Separate LAN and WLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 13:12, 30 April 2010 (edit)
Glenn (Talk | contribs)
(+cats)
← Previous diff
Revision as of 09:23, 15 May 2010 (edit) (undo)
Phuzi0n (Talk | contribs)

Next diff →
Line 4: Line 4:
'''Note:''' If you're separating virtual interfaces then use the instructions from the [[Multiple_WLANs | Multiple WLAN Guide]]. '''Note:''' If you're separating virtual interfaces then use the instructions from the [[Multiple_WLANs | Multiple WLAN Guide]].
 +==Preparation==
 +Go to the '''Administration -> Commands''' page, insert the command below, and press the '''Run Commands''' button to find out the actual name of your wl0 interface. If you have a wl1 interface that you want to unbridge then change the command accordingly.
 +
 + nvram get wl0_ifname
== Configuration == == Configuration ==
=== Step 1: Remove the Wireless Interface from the LAN bridge === === Step 1: Remove the Wireless Interface from the LAN bridge ===
 +# Navigate to the '''Setup -> Networking''' page.
 +# Press the '''Add''' button in the '''Create Bridge''' section
 +# Type "'''br1'''" into the blank input box that is on the left side of all the options that just appeared.
 +# Press the '''Apply Settings''' button at the bottom of the page and new input boxes will appear.
 +# Set an '''IP Address''' that is in an unused subnet. ie. '''192.168.2.1'''
 +# Set the '''Subnet Mask''' to '''255.255.255.0'''
 +# Press the '''Apply Settings''' button again so that the IP address will be assigned to the br1 interface before you continue.
-# Go to the '''Wireless -> Basic Settings''' page.+[[Image:MultiWLAN_create_bridge.png]]
-# Change '''Network Configuration''' option from '''Bridged''' to '''Unbridged''' for whichever wireless interfaces you want separated.+
-# In the '''IP Address''' option that appears, set an IP Address that is in an unused subnet. ie. '''192.168.2.1'''+
 +# Press the '''Add''' button in the '''Assign to Bridge''' section.
 +# Select '''br1''' in the left drop down menu that appeared and in the middle menu select the name of your wireless interface that you discovered during the preparation.
 +# Press the '''Apply Settings''' button and the wireless interface will now be moved from br0 to br1.
 +
 +[[Image:MultiWLAN_assign_bridge.png]]
=== Step 2: Add DHCP for the unbridged WLAN interface === === Step 2: Add DHCP for the unbridged WLAN interface ===
-# Go to the '''Setup -> Networking''' page.+# Press the '''Add''' button in the '''Multiple DHCP Server''' section.
-# In the '''Port Setup''' section find the interface that has the IP Address you assigned in Step 1, this is the real name of the wireless interface.+# Select '''br1''' in the left drop down menu that appeared.
-# Press the '''Add''' button in the Multiple DHCP Server section.+
-# Select the wireless interface's real name in the left drop down menu that appeared. ie. '''eth0'''+
# Press the '''Apply Settings''' button to finish enabling the DHCP server for the wireless interface. # Press the '''Apply Settings''' button to finish enabling the DHCP server for the wireless interface.
 +
 +[[Image:MultiWLAN_add_dhcp.png]]
Line 43: Line 57:
If you have any problems with your firewall script, then create a forum thread and be sure to describe in great detail what you're trying to do, what it is actually doing, and post your firewall script. If you have any problems with your firewall script, then create a forum thread and be sure to describe in great detail what you're trying to do, what it is actually doing, and post your firewall script.
- 
-Configure this variable to get either wl0_ifname or wl1_ifname (only on dual radio models) depending on which radio you want to unbridge. Always include this so that the other commands will know which interface is used. 
- W_IF=`nvram get wl0_ifname` 
-Allow WLAN access to br0, the WAN, and any other subnets+Allow br1 access to br0, the WAN, and any other subnets (required if SPI firewall is on)
- iptables -I FORWARD -i $W_IF -m state --state NEW -j ACCEPT+ iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-Restrict WLAN from accessing br0+Restrict br1 from accessing br0 (do not use on [[Wireless Access Point|WAP]]'s)
- iptables -I FORWARD -i $W_IF -o br0 -m state --state NEW -j DROP+ iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
-Restrict br0 from accessing WLAN+Restrict br0 from accessing br1
- iptables -I FORWARD -i br0 -o $W_IF -m state --state NEW -j DROP+ iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
-Restrict WLAN from accessing the WAN+Restrict br1 from accessing the WAN port (no internet access!)
- iptables -I FORWARD -i $W_IF -o `nvram get wan_iface` -j DROP+ iptables -I FORWARD -i br1 -o `nvram get wan_iface` -j DROP
-Restrict WLAN access to br0's subnet, but pass traffic through br0 to the internet (for [[Wireless Access Point|WAP]]'s - WAN port disabled)+Restrict br1 from accessing br0's subnet but pass traffic through br0 to the internet (for [[Wireless Access Point|WAP]]'s - WAN port disabled)
- iptables -I FORWARD -i $W_IF -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP+ iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
-Enable NAT for traffic being routed out br0 so that the WLAN has connectivity (for [[Wireless Access Point|WAP]]'s - WAN port disabled)+Enable NAT for traffic being routed out br0 so that br1 has connectivity (for [[Wireless Access Point|WAP]]'s - WAN port disabled)
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr` iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
-Restrict WLAN from accessing the router's local sockets (software running on the router)+Restrict br1 from accessing the router's local sockets (software running on the router)
- iptables -I INPUT -i $W_IF -m state --state NEW -j DROP+ iptables -I INPUT -i br1 -m state --state NEW -j DROP
-Allow WLAN to access DHCP on the router+Allow br1 to access DHCP on the router
- iptables -I INPUT -i $W_IF -p udp --dport 67 -j ACCEPT+ iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
-Allow WLAN to access DNS on the router+Allow br1 to access DNS on the router
- iptables -I INPUT -i $W_IF -p udp --dport 53 -j ACCEPT+ iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
- iptables -I INPUT -i $W_IF -p tcp --dport 53 -j ACCEPT+ iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
==References== ==References==

Revision as of 09:23, 15 May 2010

Contents

Introduction

This guide explains how to separate the wireless interface from the "LAN&WLAN" bridge so that they are on different subnets. You are then able to control communication between the interfaces using iptables commands.

Note: If you're separating virtual interfaces then use the instructions from the Multiple WLAN Guide.

Preparation

Go to the Administration -> Commands page, insert the command below, and press the Run Commands button to find out the actual name of your wl0 interface. If you have a wl1 interface that you want to unbridge then change the command accordingly.

nvram get wl0_ifname

Configuration

Step 1: Remove the Wireless Interface from the LAN bridge

  1. Navigate to the Setup -> Networking page.
  2. Press the Add button in the Create Bridge section
  3. Type "br1" into the blank input box that is on the left side of all the options that just appeared.
  4. Press the Apply Settings button at the bottom of the page and new input boxes will appear.
  5. Set an IP Address that is in an unused subnet. ie. 192.168.2.1
  6. Set the Subnet Mask to 255.255.255.0
  7. Press the Apply Settings button again so that the IP address will be assigned to the br1 interface before you continue.

Image:MultiWLAN_create_bridge.png

  1. Press the Add button in the Assign to Bridge section.
  2. Select br1 in the left drop down menu that appeared and in the middle menu select the name of your wireless interface that you discovered during the preparation.
  3. Press the Apply Settings button and the wireless interface will now be moved from br0 to br1.

Image:MultiWLAN_assign_bridge.png

Step 2: Add DHCP for the unbridged WLAN interface

  1. Press the Add button in the Multiple DHCP Server section.
  2. Select br1 in the left drop down menu that appeared.
  3. Press the Apply Settings button to finish enabling the DHCP server for the wireless interface.

Image:MultiWLAN_add_dhcp.png


If DHCP is disabled on your main LAN in Basic Setup, then the Multiple DHCP method above will not work. Instead you will need to use Additional DNSMasq Options.

  1. Go to the Services tab and find the Additional DNSMasq Options text area.
  2. Adjust the following options to fit your environment (omit the comments starting with '#'):
# Enables DHCP on the wireless LAN
interface=eth0
# Set the WLAN default gateway
dhcp-option=eth0,3,192.168.2.1
# Set the DHCP range and default lease time of 24 hours
dhcp-range=eth0,192.168.2.100,192.168.2.150,255.255.255.0,24h


Make sure that you can connect to the unbridged wireless interface, receive a DHCP lease, and browse the network/internet before you do anything further.

Step 3: Controlling Access

Now that you have your WLAN separated you can start limiting what access it has. Here are several iptables commands that you can save to your firewall script on the Administration -> Commands page. These commands are written in the same order that the should appear in your firewall script, changing the order can affect the way that they work. Mix and match them however you like, just be sure to keep them in the order they appear on this page.

If you have any problems with your firewall script, then create a forum thread and be sure to describe in great detail what you're trying to do, what it is actually doing, and post your firewall script.


Allow br1 access to br0, the WAN, and any other subnets (required if SPI firewall is on)

iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu


Restrict br1 from accessing br0 (do not use on WAP's)

iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP


Restrict br0 from accessing br1

iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP


Restrict br1 from accessing the WAN port (no internet access!)

iptables -I FORWARD -i br1 -o `nvram get wan_iface` -j DROP


Restrict br1 from accessing br0's subnet but pass traffic through br0 to the internet (for WAP's - WAN port disabled)

iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP


Enable NAT for traffic being routed out br0 so that br1 has connectivity (for WAP's - WAN port disabled)

iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


Restrict br1 from accessing the router's local sockets (software running on the router)

iptables -I INPUT -i br1 -m state --state NEW -j DROP


Allow br1 to access DHCP on the router

iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT


Allow br1 to access DNS on the router

iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

References