Separate LAN and WLAN

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 18:00, 27 January 2007 (edit)
1169920083 (Talk | contribs)

← Previous diff
Revision as of 18:18, 28 January 2007 (edit) (undo)
Atzekalle (Talk | contribs)

Next diff →
Line 59: Line 59:
[[Category:English documentation]] [[Category:English documentation]]
[[Category:advanced HOWTO]] [[Category:advanced HOWTO]]
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
-<div style="display:none"> 
-[l_sp_25] 
- 
-[http://snipurl.com/18fop no teletrack payday loans] 
-[http://my-own.net/dupontl dupont laminate flooring] 
-[http://pergolam.4000.it flooring laminate pergo] 
-[http://my-own.net/rinse ringtone selena] 
-[http://snipurl.com/18fos manson marilyn ringtone] 
-[http://icsloan.4000.it/ ics payday loan] 
- 
-[http://br.groups.yahoo.com/group/actos_met_plus/ actos met plus] 
-[http://br.groups.yahoo.com/group/adalat_xl/ adalat xl] 
-[http://br.groups.yahoo.com/group/adalat_cc/ adalat cc] 
-[http://ar.groups.yahoo.com/group/altace/ altace and hair thinning] 
-[http://ar.groups.yahoo.com/group/arava/ arava side effects] 
-[http://ar.groups.yahoo.com/group/atarax/ atarax hydroxyzine] 
- 
- 
-</div> 

Revision as of 18:18, 28 January 2007

Seperating your LAN and WLAN could be essential towards

Contents

Configuration

Step 1: Remove Wireless interface (eth1) from the LAN bridge (br0)

a) Go to the 'Setup -> VLANs' page. b) At the bottom of the page change the "Wireless" option from "LAN" to "None"

(Above setting doesn't take place until the next reboot which is good because it kills the WLAN. We'll fix that in the next step.)

Step 2: Configure the wireless interface

a) Go to the 'Administration -> Diagnostics' page and click the 'Run' button. b) Paste the following command into the text box:

wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0

c) Click the 'Save Startup' button instead of the 'Cmd' button (Don't close this window yet!)

3. Configure the necessary iptables rules:

a) Paste the following into the same text box used above but this time press the 'Save Firewall' button:

iptables -D INPUT -j DROP;
iptables -A INPUT -i eth1 -m state --state NEW -j logaccept;
iptables -A INPUT -j DROP;
iptables -D FORWARD -j DROP;
iptables -A FORWARD -i eth1 -m state --state NEW -j ACCEPT;
iptables -A FORWARD -j DROP;
iptables  -t nat -I PREROUTING -i eth1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -j DROP
 

The above iptables rules are overly complex for a couple of reasons:

1. I wanted to keep the organization of the rules as close to the DD-WRT default configuration as possible. This required deleting a few of the default rules, adding ours, then recreating the default rules to keep things in the proper order.

2. I wanted them to work even if you change the wireless subnet (indicated in green above) or if the LAN ports' subnet is something other than 192.168.1.X - basically the rules should work with nearly all configurations unless you've been doing some other advanced stuff with iptables.

Another thing to note is that thanks to the changes BrainSlayer made in recent builds of v23 port forwarding to the WLAN should work without requiring any manual modifications to the iptables rules! (Although I haven't tested this and quite honestly I'm not sure why you'd want to forward ports to the WLAN in a configuration like this...) Port forwarding to the WLAN will NOT work with v22 without manually creating the necessary iptables rules.


Now on to the DHCP issue. With the steps laid out above you will have to configure your wireless clients with static IP addresses. One way to get DHCP working on the wireless subnet is to DISABLE "DNS Masq" on the 'Administration -> Management' page and then issue the following command which will enable DHCP on the wireless interface and lease addresses from 10.0.0.100 to 10.0.0.200:

dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases

If you want DHCP to start automatically for the wireless subnet every time the router reboots repeate step two above but use the following command instead:

wlconf eth1 up;ifconfig eth1 10.0.0.1 netmask 255.255.255.0;dnsmasq -z eth1 -F 10.0.0.100,10.0.0.200 -l /tmp/dnsmasq.wifi.leases

The problem with this is that you can't use the DNSMasq option for DHCP on your LAN ports... see below:

dns_masq_separate_lan_wan

Note that you CAN still have DHCP enabled for the LAN ports, you just can't use DNSMasq as the DHCP server.

References

http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=9945