OpenDNS the new IP address when it changes. See the [[OpenDNS#OpenDns with DNS-O-Matic for users with a Dynamic IP|DNS-O-Matic]] section of the OpenDNS article. Reboot router, clear browser cache, and manually set public DNS server in your PC NIC adapter to try to avoid restrictions.<br clear="all" />+ 
 +ath0 512/512 0 ssl manual
 + 
 +ath0 2048/512 0 http manual
 + 
 +ath0 512/512 0 ftp manual
 + 
 + 
 +^with this, the same applies to what said above, just for the ath0 wireless interface & only the listed services are rate limited. u can also do priority limits, but rate limiting & prioritizing the same service is not supported, one or the other.
 + 
 + 
 +You can use [[Access Restrictions]] to block torrents and some VPNs. Determined user is very hard to block because nowdays you have free SSTP VPN services etc. On cheap routers you can not run Proxy, Squid etc so this is all we have...
 + 
 +To do some net abuse filtering we will use OpenDNS.
 + 
 +'''What is OpenDNS?'''
 +OpenDNS is a free DNS (Domain Name Server) service which makes internet browsing safer and allegedly faster.
 +By simply using their DNS servers instead of your ISP's you are automatically protected from their list of Phishing websites.
 +However, in order to restrict a variety of adult website content you will need to create a free account with them,
 +register your IP address and select the categories you want restricted (i.e. sexuality, nude, pornography, lingerie, grotesque, etc...).
 +Since most of us have DHCP assigned WAN IP addresses that change periodically we need to instruct our router to tell OpenDNS
 +what our new IP address is when it changes. See [https://www.dd-wrt.com/wiki/index.php/OpenDNS#section2/ DNS-O-MATIC]
-[[Category:Wlan]]+Reboot router, clear browser cache, and manually set public dns server in your PC NIC adapter to try to avoid restrictions...
-[[Category:Basic tutorials]]+

Revision as of 08:41, 17 January 2020

This tutorial is for beginners, and therefore before proceeding make sure you have working reset button and have backed up you configuration (so you can reset your router and restore configuration if you stuck somewhere). This guide will show you the basics of creating and controlling Guest WiFi.

Creating Guest VAP
Creating Guest VAP
Adding DHCP for Guets
Adding DHCP for Guets
Hardcoded limitng intefaces
Hardcoded limitng intefaces
Setting priorities
Setting priorities
Abuse controling
Abuse controling
Web content filtering
Web content filtering
Content blocked
Content blocked


For that purpose we will first create VAP(Virtual Access point) for Guests .

On Wireless->Basic Setup tab click Add on Virtual Interfaces section. Enable AP isolation so that guests can not see each others. AP Isolation drops all traffic between clients connected to the VAP. If you want secure Guest WiFI its recommended to enable this feature to help mitigate Wi-Fi snooping attacks.

Set Network Configuration to Unbridged, Enable NAT (so that guest can have internet). enable Net isolation (this option creates a couple of firewall rules that blocks guest to reach your private network). Net isolation works ONLY on unbridged inteface on newer builds, for Broadcom starting from build 23020, for Atheros starting from build 24759 and for Mediatek (Ralink) units starting from build 25934.


AP Isolation = Guests can not hack each other on guest VAP,

Net isolation = Guests can not hack your private LAN+WLAN


Enable Forced DNS Redirection and enter the OpenDNS server IP (208.67.222.222) in the Optional DNS target field. This will prevent users from using their own DNS servers (and hence get around content filtering) by intercepting DNS queries and forcing them to use the DNS servers you specify. Enter the IP Address and Subent Mask of yours newly created interface (ath0.1) 172.16.1.1./255.255.255.0 Click Save and Apply. Wait about 30 sec. for interface ath0.1 to be created. Note: You still wont be able to connect to this Guest VAP. You must enable DHCP for the clients.



Next step is to enable DHCPd for the guest wifi. Go to Setup->Networking and on DHCPd section add another dhcp server for the guest network (click add then choose ath0.1 from drop down menu). select starting IP for guests, max number of IPs and leasetime. Again click Save and Apply. Wait about 30 sec. and try to connect to Guest WiFi. You should be able to browse Internet and shouldn't be able to reach your private network or see other clients on network discovery.

Now, lets do some bandwidth limiting. You can put your private network on Maximum and Guest to bulk. The bulk class is only allocated remaining bandwidth when the remaining classes are idle. If the pipe is full of traffic from other classes, Bulk will only be allocated 1% of total set limit. So, basically your guests will not affect your private speed. Or you can set hardcoded limits with manual entering.

With interface limiting both bridged & unbridged, offers ability to rate or priority limit services or ports/port ranges. This can be exceptionally useful to control bandwidth hogs, regulate hotspots, etc. with an interface limit, a guest user can change their ip address & mac address as much as they want trying to get around qos, abusive users can't bypass ur rules without switching off the interface.

example such as:


vlan1 512/512 0 ssl manual

^this means all traffic on vlan1 interface (lan ports for some routers, others use eth) is not limited or shaped & goes "up to" global limits, except ssl traffic, being limited to 512kbps both up & down (64KB/s). multiple entries are possible exampled below.


ath0 512/512 0 ssl manual

ath0 2048/512 0 http manual

ath0 512/512 0 ftp manual


^with this, the same applies to what said above, just for the ath0 wireless interface & only the listed services are rate limited. u can also do priority limits, but rate limiting & prioritizing the same service is not supported, one or the other.


You can use Access Restrictions to block torrents and some VPNs. Determined user is very hard to block because nowdays you have free SSTP VPN services etc. On cheap routers you can not run Proxy, Squid etc so this is all we have...

To do some net abuse filtering we will use OpenDNS.

What is OpenDNS?

OpenDNS is a free DNS (Domain Name Server) service which makes internet browsing safer and allegedly faster. By simply using their DNS servers instead of your ISP's you are automatically protected from their list of Phishing websites. However, in order to restrict a variety of adult website content you will need to create a free account with them, register your IP address and select the categories you want restricted (i.e. sexuality, nude, pornography, lingerie, grotesque, etc...). Since most of us have DHCP assigned WAN IP addresses that change periodically we need to instruct our router to tell OpenDNS what our new IP address is when it changes. See DNS-O-MATIC

Reboot router, clear browser cache, and manually set public dns server in your PC NIC adapter to try to avoid restrictions...