V24: WLAN separate from LAN, with independent DHCP

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 19:20, 1 September 2008 (edit)
Brian Cunnie (Talk | contribs)
(Setup→VLANs)
← Previous diff
Revision as of 21:26, 16 September 2008 (edit) (undo)
TestedDoughnut (Talk | contribs)
(Configuration)
Next diff →
Line 2: Line 2:
-== Configuration ==+===Overview===
 + The goal of this article is to separate the wireless LAN from the hardwired LAN, with an independent class c network for both interfaces. For security purposes, we will prevent communication between both networks, as well as between wireless clients. This way, the wireless network is able to be a little more lax on security without the threat of unsecured access to the wired network. This is a good implementation for wireless cafés and other businesses that provide wireless Internet access to their customers.
-Informal Description: I wanted to create a firewall that would have a separate WLAN from LAN. The WLAN would be unsecured (no WEP, no WPA) so as to allow my poor-but-attractive female neighbors access to the Internet without exposing my private network.+===Setup===
 + The configuration takes about 20 minutes to complete. For this tutorial, I used a WRT54GL v1.1 with DD-WRT NoKaid v24 sp1. I've also done this setup on a WRT54G v8.2 with DD-WRT Micro v24 sp1, so I imagine that any version of DD-WRT v24 sp1 would work with this. For this scenario, we will set the wired network to 192.168.1.1/24 and the wireless network to 192.168.2.1/24.
-I wanted to block outbound mail ports on the WLAN to preclude roaming spammers from using my unsecured WLAN as a launching pad to send their spam. 
-I also wanted to make sure that several services I run (i.e. ssh, dns, ntp) were forwarded to the appropriate machine on the internal network.+== Configuration ==
- +
-* Hardware: Linksys WRT54GL v1.1+
-* Software: DD-WRT v24 SP1+
-* External IPs+
-** 173.8.141.153+
-** 173.8.141.154+
-** 173.8.141.155+
-* Internal IPs+
-** 10.9.9.0/24 (private network)+
-** 10.8.8.0/24 (open wifi network)+
- +
-=== Step 1: ===+
- +
-==== Setup→Basic Setup ====+
- +
-{| border="1" cellpadding="2" cellspacing="0"+
-|+ Wan Setup Options+
-|-+
-|Connection Type || '''Static IP'''+
-|-+
-|Wan IP Address||'''173.8.141.153'''+
-|-+
-|Subnet Mask||'''255.255.255.248'''+
-|-+
-|Gateway||'''173.8.141.158'''+
-|-+
-|Static DNS 1||'''68.87.76.178'''+
-|-+
-|Static DNS 2||'''66.240.48.9'''+
-|}+
- +
-{| border="1" cellpadding="2" cellspacing="0"+
-|+ Optional Settings+
-|-+
-|Router Name||'''lili'''+
-|-+
-|Host Name||'''lili'''+
-|-+
-|Domain Name||'''nono.com'''+
-|}+
- +
-{| border="1" cellpadding="2" cellspacing="0"+
-|+ Router IP+
-|-+
-|Local IP Address||'''10.9.9.1'''+
-|-+
-|Subnet Mask||'''255.255.255.0'''+
-|}+
- +
-{| border="1" cellpadding="2" cellspacing="0"+
-|+ Network Address Server Settings (DHCP)+
-|-+
-|DHCP Type||'''DHCP Server'''+
-|-+
-|Start IP Address||'''10.9.9.10'''+
-|-+
-|Maximum DHCP Users||'''200'''+
-|-+
-|Client Lease Time||'''600'''+
-|-+
-|Use DNSMasq for DHCP||'''checked'''+
-|-+
-|Use DNSMasq for DNS||'''checked'''+
-|-+
-|DHCP-Authoritative||'''checked'''+
-|}+
- +
-FYI, according to [http://en.wikipedia.org/wiki/Daylight_saving_time wikipedia], "Starting in 2007, most of the United States and Canada observe DST from the second Sunday in March to the first Sunday in November."+
- +
-{| border="1" cellpadding="2" cellspacing="0"+
-|+Time Settings+
-|-+
-|NTP Client||'''Enable'''+
-|-+
-|Time Zone||'''UTC-08:00'''+
-|-+
-|Summer Time (DST)||'''2nd Sun Mar - first Sun Nov'''+
-|-+
-|Server IP/Name||'''0.us.pool.ntp.org'''+
-|}+
- +
-==== Setup→VLANs ====+
- +
-{| border="1" cellpadding="2" cellspacing="0"+
-|+VLAN+
-|-+
-|Wireless||'''None'''+
-|}+
-[[User:Brian Cunnie|Brian Cunnie]] 19:56, 1 September 2008 (CEST)+====Step 1====
 + First, we will log into the router interface and go to Wireless > Basic Settings. Change Network Configuration from Bridged to Unbridged. This will bring up 3 new settings. For IP Address enter 192.168.2.1 and for Subnet Mask enter 255.255.255.0. Click Apply Settings. Now click on Wireless > Advanced Settings. Change AP Isolation from Disable to Enable and click Apply Settings. This will prevent wireless clients from communicating with each other. As far as wireless encryption goes, that's up to your preferences. I'm not going to cover it in this article.
-==== Wireless→Basic Settings ====+====Step 2====
 + Now that we have the wireless network setup, we need to have the DHCP server issue IP addresses within its range. To do this, first go to Setup > VLANs. Scroll to the bottom and change Wireless from LAN to None. Click Apply Settings. Now go to Setup > Networking. Scroll to the bottom and click Add under Multiple DHCP Server. This will bring up several new options. Set the first option to eth1 (the wireless adapter) and leave the other default settings as they are. Click Apply Settings.
-{| border="1" cellpadding="2" cellspacing="0"+====Step 3====
-|+Wireless Physical Interfaces wl0+ Now we have the wireless and wired on their own class c networks, all we have to do now is prevent them from talking to each other. Goto Administration > Commands. Now put the following commands into the text box:
-|-+
-|Wireless Network Name||'''play_nicely'''+
-|-+
-|Network Configuration||'''Bridged'''+
-|}+
-==== Wireless&rarr;Wireless Security ====+<pre>
 +iptables -t nat -I PREROUTING -i eth1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -j DROP
 +iptables -t nat -I PREROUTING -i br0 -d $(nvram get eth1_ipaddr)/$(nvram get eth1_netmask) -j DROP
 +</pre>
-{| border="1" cellpadding="2" cellspacing="0"+Click Save Firewall, reboot the router for good measure, and BAM! You now have your LAN on the 192.168.1.1/24 network and your wireless on 192.168.2.1/24, without access to each other.
-|+Wireless Security wl0+
-|-+
-|Security Mode||'''Disabled'''+
-|}+

Revision as of 21:26, 16 September 2008

The goal is to separate the WLAN and LAN ports from each other using the v24 GUI.


Contents

Overview

The goal of this article is to separate the wireless LAN from the hardwired LAN, with an independent class c network for both interfaces. For security purposes, we will prevent communication between both networks, as well as between wireless clients. This way, the wireless network is able to be a little more lax on security without the threat of unsecured access to the wired network. This is a good implementation for wireless cafés and other businesses that provide wireless Internet access to their customers.

Setup

The configuration takes about 20 minutes to complete. For this tutorial, I used a WRT54GL v1.1 with DD-WRT NoKaid v24 sp1. I've also done this setup on a WRT54G v8.2 with DD-WRT Micro v24 sp1, so I imagine that any version of DD-WRT v24 sp1 would work with this. For this scenario, we will set the wired network to 192.168.1.1/24 and the wireless network to 192.168.2.1/24.


Configuration

Step 1

First, we will log into the router interface and go to Wireless > Basic Settings. Change Network Configuration from Bridged to Unbridged. This will bring up 3 new settings. For IP Address enter 192.168.2.1 and for Subnet Mask enter 255.255.255.0. Click Apply Settings. Now click on Wireless > Advanced Settings. Change AP Isolation from Disable to Enable and click Apply Settings. This will prevent wireless clients from communicating with each other. As far as wireless encryption goes, that's up to your preferences. I'm not going to cover it in this article.

Step 2

Now that we have the wireless network setup, we need to have the DHCP server issue IP addresses within its range. To do this, first go to Setup > VLANs. Scroll to the bottom and change Wireless from LAN to None. Click Apply Settings. Now go to Setup > Networking. Scroll to the bottom and click Add under Multiple DHCP Server. This will bring up several new options. Set the first option to eth1 (the wireless adapter) and leave the other default settings as they are. Click Apply Settings.

Step 3

Now we have the wireless and wired on their own class c networks, all we have to do now is prevent them from talking to each other. Goto Administration > Commands. Now put the following commands into the text box:

iptables  -t nat -I PREROUTING -i eth1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -j DROP
iptables  -t nat -I PREROUTING -i br0 -d $(nvram get eth1_ipaddr)/$(nvram get eth1_netmask) -j DROP

Click Save Firewall, reboot the router for good measure, and BAM! You now have your LAN on the 192.168.1.1/24 network and your wireless on 192.168.2.1/24, without access to each other.