Multiple WLANs

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 02:35, 1 December 2009 (edit)
Phuzi0n (Talk | contribs)
(Broadcom Based Hardware)
← Previous diff
Revision as of 00:10, 2 December 2009 (edit) (undo)
Phuzi0n (Talk | contribs)
(Restricting Access)
Next diff →
Line 79: Line 79:
=Restricting Access= =Restricting Access=
-Wait until tomorrow...+Now that you have your WLAN's working you can start limiting what access they have. Here are several [[iptables]] commands that you can save to your firewall script on the Administration -> Commands page. These commands are written in the same order that the should appear in your firewall script, changing the order can affect the way that they work. Mix and match them however you like, just be sure to keep them in the order they appear on this page.
 +
 +Restrict br1 from accessing br0
 + iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
 +
 +
 +Restrict br0 from accessing br1
 + iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
 +
 +
 +Restrict br1 from accessing the internet
 + iptables -I FORWARD -i br1 -o `nvram get wan_iface` -j DROP
 +
 +
 +Restrict br1 from accessing the router's local sockets (software running on the router)
 + iptables -I INPUT -i br1 -m state --state NEW -j DROP
 +
 +
 +Allow br1 to access DHCP on the router
 + iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
 +
 +
 +Allow br1 to access DNS on the router
 + iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
 + iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
=External Links= =External Links=

Revision as of 00:10, 2 December 2009

Contents

Introduction

This guide teaches you how to broadcast multiple WLAN SSID's using virtual interfaces. You can have different encryption settings for each WLAN and you can restrict what they have access to.


Preparation

As with all configuration changes, it is best to connect your router with an Ethernet cable so that you do not get disconnected or locked out of your router while configuring it.

Broadcom Based Hardware

Very early Broadcom based routers have radios that do not support or only partially support multiple WLAN's. You will need to telnet to the router and run this command on the router:


nvram get wl0_corerev

Image:Corerev_test.png


  • If the number is 4 or less then the router is too old.
  • If it is between 5 and 8 then it is capable of multiple SSID's but not multiple BSSID's, which means the wireless interfaces will all have the same MAC address so some devices might not recognize both WLAN's, and you will need to use a build that has a VINT wireless driver.
  • If it is 9 or above then the router fully supports multiple WLAN's.

Configuration

GUI Method

Basic Wireless Settings

Use a web browser to connect to your router's web GUI. Navigate to the Wireless -> Basic Settings page and under the Virtual Interfaces section press the "Add" button to add a new virtual interface. Leave the Network Configuration set to "Bridged" for all interfaces regardless of whether you want to bridge them or not because "Unbridged" has unresolved bugs at the time this was written (svn 13312). To get a working unbridged interface we will actually assign it to its own bridge later on. You may change any of the other settings to your liking.


Image:MultiWLAN_wireless_basicsettings.png


Press the "Apply Settings" button, wait 1 minute, and then you should be able to see and connect to your new WLAN SSID. Make sure that you can connect to it, receive a DHCP lease, and browse the network/internet before you do anything further.

Note: If you're using a Broadcom VINT build then some devices may have problems connecting. Often it is just that they will only display one SSID being broadcast but they will still be able to connect if you manually create a profile for the virtual interface's SSID. Two of my old 802.11g adapters can not see the VAP's SSID but can still connect with manual profiles while my 802.11n adapter can see both SSID's being broadcast.

Encryption

Configure whatever encryption you desire on the Wireless Security page. For instance, you may want WPA2-AES for your main interface to have maximum security but use WEP or no encryption on the virtual interface to allow other to connect. You may also use the same encryption type in order to have different passwords for different people.

Note: Firmware builds prior to 12548 are known to have trouble with using different encryption settings.


Image:MultiWLAN_wireless_encryption.png


Press the "Apply Settings" button, wait 1 minute, and then you should be able to see and connect to both WLAN SSID's using their new encryption settings. Make sure that you can connect to both SSID's, receive a DHCP lease, and browse the network/internet before you do anything further.

At this point you may stop if you want to allow everything to communicate together. If you are mixing strong encryption for your main network with weak encryption or none at all on the virtual interface then it is advisable to follow the steps below to separate the interfaces so that the virtual interface is restricted from communicating with your main network.

Separating the WLAN's

Navigate to the Setup -> Networking page. Press the "Add" button in the Create Bridge section and type "br1" into the blank input box that is on the left side of all the options that just appeared. Press the "Apply Settings" button at the bottom of the page and new input boxes will appear to specify the IP address for the new bridge.

This new bridge needs to have an address that is in a different subnet than your main LAN. By default the main router LAN address is 192.168.1.1 netmask 255.255.255.0 so we will use 192.168.2.1 netmask 255.255.255.0 for the br1 bridge interface. Press the "Apply Settings" button again so that the IP address will be assigned to the br1 interface before you continue.


Image:MultiWLAN_create_bridge.png


Press the "Add" button in the Assign to Bridge section. Select "br1" in the left drop down menu that appeared and select "wl0.1" in the other. Press the "Apply Settings" button and the virtual wireless interface wl0.1 will now be moved from br0 to br1.


Image:MultiWLAN_assign_bridge.png


Press the "Add" button in the Multiple DHCP Server section. Select "br1" in the left drop down menu that appeared. Press the "Apply Settings" button to finish enabling the DHCP server for the br1 interface.

Image:MultiWLAN_add_dhcp.png


You should now be able to connect to VAP's SSID and receive a DHCP lease with an IP address that is in the 192.168.2.0/24 subnet. Make sure that you can connect to it, receive a DHCP lease, and browse the network/internet before you do anything further.


Restricting Access

Now that you have your WLAN's working you can start limiting what access they have. Here are several iptables commands that you can save to your firewall script on the Administration -> Commands page. These commands are written in the same order that the should appear in your firewall script, changing the order can affect the way that they work. Mix and match them however you like, just be sure to keep them in the order they appear on this page.


Restrict br1 from accessing br0

iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP


Restrict br0 from accessing br1

iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP


Restrict br1 from accessing the internet

iptables -I FORWARD -i br1 -o `nvram get wan_iface` -j DROP


Restrict br1 from accessing the router's local sockets (software running on the router)

iptables -I INPUT -i br1 -m state --state NEW -j DROP


Allow br1 to access DHCP on the router

iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT


Allow br1 to access DNS on the router

iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

External Links

http://www.pennock.nl/dd-wrt/Multiple_BSSIDs.html