Separate LAN and WLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 05:23, 19 October 2008 (edit)
Dydimus (Talk | contribs)
(Step 2: Configure the wireless interface)
← Previous diff
Revision as of 22:13, 5 November 2008 (edit) (undo)
D7342 (Talk | contribs)
(Step 2: Configure the wireless interface)
Next diff →
Line 76: Line 76:
# Set DHCP reservations on the wireless LAN with lease time of 24 hours # Set DHCP reservations on the wireless LAN with lease time of 24 hours
dhcp-host=00:xx:xx:xx:xx:xx,10.0.0.100,24h dhcp-host=00:xx:xx:xx:xx:xx,10.0.0.100,24h
 +</pre>
 +
 +* added by [[User:d7342|d7342]] 5 Nov 2008
 +
 +The wireless interface '''may not''' always be on eth1. On wrt54g v1 its on eth2. To determine the assigned port, take a look at the routing table under Setup -> Advanced Routing -> Show Routing Table. Look for the IP address of the wireless lan you have just unbridged, and see if its eth1 or eth2 that is assigned to it. For example, for the wrt54g v1, the "Additional DNSMasq Options" would be:
 +
 +<pre>
 +interface=eth2
 +dhcp-option=eth2,3,10.0.0.1
 +dhcp-range=eth2,10.0.0.100,10.0.0.200,255.255.255.0,24h
</pre> </pre>

Revision as of 22:13, 5 November 2008

Seperating your LAN and WLAN could be essential towards

Contents

Configuration

Step 1: Remove Wireless interface (eth1) from the LAN bridge (br0)

a) Go to the 'Setup -> VLANs' page. b) At the bottom of the page change the "Wireless" option from "LAN" to "None"

(Above setting doesn't take place until the next reboot which is good because it kills the WLAN. We'll fix that in the next step.)

Step 2: Configure the wireless interface

a1) Go to the 'Administration -> Diagnostics' page.

a2) (v23) Go to the 'Administration -> Command' page.

b) Paste the following command into the text box:

wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0

c) Click the 'Save Startup' button instead of the 'Cmd' button (Don't close this window yet!)

3. Configure the necessary iptables rules:

a) Paste the following into the same text box used above but this time press the 'Save Firewall' button:

 iptables -D INPUT -j DROP;
 iptables -A INPUT -i eth1 -m state --state NEW -j logaccept;
 iptables -A INPUT -j DROP;
 iptables -D FORWARD -j DROP;
 iptables -A FORWARD -i eth1 -m state --state NEW -j ACCEPT;
 iptables -A FORWARD -j DROP;
 iptables  -t nat -I PREROUTING -i eth1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -j DROP

The above iptables rules are overly complex for a couple of reasons:

1. I wanted to keep the organization of the rules as close to the DD-WRT default configuration as possible. This required deleting a few of the default rules, adding ours, then recreating the default rules to keep things in the proper order.

2. I wanted them to work even if you change the wireless subnet (indicated in green above) or if the LAN ports' subnet is something other than 192.168.1.X - basically the rules should work with nearly all configurations unless you've been doing some other advanced stuff with iptables.

Another thing to note is that thanks to the changes BrainSlayer made in recent builds of v23 port forwarding to the WLAN should work without requiring any manual modifications to the iptables rules! (Although I haven't tested this and quite honestly I'm not sure why you'd want to forward ports to the WLAN in a configuration like this...) Port forwarding to the WLAN will NOT work with v22 without manually creating the necessary iptables rules.


Now on to the DHCP issue. With the steps laid out above you will have to configure your wireless clients with static IP addresses. One way to get DHCP working on the wireless subnet is to DISABLE "DNS Masq" on the 'Administration -> Management' page and then issue the following command which will enable DHCP on the wireless interface and lease addresses from 10.0.0.100 to 10.0.0.200:

 dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases
  • In version v23, you disable DNSMasq under 'Administration -> Services'

If you want DHCP to start automatically for the wireless subnet every time the router reboots repeate step two above but use the following command instead:

 wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0;dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases

The problem with this is that you can't use the DNSMasq option for DHCP on your LAN ports... see below:

dns_masq_separate_lan_wan

Note that you CAN still have DHCP enabled for the LAN ports, you just can't use DNSMasq as the DHCP server.

  • added by Nifty, 21/04/2008

With version v24 dnsmasq doesn't work with parameter "-z", so I change last line to

dnsmasq -i eth1 -r /tmp/resolv.dnsmasq -9 -6 /etc/lease_update.sh -X 50 -O 3,10.0.0.1 -F 10.0.0.100,10.0.0.200,255.255.255.0,24h
  • added by Dydimus 07:23, 19 October 2008 (CEST)

You can use the standard DNSMasq setup to serve DHCP on the separate WLAN. For v24, go to the "Services" tab and find the "Additional DNSMasq Options" text area. Continuing with the IP ranges as used above, add the following options (you can omit the comments that start with '#'):

# Enables DHCP on the wireless LAN
interface=eth1
# Set the WLAN default gateway
dhcp-option=eth1,3,10.0.0.1
# Set the DHCP range and default lease time of 24 hours
dhcp-range=eth1,10.0.0.100,10.0.0.200,255.255.255.0,24h
# Set DHCP reservations on the wireless LAN with lease time of 24 hours
dhcp-host=00:xx:xx:xx:xx:xx,10.0.0.100,24h
  • added by d7342 5 Nov 2008

The wireless interface may not always be on eth1. On wrt54g v1 its on eth2. To determine the assigned port, take a look at the routing table under Setup -> Advanced Routing -> Show Routing Table. Look for the IP address of the wireless lan you have just unbridged, and see if its eth1 or eth2 that is assigned to it. For example, for the wrt54g v1, the "Additional DNSMasq Options" would be:

interface=eth2
dhcp-option=eth2,3,10.0.0.1
dhcp-range=eth2,10.0.0.100,10.0.0.200,255.255.255.0,24h

References

link dead: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=9945 Linksys info page












[l_sp_28] No Telecheck Payday Loan Ge Water Softener Bruce Hardwood Floor