Separate LAN and WLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:04, 16 February 2010 (edit)
Phuzi0n (Talk | contribs)
m (Step 2: Add DHCP for the unbridged WLAN interface)
← Previous diff
Revision as of 20:05, 16 February 2010 (edit) (undo)
Phuzi0n (Talk | contribs)
m (Step 1: Remove the Wireless Interface from the LAN bridge)
Next diff →
Line 2: Line 2:
=== Step 1: Remove the Wireless Interface from the LAN bridge === === Step 1: Remove the Wireless Interface from the LAN bridge ===
-# Go to the "'''Wireless -> Basic Settings'''" page.+# Go to the '''Wireless -> Basic Settings''' page.
-# Change "'''Network Configuration'''" option from "'''Bridged'''" to "'''Unbridged'''" for whichever wireless interfaces you want separated.+# Change '''Network Configuration''' option from '''Bridged''' to '''Unbridged''' for whichever wireless interfaces you want separated.
-# In the "'''IP Address'''" option that appears, set an IP Address that is in an unused subnet. ie. "'''192.168.2.1'''"+# In the '''IP Address''' option that appears, set an IP Address that is in an unused subnet. ie. '''192.168.2.1'''
'''Note:''' If you're separating virtual interfaces then use the instructions from the [[Multiple_WLANs | Multiple WLAN Guide]]. '''Note:''' If you're separating virtual interfaces then use the instructions from the [[Multiple_WLANs | Multiple WLAN Guide]].

Revision as of 20:05, 16 February 2010

Contents

Configuration

Step 1: Remove the Wireless Interface from the LAN bridge

  1. Go to the Wireless -> Basic Settings page.
  2. Change Network Configuration option from Bridged to Unbridged for whichever wireless interfaces you want separated.
  3. In the IP Address option that appears, set an IP Address that is in an unused subnet. ie. 192.168.2.1

Note: If you're separating virtual interfaces then use the instructions from the Multiple WLAN Guide.

Step 2: Add DHCP for the unbridged WLAN interface

  1. Go to the Setup -> Networking page.
  2. In the Port Setup section find the interface that has the IP Address you assigned in Step 1, this is the real name of the wireless interface.
  3. Press the Add button in the Multiple DHCP Server section.
  4. Select the wireless interface's real name in the left drop down menu that appeared. ie. eth0
  5. Press the Apply Settings button to finish enabling the DHCP server for the wireless interface.


Make sure that you can connect to the unbridged wireless interface, receive a DHCP lease, and browse the network/internet before you do anything further.

Step 3: Controlling Access

a) Paste the following into the same text box used above but this time press the 'Save Firewall' button:

 iptables -D INPUT -j DROP;
 iptables -A INPUT -i eth1 -m state --state NEW -j logaccept;
 iptables -A INPUT -j DROP;
 iptables -D FORWARD -j DROP;
 iptables -A FORWARD -i eth1 -m state --state NEW -j ACCEPT;
 iptables -A FORWARD -j DROP;
 iptables  -t nat -I PREROUTING -i eth1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -j DROP

The above iptables rules are overly complex for a couple of reasons:

1. I wanted to keep the organization of the rules as close to the DD-WRT default configuration as possible. This required deleting a few of the default rules, adding ours, then recreating the default rules to keep things in the proper order.

2. I wanted them to work even if you change the wireless subnet (10.0.0.1 in the above example) or if the LAN ports' subnet is something other than 192.168.1.X - basically the rules should work with nearly all configurations unless you've been doing some other advanced stuff with iptables.

Another thing to note is that thanks to the changes BrainSlayer made in recent builds of v23 port forwarding to the WLAN should work without requiring any manual modifications to the iptables rules! (Although I haven't tested this and quite honestly I'm not sure why you'd want to forward ports to the WLAN in a configuration like this...) Port forwarding to the WLAN will NOT work with v22 without manually creating the necessary iptables rules.


Now on to the DHCP issue. With the steps laid out above you will have to configure your wireless clients with static IP addresses. One way to get DHCP working on the wireless subnet is to DISABLE "DNS Masq" on the 'Administration -> Management' page and then issue the following command which will enable DHCP on the wireless interface and lease addresses from 10.0.0.100 to 10.0.0.200:

 dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases
  • In version v23, you disable DNSMasq under 'Administration -> Services'

If you want DHCP to start automatically for the wireless subnet every time the router reboots repeate step two above but use the following command instead:

 wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0;dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases

The problem with this is that you can't use the DNSMasq option for DHCP on your LAN ports... see below:

dns_masq_separate_lan_wan

Note that you CAN still have DHCP enabled for the LAN ports, you just can't use DNSMasq as the DHCP server.

  • added by Nifty, 21/04/2008

With version v24 dnsmasq doesn't work with parameter "-z", so I change last line to

dnsmasq -i eth1 -r /tmp/resolv.dnsmasq -9 -6 /etc/lease_update.sh -X 50 -O 3,10.0.0.1 -F 10.0.0.100,10.0.0.200,255.255.255.0,24h
  • added by Dydimus 07:23, 19 October 2008 (CEST)

You can use the standard DNSMasq setup to serve DHCP on the separate WLAN. For v24, go to the "Services" tab and find the "Additional DNSMasq Options" text area. Continuing with the IP ranges as used above, add the following options (you can omit the comments that start with '#'):

# Enables DHCP on the wireless LAN
interface=eth1
# Set the WLAN default gateway
dhcp-option=eth1,3,10.0.0.1
# Set the DHCP range and default lease time of 24 hours
dhcp-range=eth1,10.0.0.100,10.0.0.200,255.255.255.0,24h
# Set DHCP reservations on the wireless LAN with lease time of 24 hours
dhcp-host=00:xx:xx:xx:xx:xx,10.0.0.100,24h


  • added by d7342 5 Nov 2008

The wireless interface may not always be on eth1. On wrt54g v1 its on eth2. To determine the assigned port, take a look at the routing table under Setup -> Advanced Routing -> Show Routing Table. Look for the IP address of the wireless lan you have just unbridged, and see if its eth1 or eth2 that is assigned to it. For example, for the wrt54g v1, the "Additional DNSMasq Options" would be:

interface=eth2
dhcp-option=eth2,3,10.0.0.1
dhcp-range=eth2,10.0.0.100,10.0.0.200,255.255.255.0,24h

Save, then Apply the changes.

--Woodoo 15:58, 26 November 2009 (CET) With settings above, wireless clients may have problems with not being able to acquire IP from DHCP in secured network . Josevolf [1] found that there was a problem with the nas authentication service. To solve the problem, just drop a string at the beginning of start up command list:

killall nas

nas -P /tmp/nas.wl0lan.pid -H 34954 -l eth1 -i eth1 -A -m 132 -k yourpsk -s yourssid -w 6 -g 3600 &

References

link dead: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=9945 Linksys info page












[l_sp_28] No Telecheck Payday Loan Ge Water Softener Bruce Hardwood Floor