Separate LAN and WLAN (light)
From DD-WRT Wiki
(Difference between revisions)
Revision as of 00:30, 11 February 2016 (edit) S2s2 (Talk | contribs) (Separate WIFI (WLAN) from LAN v2) ← Previous diff |
Revision as of 00:32, 11 February 2016 (edit) (undo) S2s2 (Talk | contribs) Next diff → |
||
Line 4: | Line 4: | ||
On a Buffalo WHR-HP-G300N | On a Buffalo WHR-HP-G300N | ||
- | http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_01.png | + | [[Image:http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_01.png]] |
http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_02.png | http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_02.png | ||
http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_03.png | http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_03.png |
Revision as of 00:32, 11 February 2016
This is a rough draft of a page that details how I separated the WIFI from the LAN on Build 27506 2015-09-07 DD-WRT v3.0-r27506 (07/09/15) std On a Buffalo WHR-HP-G300N
Image:Http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2 01.png http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_02.png http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_03.png http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_04.png http://www.dd-wrt.com/wiki/index.php/Image:SeparateWIFIfromLANv2_05.png
Lastly, this goes in the Commands section, Save Firewall:
#Allow guest bridge access to Internet iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu #Block access from br1 to br0. You can beef this up if you like to drop packets from br0 to br1 also iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j ACCEPT iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP #NAT to make Internet work iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr` #Enable NAT on the WAN port to correct a bug in builds over 17000 iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr` #Deny access to local router services from Guest (240.x br1) network iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset #iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset