Seperate Lan and WLan

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 04:39, 23 May 2005 (edit)
Sveasoft (Talk | contribs)
(Setup DHCP on Wifi interface)
← Previous diff
Revision as of 05:50, 23 May 2005 (edit) (undo)
Sveasoft (Talk | contribs)
(Bypassing the Bridge - Major updating)
Next diff →
Line 75: Line 75:
==Bypassing the Bridge== ==Bypassing the Bridge==
-'''needs to be finished -- I need the iptables and dhcp commands'''<Br>+'''Not yet fully tested. Do not know if wep/wds work from web config of if [[wl command]] will be needed.'''
-as such, not fully tested. Do not know if wep/wds work from web config of if [[wl command]] will be needed.+
-Since the file ''/etc/network/interfaces'' file doesn't exist on DD-WRT as it does on OpenWRT, we have to use the [[ifconfig command]] to configure the interfaces and those ''wifi_*'' variables from before won't be automatic. We'll still use them in order to make changing the wifi settings later easier. All you'll have to do is update the nvram variables and reboot.+Since the file ''/etc/network/interfaces'' file doesn't exist on DD-WRT as it does on OpenWRT, we have to use the [[ifconfig command]] to configure the interfaces and those ''wifi_*'' variables from before don't have a script to read them, so they're useless right now. But we can still do it manually.
-We'll use the nvram rc_firewall variable to bringup the wifi adapter and setup the iptables routes. +For this example I'm placing the wifi on 192.168.2.x and 192.168.1.1 is the LAN ip.
- +
-For this example I'm placing the wifi on 192.168.2.x+
'''MAKE SURE THE ROUTER IS IN AP MODE'''<br> '''MAKE SURE THE ROUTER IS IN AP MODE'''<br>
Line 89: Line 86:
===Seperate the Bridge and configure initial Wifi=== ===Seperate the Bridge and configure initial Wifi===
nvram set lan_ifname=vlan0 nvram set lan_ifname=vlan0
- nvram set wifi_ifname=eth1 
- nvram set wifi_proto=dhcp 
- nvram set wifi_ipaddr=192.168.2.1 
- nvram set wifi_netaddr=192.168.2.0 ''(I'm not sure if this line will be needed)'' 
- nvram set wifi_netmask=255.255.255.0 
nvram commit nvram commit
reboot reboot
===Setup the eth1 interface=== ===Setup the eth1 interface===
- nvram set rc_firwall="+ ifconfig eth1 down
- ifconfig $(nvram get wifi_ifname) down+ ifconfig eht1 192.168.2.1 netmask 255.255.255.0
- ifconfig $(nvram get wifi_ifname) $(nvram get wifi_ipaddr) netmask $(nvram get wifi_netmask)+ ifconfig eth1 up
- ifconfig $(nvram get wifi_ifname) up+
- "+
- nvram commit+
===Setup Routes=== ===Setup Routes===
- nvram set rc_firewall="$(nvram get rc_firewall)+ iptables -I INPUT -i eth1 -p tcp -j ACCEPT
- ''iptables ?? umm... if to $(nvram get wifi_netaddr) send to $(nvram get wifi_ifname) ??''+ iptables -I FORWARD -i eth1 -p tcp -j ACCEPT
- ''etc''+
- ''I don't know iptables syntax at all...''+
- "+
- nvram commit+
===Setup DHCP & DNS on Wifi interface=== ===Setup DHCP & DNS on Wifi interface===
-''These commands are just contingent and have not been fully tested by the author''+ iptables -I INPUT -i eth1 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
-The following commands enable dns on all interfaces (removes interface=vlan0 from dnsmasq.conf and reloads) and enable dhcp on the wifi interface if that nvram variable was set accordingly. Next it creates a udhcp.conf file for the wifi interface. When I noticed dnsmasq had a built in dhcp server, I toyed with using that instead, but that wouldn't allow static dhcp on the wifi interface. This allows that. Much thanks to loco in the forum for his example! Right now, this uses the same dhcp setup as the lan side, only on the different local network (192.168.2.x or whatever instead of 192.168.1.x or whatever).+ iptables -I INPUT -i eth1 -p udp --dport 53 -j ACCEPT
- +
-Here I had to get a little fancy. I had to learn how to use the [[cut command]], and the [[expr command]].. I'll update this page with a simplier manual setup once I write the script. I think that'll be better for all of us. An easy to understand example, and a script that does it all for you ;)+
- +
- nvram set rc_firewall="$(nvram get rc_firewall)+
killall -q -9 dnsmasq killall -q -9 dnsmasq
sed /^interface.*/d /tmp/dnsmasq.conf > /tmp/dnsmasq.conf.new sed /^interface.*/d /tmp/dnsmasq.conf > /tmp/dnsmasq.conf.new
- if "$(nvram get wifi_proto)" = "dhcp"+ echo -n "
- then+
- echo -h '+
pidfile /var/run/udhcpd.pid pidfile /var/run/udhcpd.pid
- start $(echo $(nvram get wifi_ipaddr) | cut -f1-3 -d .).$(nvram get dhcp_start)+ start 192.168.2.100
- end $(echo $(nvram get wifi_ipaddr) | cut -f1-3 -d .).$(expr $(nvram get dhcp_start) + $(nvram get dhcp_num) - 1)+ end 192.168.2.149
- max_leases $(nvram get dhcp_num)+ max_leases 50
- interface $(nvram get wifi_ifname)+ interface eth1
remaining yes remaining yes
auto_time 30 auto_time 30
lease_file /tmp/udhcpd.leases lease_file /tmp/udhcpd.leases
statics_file /tmp/udhcpd.statics statics_file /tmp/udhcpd.statics
- option subnet $(nvram get wifi_netmask)+ option subnet 255.255.255.0
- option router $(nvram get wifi_ipaddr)+ option router 192.168.2.1
- option lease $(nvram get dhcp_lease)+ option lease 86640
- option dns $(nvram get wan_dns)' > /tmp/udhcpdeth1.conf+ option dns $(nvram get wan_dns)
 + " > /tmp/udhcpdeth1.conf
udhcpd /tmp/udhcpdeth1.conf udhcpd /tmp/udhcpdeth1.conf
- fi + 
- "+===Undo===
 +If you want to put your router back with the wifi and wlan bridged give the commands
 + nvram unset rc_firewall
 + nvram lan_ifname="br0"
nvram commit nvram commit
 + reboot
-If you ever want to change your wifi settings, you only have to change your wifi_* nvram variables and reboot!+===Using a script to parse wifi_* Variables===
- +To make configuration easier, I've written a script that accepts wifi_* nvram variables. This is essentially how the OpenWRT firmware does this, as I understand it. After it's setup, you can change your wifi settings by simply updating the nvram variables and rebooting!
-===Adding additional firewall configs===+ nvram set lan_ifname=vlan0
-Since we've just put a lot in rc_firewall that you won't want to re-enter, and you may want to setup additional custom firewalls, just be sure to add your additional firewall commands in the form so you don't screw up your wifi:+ nvram set wifi_ifname=eth1
- nvram set rc_firewall="$(nvram get rc_firewall)+ nvram set wifi_proto=dhcp
- ''additional commands''+ nvram set wifi_ipaddr=192.168.2.1
- "+ nvram set wifi_netmask=255.255.255.0
 + nvram commit
 +
 +If you don't want your wifi to use the same dhcp settings as your lan side (same number of leases, same lease time, etc) issue these commands.<br>(Example will setup dhcp from 192.168.2.100-192.168.2.14 with 120 minute leases)
 + nvram set wifi_dhcp_start=100
 + nvram set wifi_dhcp_num=15
 + nvram set wifi_dhcp_lease=120
nvram commit nvram commit
-===Future Goals===+Now copy this script to /jffs/etc/wifi_config.sh<br>Remember, only edit scripts using *nix friendly text editors (such as TextPad or win32pad).
-These last 3 steps should probably be written in a script /jffs/etc/setup_wifi.sh<br>+
-This script should:<br>+ # !/bin/sh
--Check to see if $(nvram get lan_ifname) != "br0" // ie, we've seperated the interfaces<br>+ #
--run the ifconfig and iptables commands to setup the interface and routes between wifi and wan and wan and lan. Could even add an nvram variable wifi_accessable that if 1 would set a route between wifi and lan and lan and wifi, so even though their seperate broadcast domains, they can still ping, etc. The script should remove the need for wifi_netaddr by setting the last octet in wifi_ipaddr to 0 automatically after getting it from nvram.<br>+ ##### wifi_config.startup ####
--check to see if $(nvram get wifi_proto) = "dhcp" and if so, setup dhcp on the wifi interface, otherwise don't<br>+ #
 + # Wifi configuration script by Bob/Paul.
 + # Special thanks to loco on the forums for the iptables, dhcp, and dnsmasq code!!
 +
 + #initialize the variables
 + WIFI_INTERFACE=$(nvram get wifi_ifname)
 + WIFI_IPADDRESS=$(nvram get wifi_ipaddr)
 + WIFI_NETMASK=$(nvram get wifi_netmask)
 +
 + #Test for extended wifi variables (wifi_dhcp_start, wifi_dhcp_num, & wifi dhcp_lease (in minutes))
 +
 + #Test for wifi_dhcp_lease
 + if [ "$(nvram get wifi_dhcp_lease)" = "" ]; then #default values
 + WIFI_DHCP_LEASE=$(nvram get dhcp_lease)
 + else #else configured...
 + WIFI_DHCP_LEASE=$(nvram get wifi_dhcp_lease)
 + fi
 +
 + #Test for wifi_dhcp_num
 + if [ "$(nvram get wifi_dhcp_num)" = "" ]; then
 + WIFI_DHCP_NUM=$(nvram get dhcp_num)
 + else
 + WIFI_DHCP_NUM=$(nvram get wifi_dhcp_num)
 + fi
 +
 + #Test for wifi_dhcp_start
 + if [ "$(nvram get dhcp_start)" = "" ]; then
 + WIFI_DHCP_START=$(echo $WIFI_IPADDRESS | cut -f1-3 -d .).$(nvram get dhcp_start)
 + else
 + WIFI_DHCP_START=$(echo $WIFI_IPADDRESS | cut -f1-3 -d .).$(nvram get wan_dhcp_start)
 + fi
 +
 + #WIFI_DHCP_END can be configured from what we already know
 + WIFI_DHCP_END=$(echo $WIFI_IPADDRESS | cut -f1-3 -d .).$(expr $WIFI_DHCP_START + $WIFI_DHCP_NUM - 1)
-This would make it easier to setup additional firewall settings as all the wifi would need is:<br>+
- nvram set rc_firewall="/jffs/etc/setup_wifi.sh"+ #if the bridge is down, configure the wifi, else do nothing
- nvram commit+ if [ "$(nvram get lan_ifname)" != "br0" ]; then
-===Undo===+ #bring up the wifi interface with the ip and netmask
-If you want to put your router back with the wifi and wlan bridged give the commands+ ifconfig $WIFI_INTERFACE down
- nvram unset rc_firewall+ ifconfig $WIFI_INTERFACE $WIFI_IPADDRESS netmask $WIFI_NETMASK
- nvram lan_ifname="br0"+ ifconfig $WIFI_INTERFACE up
 +
 + #setup static routes for the wifi interface
 + iptables -I INPUT -i $WIFI_INTERFACE -p tcp -j ACCEPT
 + iptables -I FORWARD -i $WIFI_INTERFACE -p tcp -j ACCEPT
 +
 + #allow dhcp and dns mask on the wifi interface
 + iptables -I INPUT -i $WIFI_INTERFACE -p udp --dport 67:68 --sport 67:68 -j ACCEPT
 + iptables -I INPUT -i $WIFI_INTERFACE -p udp --dport 53 -j ACCEPT
 +
 + #kill dns masq and bring it back up on the wifi and lan interfaces
 + killall -q -9 dnsmasq
 + sed /^interface.*/d /tmp/dnsmasq.conf > /tmp/dnsmasq.conf.new
 + dnsmasq --conf-file /tmp/dnsmasq.conf.new
 +
 + #write a new udhcpd script for the wifi interface to /tmp/udhcpd_wifi.conf
 + echo -n "
 + start $WIFI_DHCP_START
 + end $WIFI_DHCP_END
 + max_leases WIFI_DHCP_NUM
 + interface $WIFI_INTERFACE
 + remaining yes
 + auto_time 30
 + lease_file /tmp/udhcpd.leases
 + statics_file /tmp/udhcpd.statics
 + option subnet $WIFI_NETMASK
 + option router $WIFI_IPADDRESS
 + option lease $WIFI_DHCP_LEASE
 + option dns $(nvram get wan_dns)" > /tmp/udhcpd_wifi.conf
 +
 + #bring up udhcpd on the wifi interface
 + udhcpd /tmp/udhcpd.eth1.conf
 +
 + fi
 +
 +Now that you've save the script as a to ''/jffs/etc'', make it executable and tell it to load on startup. Since this is basically a firewall setting, we'll add it to the ''rc_firewall'' variable. You could also use any of the methods in [[Startup Scripts]]
 + chmod 700 /jffs/etc/wifi_config.sh
 + nvram set rc_firewall="$(nvram get rc_firewall)
 + /jffs/etc/wifi_config.sh $
 + "
nvram commit nvram commit
- reboot+
 +'''Reboot and enjoy!'''
=External Resources= =External Resources=

Revision as of 05:50, 23 May 2005

You are here: Main Page/DD-WRT Docu (EN)/Seperate Lan and WLan

Contents


THIS WIKI IS A WORK IN PROGRESS. PLEASE HELP

Introduction

While Linksys never intended their WRT54G/GS router to allow multiple local networks, it is possible to seperate the WLan network from the Lan network and allow both to independantly access the internet. Since this was not supported by the origional Linksys firmware, and all custom firmwares are a derivation of this, performing this setup will yield unexpected results when configuring certain options from the Web Interface. Users wishing to perform this setup should be very familiar with the command line interface, as those Web Interface configurations broken by this setup can still be set from the command line interface.

Users wishing to configure their routers this way might choose to install the OpenWRT firmware instead as it does not offer a web interface that can get screwed up.

Keep in mind that Brainslayer is currently in the processes of merging DD-WRT with OpenWRT. While it was already true that things said for OpenWRT were likely the same or similar for DD-WRT since they both share the same Linksys firmware roots, this statement is even more true now and will eventually read: Things said for OpenWRT can be said for DD-WRT. We are not there yet.

Hardware

Physically the WRT54G is a 2 port router and a 6 port switch. 1 Port of the switch is connected to the router. 1 Port of the Switch is the WAN port. The other 4 ports of the switch are the 4 LAN ports seen on the back of the router. The remaining port on the router is connected to the WLAN adapter.

By default, inside the switch exist 2 Virtual LANs (VLans), vlan0 and vlan1. vlan0 contains ports 1-4 (Lan ports) and port 6 (router). vlan1 contains port 0 (WAN) and port 6 (router). IPTables are then implemented on the router such that NAT'd routing is possible between the VLans.

By default, inside the router there is a bridge (br0) bridging eth1 (WLAN) and eth0 (switch port 0). This is what allows the WLAN and LAN to share the same IP address. When the router needs to send information to client machines, it is broadcast out br0 (sending it to eth1 and vlan0). Then the router needs to send information to the WAN port, it is sent directly to vlan1.

Please read OpenWRT: OpenWRT DOCS/Configuration as it is short and quite in depth.

Configuration Overview

There are two methods for running seperate IP ranges on each of the interfaces which yeild two rather dissimilar results.

iptables method

Rather than splitting up br0, some may find it addequate to use the Iptables command to allow routing between two subnets on the LAN/WLAN side. Since br0 is not being split up, there are no/fewer problems caused in the web interface. The major draw back to this is that if wireless users statically assign an IP on the LAN ip address range, the bridge will allow them access. A trick might be to set the WLAN ip range to the default (192.168.1.x) and the LAN ip range to something odd (10.15.25.x, or 192.168.152.x or something) to prevent WLAN users from guessing the ip range.

You can use any private ip ranges you would like, but for this example I will use 192.168.1.x for the LAN ports and 192.168.2.x for the WLAN port.

Basic Steps:

Enable a static route for 192.168.1.x to vlan0
Enable a static route for 192.168.2.x to eth1
Enable DHCP for 192.168.1.x for vlan0
Enable DHCP for 192.168.2.x for eth1

Bypass the bridge method

In this method we will bypass the br0, disconnecting the Lan and the WLan ports ensuring that everything is processed inside the router. The down side with this is that more web interface options that depend on br0's existance will be broken. Currently it would appear this includes web interface configuration of WEP/WDS.

Basic Steps:
After this stage, br0 is not created using the contents of lan_ifnames as would normally be the case. wifi_* variables have now been created for use with ifup. These steps need only be done once.

Set the lan_ifname nvram variable to vlan0
Set wifi_ifnam to eth1
Set wifi_proto to static
Set wifi_ipaddr to the IP you want your wifi adapter on
Set wifi_netmask to the your wifi netmask (probably 255.255.255.0)
commit to nvram 
reboot

The following commands will need to be done every boot (rc_firewall perhaps?)

Enable a static route for <lan_adapter_network> to/from vlan0 and wan
Enable a static route for <wireless_network> to/from eth1 and wan
Enable DHCP for <lan_adapter_network> for vlan0
Enable DHCP for <wireless_network> for eth1

To match the above example, replace <lan_adapter_network> with 192.168.1.x and <wireless_network> with 192.168.2.x

Vlan Web Interface method

Someone experimenting in the forums discovered that by not assigning the WLAN interface to any vlan he could seperate the wireless and lan to seperate networks. He was unable to configure WEP/WDS on the wireless link, however. I don't intend to explore this option further in the wiki, as I can find no other documentation describing this type of method for other firmwares. If you don't care about WEP/WDS, this might be easier than the bypass method described above.

Basic Steps (as I understand them)

Change "Wireless to None" under VLAN in the [Web Interface]
ADD "wlconf eth1 up" to rc_startup or Wlan back up.
Enable a static route for <lan_adapter_network> to/from vlan0 and wan
Enable a static route for <wireless_network> to/from eth1 and wan
Enable DHCP for <lan_adapter_network> for vlan0
Enable DHCP for <wireless_network> for eth1

To match the above example, replace <lan_adapter_network> with 192.168.1.x and <wireless_network> with 192.168.2.x

Config Implementation

Here we will describe the actual commands needed to accompolish the basic steps overviewed above.

Using iptables

needs to be written

Bypassing the Bridge

Not yet fully tested. Do not know if wep/wds work from web config of if wl command will be needed.

Since the file /etc/network/interfaces file doesn't exist on DD-WRT as it does on OpenWRT, we have to use the ifconfig command to configure the interfaces and those wifi_* variables from before don't have a script to read them, so they're useless right now. But we can still do it manually.

For this example I'm placing the wifi on 192.168.2.x and 192.168.1.1 is the LAN ip.

MAKE SURE THE ROUTER IS IN AP MODE
  If not, set to AP mode and then reboot the router.

Seperate the Bridge and configure initial Wifi

nvram set lan_ifname=vlan0
nvram commit
reboot

Setup the eth1 interface

ifconfig eth1 down
ifconfig eht1 192.168.2.1 netmask 255.255.255.0
ifconfig eth1 up

Setup Routes

iptables -I INPUT -i eth1 -p tcp -j ACCEPT
iptables -I FORWARD -i eth1 -p tcp -j ACCEPT

Setup DHCP & DNS on Wifi interface

iptables -I INPUT -i eth1 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
iptables -I INPUT -i eth1 -p udp --dport 53 -j ACCEPT
killall -q -9 dnsmasq
sed /^interface.*/d /tmp/dnsmasq.conf > /tmp/dnsmasq.conf.new
echo -n "
pidfile /var/run/udhcpd.pid
start 192.168.2.100
end 192.168.2.149
max_leases 50
interface eth1
remaining yes
auto_time 30
lease_file /tmp/udhcpd.leases
statics_file /tmp/udhcpd.statics
option subnet 255.255.255.0
option router 192.168.2.1
option lease 86640
option dns $(nvram get wan_dns)
" > /tmp/udhcpdeth1.conf
udhcpd /tmp/udhcpdeth1.conf

Undo

If you want to put your router back with the wifi and wlan bridged give the commands

nvram unset rc_firewall
nvram lan_ifname="br0"
nvram commit
reboot

Using a script to parse wifi_* Variables

To make configuration easier, I've written a script that accepts wifi_* nvram variables. This is essentially how the OpenWRT firmware does this, as I understand it. After it's setup, you can change your wifi settings by simply updating the nvram variables and rebooting!

nvram set lan_ifname=vlan0
nvram set wifi_ifname=eth1
nvram set wifi_proto=dhcp
nvram set wifi_ipaddr=192.168.2.1
nvram set wifi_netmask=255.255.255.0
nvram commit

If you don't want your wifi to use the same dhcp settings as your lan side (same number of leases, same lease time, etc) issue these commands.
(Example will setup dhcp from 192.168.2.100-192.168.2.14 with 120 minute leases)

nvram set wifi_dhcp_start=100
nvram set wifi_dhcp_num=15
nvram set wifi_dhcp_lease=120
nvram commit

Now copy this script to /jffs/etc/wifi_config.sh
Remember, only edit scripts using *nix friendly text editors (such as TextPad or win32pad).

# !/bin/sh
#
##### wifi_config.startup ####
#
# Wifi configuration script by Bob/Paul. 
# Special thanks to loco on the forums for the iptables, dhcp, and dnsmasq code!!

#initialize the variables
WIFI_INTERFACE=$(nvram get wifi_ifname)
WIFI_IPADDRESS=$(nvram get wifi_ipaddr)
WIFI_NETMASK=$(nvram get wifi_netmask)

#Test for extended wifi variables (wifi_dhcp_start, wifi_dhcp_num, & wifi dhcp_lease (in minutes))

#Test for wifi_dhcp_lease
if [ "$(nvram get wifi_dhcp_lease)" = "" ]; then   #default values
 WIFI_DHCP_LEASE=$(nvram get dhcp_lease)
else                                             #else configured...
 WIFI_DHCP_LEASE=$(nvram get wifi_dhcp_lease)
fi

#Test for wifi_dhcp_num
if [ "$(nvram get wifi_dhcp_num)" = "" ]; then 
 WIFI_DHCP_NUM=$(nvram get dhcp_num)
else
 WIFI_DHCP_NUM=$(nvram get wifi_dhcp_num)
fi

#Test for wifi_dhcp_start
if [ "$(nvram get dhcp_start)" = "" ]; then
 WIFI_DHCP_START=$(echo $WIFI_IPADDRESS | cut -f1-3 -d .).$(nvram get dhcp_start)
else
 WIFI_DHCP_START=$(echo $WIFI_IPADDRESS | cut -f1-3 -d .).$(nvram get wan_dhcp_start)
fi

#WIFI_DHCP_END can be configured from what we already know
WIFI_DHCP_END=$(echo $WIFI_IPADDRESS | cut -f1-3 -d .).$(expr $WIFI_DHCP_START + $WIFI_DHCP_NUM - 1)


#if the bridge is down, configure the wifi, else do nothing
if [ "$(nvram get lan_ifname)" != "br0" ]; then
  #bring up the wifi interface with the ip and netmask
  ifconfig $WIFI_INTERFACE down
  ifconfig $WIFI_INTERFACE $WIFI_IPADDRESS netmask $WIFI_NETMASK
  ifconfig $WIFI_INTERFACE up
  
  #setup static routes for the wifi interface
  iptables -I INPUT -i $WIFI_INTERFACE -p tcp -j ACCEPT
  iptables -I FORWARD -i $WIFI_INTERFACE -p tcp -j ACCEPT
  
  #allow dhcp and dns mask on the wifi interface 
  iptables -I INPUT -i $WIFI_INTERFACE -p udp --dport 67:68 --sport 67:68 -j ACCEPT
  iptables -I INPUT -i $WIFI_INTERFACE -p udp --dport 53 -j ACCEPT
  
  #kill dns masq and bring it back up on the wifi and lan interfaces
  killall -q -9 dnsmasq
  sed /^interface.*/d /tmp/dnsmasq.conf > /tmp/dnsmasq.conf.new
  dnsmasq --conf-file /tmp/dnsmasq.conf.new 
  
  #write a new udhcpd script for the wifi interface to /tmp/udhcpd_wifi.conf
  echo -n "
  start $WIFI_DHCP_START
  end $WIFI_DHCP_END
  max_leases WIFI_DHCP_NUM
  interface $WIFI_INTERFACE
  remaining yes
  auto_time 30
  lease_file /tmp/udhcpd.leases
  statics_file /tmp/udhcpd.statics
  option subnet $WIFI_NETMASK
  option router $WIFI_IPADDRESS
  option lease $WIFI_DHCP_LEASE
  option dns $(nvram get wan_dns)" > /tmp/udhcpd_wifi.conf
  
  #bring up udhcpd on the wifi interface
  udhcpd /tmp/udhcpd.eth1.conf
  
fi
 

Now that you've save the script as a to /jffs/etc, make it executable and tell it to load on startup. Since this is basically a firewall setting, we'll add it to the rc_firewall variable. You could also use any of the methods in Startup Scripts

chmod 700 /jffs/etc/wifi_config.sh
nvram set rc_firewall="$(nvram get rc_firewall)
/jffs/etc/wifi_config.sh $
"
nvram commit

Reboot and enjoy!

External Resources

A DD-WRT Forum Thread on the topic
OpenWRT FAQ: 13. Using OpenWRT as a router, instead of a bridge?
OpenWRT FAQ: what is BR0
OpenWRT Mini howto: 3.1. Individual control of all network devices
OpenWRT: How to VLans
OpenWRT: The Ethernet Switch
WLUG-Wiki - ifup(8)
Bridging


You are here: Main Page/DD-WRT Docu (EN)/Seperate Lan and WLan