Separate LAN and WLAN

From DD-WRT Wiki

Revision as of 20:52, 16 February 2010 by Phuzi0n (Talk | contribs)
Jump to: navigation, search

Contents

Introduction

This guide explains how to separate the wireless interface from the "LAN&WLAN" bridge so that they are on different subnets. You are then able to control communication between the interfaces using iptables commands.


Configuration

Step 1: Remove the Wireless Interface from the LAN bridge

  1. Go to the Wireless -> Basic Settings page.
  2. Change Network Configuration option from Bridged to Unbridged for whichever wireless interfaces you want separated.
  3. In the IP Address option that appears, set an IP Address that is in an unused subnet. ie. 192.168.2.1


Note: If you're separating virtual interfaces then use the instructions from the Multiple WLAN Guide.

Step 2: Add DHCP for the unbridged WLAN interface

  1. Go to the Setup -> Networking page.
  2. In the Port Setup section find the interface that has the IP Address you assigned in Step 1, this is the real name of the wireless interface.
  3. Press the Add button in the Multiple DHCP Server section.
  4. Select the wireless interface's real name in the left drop down menu that appeared. ie. eth0
  5. Press the Apply Settings button to finish enabling the DHCP server for the wireless interface.


If DHCP is disabled on your main LAN in Basic Setup, then the Multiple DHCP method above will not work. Instead you will need to use Additional DNSMasq Options.

  1. Go to the Services tab and find the Additional DNSMasq Options text area.
  2. Adjust the following options to fit your environment (omit the comments starting with '#'):
# Enables DHCP on the wireless LAN
interface=eth0
# Set the WLAN default gateway
dhcp-option=eth0,3,192.168.2.1
# Set the DHCP range and default lease time of 24 hours
dhcp-range=eth0,192.168.2.100,192.168.2.150,255.255.255.0,24h


Make sure that you can connect to the unbridged wireless interface, receive a DHCP lease, and browse the network/internet before you do anything further.

Step 3: Controlling Access

Now that you have your WLAN separated you can start limiting what access it has. Here are several iptables commands that you can save to your firewall script on the Administration -> Commands page. These commands are written in the same order that the should appear in your firewall script, changing the order can affect the way that they work. Mix and match them however you like, just be sure to keep them in the order they appear on this page.

If you have any problems with your firewall script, then create a forum thread and be sure to describe in great detail what you're trying to do, what it is actually doing, and post your firewall script.


Configure this variable with the real name of the unbridged wireless interface. Always include this.

W_IF=eth0


Allow WLAN access to br0, the WAN, and any other subnets

iptables -I FORWARD -i $W_IF -m state --state NEW -j ACCEPT


Restrict WLAN from accessing br0

iptables -I FORWARD -i $W_IF -o br0 -m state --state NEW -j DROP


Restrict br0 from accessing WLAN

iptables -I FORWARD -i br0 -o $W_IF -m state --state NEW -j DROP


Restrict WLAN from accessing the WAN

iptables -I FORWARD -i $W_IF -o `nvram get wan_iface` -j DROP


Restrict WLAN access to br0's subnet, but pass traffic through br0 to the internet (for WAP's - WAN port disabled)

iptables -I FORWARD -i $W_IF -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP


Enable NAT for traffic being routed out br0 so that the WLAN has connectivity (for WAP's - WAN port disabled)

iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


Restrict WLAN from accessing the router's local sockets (software running on the router)

iptables -I INPUT -i $W_IF -m state --state NEW -j DROP


Allow WLAN to access DHCP on the router

iptables -I INPUT -i $W_IF -p udp --dport 67 -j ACCEPT


Allow WLAN to access DNS on the router

iptables -I INPUT -i $W_IF -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i $W_IF -p tcp --dport 53 -j ACCEPT

References

Multiple WLANs