Separate LAN and WLAN
From DD-WRT Wiki
Revision as of 20:20, 16 February 2010 (edit) Phuzi0n (Talk | contribs) (Add alternative DHCP method) ← Previous diff |
Revision as of 20:41, 16 February 2010 (edit) (undo) Phuzi0n (Talk | contribs) (→Step 3: Controlling Access - - Add plethora of optional iptables commands) Next diff → |
||
Line 35: | Line 35: | ||
=== Step 3: Controlling Access === | === Step 3: Controlling Access === | ||
- | + | Now that you have your WLAN separated you can start limiting what access it has. Here are several [[iptables]] commands that you can save to your firewall script on the '''Administration -> Commands''' page. These commands are written in the same order that the should appear in your firewall script, changing the order can affect the way that they work. Mix and match them however you like, just be sure to keep them in the order they appear on this page. | |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | If you have any problems with your firewall script, then create a forum thread and be sure to describe in great detail what you're trying to do, what it is actually doing, and post your firewall script. | |
- | 1. I wanted to keep the organization of the rules as close to the DD-WRT default configuration as possible. This required deleting a few of the default rules, adding ours, then recreating the default rules to keep things in the proper order. | ||
- | + | Configure this variable with the real name of the unbridged wireless interface. Always include this. | |
+ | W_IF='''eth0''' | ||
- | Another thing to note is that thanks to the changes BrainSlayer made in recent builds of v23 port forwarding to the WLAN should work without requiring any manual modifications to the iptables rules! (Although I haven't tested this and quite honestly I'm not sure why you'd want to forward ports to the WLAN in a configuration like this...) Port forwarding to the WLAN will NOT work with v22 without manually creating the necessary iptables rules. | ||
+ | Allow WLAN access to br0, the WAN, and any other subnets | ||
+ | iptables -I FORWARD -i $W_IF -m state --state NEW -j ACCEPT | ||
- | Now on to the DHCP issue. With the steps laid out above you will have to configure your wireless clients with static IP addresses. One way to get DHCP working on the wireless subnet is to DISABLE "DNS Masq" on the 'Administration -> Management' page and then issue the following command which will enable DHCP on the wireless interface and lease addresses from 10.0.0.100 to 10.0.0.200: | ||
- | <pre> | ||
- | dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases | ||
- | </pre> | ||
- | * In version v23, you disable DNSMasq under 'Administration -> Services' | ||
- | + | Restrict WLAN from accessing br0 | |
- | + | iptables -I FORWARD -i $W_IF -o br0 -m state --state NEW -j DROP | |
- | | + | |
- | + | ||
- | + | ||
- | [http://img483.imageshack.us/my.php?image=dnsmasq3ba.jpg dns_masq_separate_lan_wan] | ||
- | + | Restrict br0 from accessing WLAN | |
+ | iptables -I FORWARD -i br0 -o $W_IF -m state --state NEW -j DROP | ||
- | * added by Nifty, 21/04/2008 | ||
- | With version v24 dnsmasq doesn't work with parameter "-z", so I change last line to | ||
- | <pre> | ||
- | dnsmasq -i eth1 -r /tmp/resolv.dnsmasq -9 -6 /etc/lease_update.sh -X 50 -O 3,10.0.0.1 -F 10.0.0.100,10.0.0.200,255.255.255.0,24h | ||
- | </pre> | ||
- | + | Restrict WLAN from accessing the WAN | |
- | + | iptables -I FORWARD -i $W_IF -o `nvram get wan_iface` -j DROP | |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | Restrict WLAN access to br0's subnet, but pass traffic through br0 to the internet (for [[Wireless Access Point|WAP]]'s - WAN port disabled) | |
+ | iptables -I FORWARD -i $W_IF -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP | ||
- | The wireless interface '''may not''' always be on eth1. On wrt54g v1 its on eth2. To determine the assigned port, take a look at the routing table under Setup -> Advanced Routing -> Show Routing Table. Look for the IP address of the wireless lan you have just unbridged, and see if its eth1 or eth2 that is assigned to it. For example, for the wrt54g v1, the "Additional DNSMasq Options" would be: | ||
- | + | Enable NAT for traffic being routed out br0 so that the WLAN has connectivity (for [[Wireless Access Point|WAP]]'s - WAN port disabled) | |
- | + | iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr` | |
- | + | ||
- | + | ||
- | + | ||
- | Save, then Apply the changes. | ||
- | + | Restrict WLAN from accessing the router's local sockets (software running on the router) | |
- | + | iptables -I INPUT -i $W_IF -m state --state NEW -j DROP | |
- | + | ||
- | + | ||
- | + | ||
- | ''killall nas'' | ||
- | + | Allow WLAN to access DHCP on the router | |
+ | iptables -I INPUT -i $W_IF -p udp --dport 67 -j ACCEPT | ||
+ | |||
+ | |||
+ | Allow WLAN to access DNS on the router | ||
+ | iptables -I INPUT -i $W_IF -p udp --dport 53 -j ACCEPT | ||
+ | iptables -I INPUT -i $W_IF -p tcp --dport 53 -j ACCEPT | ||
=References= | =References= |
Revision as of 20:41, 16 February 2010
Contents |
Configuration
Step 1: Remove the Wireless Interface from the LAN bridge
- Go to the Wireless -> Basic Settings page.
- Change Network Configuration option from Bridged to Unbridged for whichever wireless interfaces you want separated.
- In the IP Address option that appears, set an IP Address that is in an unused subnet. ie. 192.168.2.1
Note: If you're separating virtual interfaces then use the instructions from the Multiple WLAN Guide.
Step 2: Add DHCP for the unbridged WLAN interface
- Go to the Setup -> Networking page.
- In the Port Setup section find the interface that has the IP Address you assigned in Step 1, this is the real name of the wireless interface.
- Press the Add button in the Multiple DHCP Server section.
- Select the wireless interface's real name in the left drop down menu that appeared. ie. eth0
- Press the Apply Settings button to finish enabling the DHCP server for the wireless interface.
If DHCP is disabled on your main LAN in Basic Setup, then the Multiple DHCP method above will not work. Instead you will need to use Additional DNSMasq Options.
- Go to the Services tab and find the Additional DNSMasq Options text area.
- Adjust the following options to fit your environment (omit the comments starting with '#'):
# Enables DHCP on the wireless LAN interface=eth0 # Set the WLAN default gateway dhcp-option=eth0,3,192.168.2.1 # Set the DHCP range and default lease time of 24 hours dhcp-range=eth0,192.168.2.100,192.168.2.150,255.255.255.0,24h
Make sure that you can connect to the unbridged wireless interface, receive a DHCP lease, and browse the network/internet before you do anything further.
Step 3: Controlling Access
Now that you have your WLAN separated you can start limiting what access it has. Here are several iptables commands that you can save to your firewall script on the Administration -> Commands page. These commands are written in the same order that the should appear in your firewall script, changing the order can affect the way that they work. Mix and match them however you like, just be sure to keep them in the order they appear on this page.
If you have any problems with your firewall script, then create a forum thread and be sure to describe in great detail what you're trying to do, what it is actually doing, and post your firewall script.
Configure this variable with the real name of the unbridged wireless interface. Always include this.
W_IF=eth0
Allow WLAN access to br0, the WAN, and any other subnets
iptables -I FORWARD -i $W_IF -m state --state NEW -j ACCEPT
Restrict WLAN from accessing br0
iptables -I FORWARD -i $W_IF -o br0 -m state --state NEW -j DROP
Restrict br0 from accessing WLAN
iptables -I FORWARD -i br0 -o $W_IF -m state --state NEW -j DROP
Restrict WLAN from accessing the WAN
iptables -I FORWARD -i $W_IF -o `nvram get wan_iface` -j DROP
Restrict WLAN access to br0's subnet, but pass traffic through br0 to the internet (for WAP's - WAN port disabled)
iptables -I FORWARD -i $W_IF -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
Enable NAT for traffic being routed out br0 so that the WLAN has connectivity (for WAP's - WAN port disabled)
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
Restrict WLAN from accessing the router's local sockets (software running on the router)
iptables -I INPUT -i $W_IF -m state --state NEW -j DROP
Allow WLAN to access DHCP on the router
iptables -I INPUT -i $W_IF -p udp --dport 67 -j ACCEPT
Allow WLAN to access DNS on the router
iptables -I INPUT -i $W_IF -p udp --dport 53 -j ACCEPT iptables -I INPUT -i $W_IF -p tcp --dport 53 -j ACCEPT
References
link dead: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=9945 Linksys info page