![\"Screenshot_2013-12-31-15-32-18\"](\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2013\/12\/Screenshot_2013-12-31-15-32-18.png\")
<\/p>\n<\/p>\n
Recently I was asked to configure a WiFi access point for a small business, who needed to have both a private internal network, and a public guest network.<\/p>\n
There are many privacy concerns when having guests share your network. Specifically, it is desirable to:<\/p>\n
Of course, all this needs to be done without impacting the desired service: Internet access.<\/p>\n
Although I found many guides online for setting up a guest network when the access point was\u00a0also<\/em> the primary router, I didn’t find any that worked for the intended network. So, after some trial, error, and research, I managed to get it to work.<\/p>\n <\/p>\n The following is a description of the desired network.<\/p>\n Private LAN<\/span>: 192.168.1.x<\/span> (DHCP already provided for private addresses, Internet source)<\/p>\n Guest WLAN<\/span>: 192.168.10.x<\/span> (separate DHCP server, isolated from Private LAN)<\/p>\n Wireless SSIDs:<\/p>\n Private_WiFi<\/span> (in this example,\u00a0Internal<\/strong>)<\/p>\n Guest_WiFi<\/span> (in this example,\u00a0Guest<\/strong>)<\/p>\n There is already a wireless home router installed, sharing Internet access with the private network.<\/p>\n We want to do two things:<\/p>\n Let’s move on to the requirements.<\/p>\n This task requires you to have a fresh, default installation of DD-WRT on any compatible router.<\/p>\n The installation of DD-WRT is beyond the scope of this article. I encourage you to consult the DD-WRT Wiki<\/a> to identify compatible devices and their installation procedures.<\/p>\n This article describes the process for integrating private<\/span> + guest<\/span> WiFi Access Points into an existing private network. If you are seeking to add a guest <\/span>network to your existing router, or if you are looking for a dedicated guest<\/span> AP, this is not the solution. It may help you, but continue Googling, and I am certain you will find the guide you need.<\/p>\n Connect your computer directly to the router. Open your web browser, and navigate to http:\/\/192.168.1.1<\/a>.<\/p>\n Since this is a fresh installation, you will need to set your administration username and password. Make it secure!<\/p>\n Now, begin by preparing your wireless networks.<\/p>\n SSIDs<\/span><\/strong><\/p>\n In Wireless -> Basic Settings, enter the desired name and channel for your\u00a0private\u00a0<\/span>SSID. Click Next, click Add, at the bottom, to add a Virtual Access Point (VAP). Enter the name for your\u00a0guest <\/span>SSID, and click Multiple SSIDs can be broadcast from the same AP. The only limitation is that they must be broadcast on the same channel, if you only have one wireless radio. This impacts performance slightly.<\/p>\n Security<\/span><\/strong><\/p>\n In Wireless -> Wireless Security, type in the password(s) you would like for the private and guest networks. Click Although traditionally guest networks have no password, this means that all traffic on the guest network is unencrypted, and easily captured. It is best to create a password that you share, so that your users’ data is secure.<\/p>\n In Setup -> Networking, we will be doing a number of things to separate the guest WLAN from the private one.<\/p>\n The final step for getting DHCP working is on another page. Navigate to the Services tab, add the following to the DNSmasq section, and # Enables DHCP on br1 The reason for this is because we will be disabling the normal DHCP server in our last step, in order to incorporate the Access Point into our private network. Thus we need to configure DNSmasq as the server for the guest<\/span> network.<\/p>\n At this point, we have both private and guest wireless networks. The guest network is still not fully isolated from the private network, and doesn’t have Internet access.<\/p>\n To fix these points, and also add some security, go to the Administration -> Commands page, and copy and paste the following in the Command Shell<\/strong>:<\/p>\n Note: <\/strong>Some people have reported issues with the #Block torrent and p2p section<\/em><\/span>. The limit may be too low to load modern sites, sometimes making the guest network unusable. I would recommend leaving this out unless you want to be really restrictive.<\/p>\n Finally, click “Save Firewall”.<\/p>\n Do not be tempted to change the quotes around the\u00a0nvram<\/strong> commands. It works exactly as is.<\/p>\n The section for blocking P2P works by throttling the maximum number of connections made by a client. P2P services make many connections, which significant impact network performance. So for TCP connections, it limits clients to 50, and for UDP they are limited to 25.<\/p>\n Blocking router services on the guest side is a good security idea. In this example, it prevents telnet, ssh, www and https access to the router.<\/p>\n We are almost done! All that is left is to include it in the private network. To begin, click the Setup tab.<\/p>\n The following steps all need to be done in sequence. Do not click Apply Settings until the very end!<\/p>\n Now that all these settings are in place, you can reconnect your computer to your existing network. Alternatively, you can leave it connected to this router, as the wired connections will still be in the private network.<\/p>\n Connect any of the remaining LAN ports of this guest router to your existing network. The Internet port is disabled in this configuration.<\/p>\n Your computer should now be on your private<\/span> network. Now you can begin testing by connecting a wireless client to the guest<\/span> network, verifying Internet access, and ensuring it cannot communicate with any of the private computers.<\/p>\n The DD-WRT Wiki is very helpful. Here is the specific page<\/a> that helped me get it all working (note the “for WAPs – WAN port disabled” commands.)<\/p>\nNetwork Topology<\/h2>\n
\n
Requirements<\/h2>\n
![\"logo[1]\"](\"https:\/\/blog.danjoannis.com\/wp-content\/uploads\/2013\/12\/logo1.jpg\"){kind=logo}
<\/a><\/p>\n1. Prepare the router<\/h2>\n
2. Create and secure WiFi access points<\/h2>\n
<\/a>.<\/p>\n<\/a>\u00a0again.<\/p>\n<\/p>\n<\/a>.<\/p>\n<\/p>\n3. Begin isolating the guest network<\/h2>\n
<\/a><\/p>\n\n
<\/a>.<\/li>\n<\/a>.<\/li>\n<\/a>.<\/li>\n<\/a>.<\/li>\n<\/ol>\n<\/a>:<\/p>\n
\ninterface=br1
\n# Set the default gateway for br1 clients
\ndhcp-option=br1,3,192.168.10.1
\n# Set the DHCP range and default lease time of 24 hours for br1 clients
\ndhcp-range=br1,192.168.10.100,192.168.10.150,255.255.255.0,24h<\/p><\/blockquote>\n<\/a><\/p>\n4. Firewall Rules<\/h2>\n
\n
#Allow guest bridge access to Internet\r\n iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT\r\n iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu\r\n#Block access between private and guest\r\n iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP\r\n iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`\/`nvram get lan_netmask` -m state --state NEW -j DROP\r\n#NAT to make Internet work\r\n iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`\r\n#Block torrent and p2p\r\n iptables -I FORWARD -p tcp -s 192.168.10.0\/24 -m connlimit --connlimit-above 50 -j DROP\r\n iptables -I FORWARD -p ! tcp -s 192.168.10.0\/24 -m connlimit --connlimit-above 25 -j DROP<\/span>\r\n#Block guest access to router services\r\n iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset\r\n iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset\r\n iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset\r\n iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset<\/pre>\n<\/blockquote>\n<\/a><\/p>\n5. Adding it to the private network<\/h2>\n
<\/a><\/p>\n\n
<\/a><\/li>\n<\/ol>\n6. Making the connections<\/h2>\n
Resources!<\/h2>\n