Separate LAN and WLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 18:00, 27 January 2007 (edit)
1169920083 (Talk | contribs)

← Previous diff
Current revision (03:06, 28 September 2020) (edit) (undo)
Tag (Talk | contribs)
m (Step 3: Controlling Access - Update syntax for NOT in iptables)
 
(83 intermediate revisions not shown.)
Line 1: Line 1:
-Seperating your LAN and WLAN could be essential towards+{{Languages|Separate LAN and WLAN}}
- +__TOC__
-== Configuration ==+==Introduction==
-=== Step 1: Remove Wireless interface (eth1) from the LAN bridge (br0) ===+This guide explains how to separate the wireless interface from the "LAN&WLAN" bridge so that they are on different subnets. You are then able to control communication between the interfaces using iptables commands.
- +
-a) Go to the 'Setup -> VLANs' page.+
-b) At the bottom of the page change the "Wireless" option from "LAN" to "None"+
- +
-(Above setting doesn't take place until the next reboot which is good because it kills the WLAN. We'll fix that in the next step.) +
- +
-=== Step 2: Configure the wireless interface ===+
- +
-a) Go to the 'Administration -> Diagnostics' page and click the 'Run' button.+
-b) Paste the following command into the text box: +
- +
-wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0+
- +
-c) Click the 'Save Startup' button instead of the 'Cmd' button (Don't close this window yet!) +
- +
-'''3. Configure the necessary iptables rules:'''+
- +
-a) Paste the following into the same text box used above but this time press the 'Save Firewall' button: +
- +
- iptables -D INPUT -j DROP;+
- iptables -A INPUT -i eth1 -m state --state NEW -j logaccept;+
- iptables -A INPUT -j DROP;+
- iptables -D FORWARD -j DROP;+
- iptables -A FORWARD -i eth1 -m state --state NEW -j ACCEPT;+
- iptables -A FORWARD -j DROP;+
- iptables -t nat -I PREROUTING -i eth1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -j DROP+
- +
- +
-The above iptables rules are overly complex for a couple of reasons:+
- +
-1. I wanted to keep the organization of the rules as close to the DD-WRT default configuration as possible. This required deleting a few of the default rules, adding ours, then recreating the default rules to keep things in the proper order.+
- +
-2. I wanted them to work even if you change the wireless subnet (indicated in green above) or if the LAN ports' subnet is something other than 192.168.1.X - basically the rules should work with nearly all configurations unless you've been doing some other advanced stuff with iptables.+
- +
-Another thing to note is that thanks to the changes BrainSlayer made in recent builds of v23 port forwarding to the WLAN should work without requiring any manual modifications to the iptables rules! (Although I haven't tested this and quite honestly I'm not sure why you'd want to forward ports to the WLAN in a configuration like this...) Port forwarding to the WLAN will NOT work with v22 without manually creating the necessary iptables rules.+
- +
- +
-Now on to the DHCP issue. With the steps laid out above you will have to configure your wireless clients with static IP addresses. One way to get DHCP working on the wireless subnet is to DISABLE "DNS Masq" on the 'Administration -> Management' page and then issue the following command which will enable DHCP on the wireless interface and lease addresses from 10.0.0.100 to 10.0.0.200: +
- +
- dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases+
- +
-If you want DHCP to start automatically for the wireless subnet every time the router reboots repeate step two above but use the following command instead:+
- +
- wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0;dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases+
- +
-The problem with this is that you can't use the DNSMasq option for DHCP on your LAN ports... see below:+
- +
-[http://img483.imageshack.us/my.php?image=dnsmasq3ba.jpg dns_masq_separate_lan_wan]+
- +
-Note that you CAN still have DHCP enabled for the LAN ports, you just can't use DNSMasq as the DHCP server.+
- +
-= References =+
-http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=9945+
- +
-[[Category:English documentation]]+
-[[Category:advanced HOWTO]]+
- +
- +
- +
- +
 +If your router is configured as a [[Wireless Access Point]] (WAN is disabled) then you must be sure to set the gateway and local DNS as recommended in the WAP guide. This also applies to WDS client nodes (but not the main WDS node) which are bridged to another router that does routing for them. Keep your eye out for the places this guide gives alternative instructions for WAP's.
 +'''Note:''' If you're separating virtual interfaces then use the instructions from the [[Multiple_WLANs | Multiple WLAN Guide]].
 +==Preparation==
 +Go to the '''Administration -> Commands''' page, insert the command below, and press the '''Run Commands''' button to find out the actual name of your wl0 interface. If you have a wl1 interface that you want to unbridge then change the command accordingly.
 + nvram get wl0_ifname
 +== Configuration ==
 +=== Step 1: Remove the Wireless Interface from the LAN bridge ===
 +1. Navigate to the '''Setup -> Networking''' page.<br/>
 +2. In the '''Port Setup''' section, find the configuration for the interface (identified in [[#Preparation]]) that you would like to unbridge.<br/>
 +3. For that interface, select the '''Unbridged''' radio button next to '''Bridge Assignment'''. More options will appear.<br/>
 +4. Set '''Masquerade / NAT''' to '''Enable'''.<br/>
 +5. Set '''Net Isolation''' to '''Enable'''. This will automatically add a rule like this to your firewall:
 + iptables -I FORWARD -i <interface> --destination 192.168.1.0/24 -m state --state NEW -j DROP
 +6. Set an '''IP Address''' that is in an unused subnet, e.g. '''192.168.2.1'''.<br/>
 +7. Set the '''Subnet Mask''' to '''255.255.255.0'''.<br/>
 +8. Press the '''Apply Settings''' button so that the IP address will be assigned to the wireless interface.
 +[[Image:Unbridged_eth1.jpg]]
 +=== Step 2: Add DHCP for the unbridged WLAN interface ===
 +# Press the '''Add''' button in the '''Multiple DHCP Server''' section.
 +# Select the interface you unbridged in '''Step 1''' in the left drop down menu that appeared.
 +# Press the '''Apply Settings''' button to finish enabling the DHCP server for the wireless interface.
 +[[Image:Eth1_DHCP.jpg]]
 +''If DHCP is disabled on your main LAN in Basic Setup, then the Multiple DHCP method above will not work. Consult [[Multiple_WLANs#Command_Method|Multiple WLANs]] for instructions on setting up a DHCP server for your unbridged interface using '''Additional DNSMasq Options'''. Note that those instructions set up a DHCP server for a bridge, so you will need to substitute occurrences of '''br1''' with your unbridged interface.''
 +You should now be able to connect to the unbridged wireless interface and receive a DHCP lease with an IP address that is in the '''192.168.2.0/24''' subnet. Make sure that you can connect to it, receive a DHCP lease, and connect to the router's '''192.168.2.1''' address before you do anything further. If your WAN port is active (ie. you're not making a WAP) then you should also be able to browse the Internet. If you are making a WAP then you must either use iptables commands for WAP's like in [[Multiple_WLANs#Restricting_Access|Multiple WLANs]], or create routes throughout your network.
 +=== Step 3: Controlling Access ===
 +'''Step 1''' has automatically restricted the unbridged interface from accessing the '''192.168.1.0/24''' subnet (typically the wired LAN).
 +To also restrict the unbridged interface from accessing another interface, add the following to your Firewall [[Startup_Scripts|Startup Script]]:
 + iptables -I FORWARD -i <interface> -o <other> -j DROP
 +where ''<interface>'' is your unbridged interface and ''<other>'' is the interface you don't want it talking to.
-<div style="display:none">+To prevent devices on the unbridged interface from accessing each other, as well as all other local interfaces, add the following to your Firewall startup script:
-[l_sp_25]+ iptables -I FORWARD -i <interface> ! -o <wan_interface> -j DROP
 +where ''<interface>'' is your unbridged interface and ''<wan_interface>'' is the interface your WAN port is assigned to (typically '''vlan2''', see ''Setup>Networking>Port Setup'' to verify.
-[http://snipurl.com/18fop no teletrack payday loans]+=== Additional Wireless Interfaces ===
-[http://my-own.net/dupontl dupont laminate flooring]+'''Steps 1-3''' can be repeated as needed to unbridge additional wireless interfaces. Be sure to use a different subnet for each unbridged interface, i.e. you cannot use '''192.168.2.0/24''' for both '''eth1''' and '''eth2'''.
-[http://pergolam.4000.it flooring laminate pergo]+=== Unbridged Interfaces Broken ===
-[http://my-own.net/rinse ringtone selena]+In the rare case that unbridged interfaces do not give WAN access in your build, you may need to create a new bridge, e.g. '''br1''' for your wireless interface. Your instructions will then be more akin to those for [[Multiple WLANs]], assigning real wireless interfaces to the new bridge instead of virtual interfaces.
-[http://snipurl.com/18fos manson marilyn ringtone]+
-[http://icsloan.4000.it/ ics payday loan]+
-[http://br.groups.yahoo.com/group/actos_met_plus/ actos met plus]+== See Also ==
-[http://br.groups.yahoo.com/group/adalat_xl/ adalat xl]+* [[iptables command]]
-[http://br.groups.yahoo.com/group/adalat_cc/ adalat cc]+* [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=323129 Leaving wireless interface unbridged?]
-[http://ar.groups.yahoo.com/group/altace/ altace and hair thinning]+== Legacy Guides ==
-[http://ar.groups.yahoo.com/group/arava/ arava side effects]+* [[Multiple WLANs]] - Using multiple bridges
-[http://ar.groups.yahoo.com/group/atarax/ atarax hydroxyzine]+* [[V24: WLAN separate from LAN, with independent DHCP]] - For v24
 +* [[WLAN separate from LAN, with independent dhcp, etc]] - Using the CLI
-</div>+[[Category:Interfaces]]
 +[[Category:Wlan]]
 +[[Category:Lan]]
 +[[Category:Basic tutorials]]

Current revision

Contents

[edit] Introduction

This guide explains how to separate the wireless interface from the "LAN&WLAN" bridge so that they are on different subnets. You are then able to control communication between the interfaces using iptables commands.

If your router is configured as a Wireless Access Point (WAN is disabled) then you must be sure to set the gateway and local DNS as recommended in the WAP guide. This also applies to WDS client nodes (but not the main WDS node) which are bridged to another router that does routing for them. Keep your eye out for the places this guide gives alternative instructions for WAP's.

Note: If you're separating virtual interfaces then use the instructions from the Multiple WLAN Guide.

[edit] Preparation

Go to the Administration -> Commands page, insert the command below, and press the Run Commands button to find out the actual name of your wl0 interface. If you have a wl1 interface that you want to unbridge then change the command accordingly.

nvram get wl0_ifname

[edit] Configuration

[edit] Step 1: Remove the Wireless Interface from the LAN bridge

1. Navigate to the Setup -> Networking page.
2. In the Port Setup section, find the configuration for the interface (identified in #Preparation) that you would like to unbridge.
3. For that interface, select the Unbridged radio button next to Bridge Assignment. More options will appear.
4. Set Masquerade / NAT to Enable.
5. Set Net Isolation to Enable. This will automatically add a rule like this to your firewall:

iptables -I FORWARD -i <interface> --destination 192.168.1.0/24 -m state --state NEW -j DROP

6. Set an IP Address that is in an unused subnet, e.g. 192.168.2.1.
7. Set the Subnet Mask to 255.255.255.0.
8. Press the Apply Settings button so that the IP address will be assigned to the wireless interface. Image:Unbridged_eth1.jpg

[edit] Step 2: Add DHCP for the unbridged WLAN interface

  1. Press the Add button in the Multiple DHCP Server section.
  2. Select the interface you unbridged in Step 1 in the left drop down menu that appeared.
  3. Press the Apply Settings button to finish enabling the DHCP server for the wireless interface.

Image:Eth1_DHCP.jpg

If DHCP is disabled on your main LAN in Basic Setup, then the Multiple DHCP method above will not work. Consult Multiple WLANs for instructions on setting up a DHCP server for your unbridged interface using Additional DNSMasq Options. Note that those instructions set up a DHCP server for a bridge, so you will need to substitute occurrences of br1 with your unbridged interface.

You should now be able to connect to the unbridged wireless interface and receive a DHCP lease with an IP address that is in the 192.168.2.0/24 subnet. Make sure that you can connect to it, receive a DHCP lease, and connect to the router's 192.168.2.1 address before you do anything further. If your WAN port is active (ie. you're not making a WAP) then you should also be able to browse the Internet. If you are making a WAP then you must either use iptables commands for WAP's like in Multiple WLANs, or create routes throughout your network.

[edit] Step 3: Controlling Access

Step 1 has automatically restricted the unbridged interface from accessing the 192.168.1.0/24 subnet (typically the wired LAN).

To also restrict the unbridged interface from accessing another interface, add the following to your Firewall Startup Script:

iptables -I FORWARD -i <interface> -o <other> -j DROP

where <interface> is your unbridged interface and <other> is the interface you don't want it talking to.

To prevent devices on the unbridged interface from accessing each other, as well as all other local interfaces, add the following to your Firewall startup script:

iptables -I FORWARD -i <interface> ! -o <wan_interface> -j DROP

where <interface> is your unbridged interface and <wan_interface> is the interface your WAN port is assigned to (typically vlan2, see Setup>Networking>Port Setup to verify.

[edit] Additional Wireless Interfaces

Steps 1-3 can be repeated as needed to unbridge additional wireless interfaces. Be sure to use a different subnet for each unbridged interface, i.e. you cannot use 192.168.2.0/24 for both eth1 and eth2.

[edit] Unbridged Interfaces Broken

In the rare case that unbridged interfaces do not give WAN access in your build, you may need to create a new bridge, e.g. br1 for your wireless interface. Your instructions will then be more akin to those for Multiple WLANs, assigning real wireless interfaces to the new bridge instead of virtual interfaces.

[edit] See Also

[edit] Legacy Guides