Asus Guest Networks still see and can talk to everything?(RT-N10P, RT-N66U, RT-AC68U)

[knowngni]

Hi guys,

I love Asus routers and have purchased 4 RT-N66u, one AC68U and one RT-N10P.

I've noticed that regardless of stock firmware and Merlin, the Guest Network virtually offers no protection at all.

Everything is seen, and all devices can communicate with each other.

I was hoping to use the RT-N10P as an AP but I don't understand why I can still use windows discovery to see and access all devices on the network.
On the guest network, even with "AP Isolation" enabled, I can still ping all other clients who are hard wired to another router. I can access our internal site which is hosted by a server in the internal LAN. We have 4 networked laser printers, they are all seen, our NAS which we use as in internal dropbox to quickly share files, other coworkers in the office. The guest network acts like this regardless of AP mode or Router Mode (when acting as the main router). Also there is still internet access and router web configuration access unlike the other threads where other people's guest networks seem to do funky things. Mine just acts like a another SSID for the LAN network. Nothing "guest" about it. I've also rebooted in each mode and each times I adjusted settings to ensure the router loaded those settings in.


(We have a small office of 12 people so we don't really need any special hardware)

Thing is I found this to be consistent across all the routers (AC68U, N66U, and N10P. Is there something that I'm not doing or missing? Preferably I would like to still keep the stock firmware on the RT-N10P given that the specs were pretty low in the first place, so I wanted to keep from having to try and flash dd-wrt or tomato which aren't officially supported.

I imagined that the AP/router(in router mode) should have denied any requests to other internal clients (for example drop any connection attempts to any other local IP in the same local subnet with the exception of the gateway IP) That way any clients on the AP/router could only communicate with the internet and not the internal network.


I've already gotten around this issue by using a Netgear Tomato router creating two LAN's and setting LAN2 without any routes to LAN1 and connecting the AP to LAN2, but as I purchase more and more ASUS hardware, I'd kinda like to figure this out if possible.

 

[phayze]

Guest SSID dun work in AP mode. It will only work when it is in router mode. In AP mode, it is basically an access point without routing function.

 

[F5ing]

knowngni, have you gotten these guest networks working as you'd expect them to?

What firmware versions are you running on them?

 

[RLBL]

Something to check:

On the guest Network, ensure that "access Intranet" is turned off.

NB: You can turn it on/off more-or-less on the fly (the router will reboot).

 

[F5ing]

Something to check:

On the guest Network, ensure that "access Intranet" is turned off.

Good point! I can imagine when first using the UI to set things up someone might be thinking "internet rather than intranet when deciding what to select for that option.

 

[StevenG]

You shouldn't be able to access LAN IPs when on the guest network if Intranet access is off, but I have found that you can at least still access the gateway IP (your router internal IP). I wish that could be prevented. Or can it and I just don't know how?

 

[F5ing]

You shouldn't be able to access LAN IPs when on the guest network if Intranet access is off, but I have found that you can at least still access the gateway IP (your router internal IP). I wish that could be prevented. Or can it and I just don't know how?

Are you running Asus' latest firmware? Or Merlin's or one of the forks?

There was a thread here about a month or so ago about that issue...

 

[starfall]

I wrote a post about guest mode when the router is an AP that may help you -

Actually you can make it work with Asuswrt-Merlin (I tested this on a RT-AC68U and RT-AC56U). As the guess access separation is handled by ebtables, you need to put the following ebtables config into your secondary AP -

ebtables -I FORWARD 1 -d Broadcast -j ACCEPT
ebtables -I FORWARD 1 -s xx:xx:xx:xx:xx:xx -j ACCEPT
ebtables -I FORWARD 1 -d xx:xx:xx:xx:xx:xx -j ACCEPT

Where xx:xx:xx:xx:xx:xx is the MAC address of the primary router's LAN interface (br0).

In short, this will allow the secondary AP guest networks to send broadcast traffic to your LAN for ARP and DHCP, and it will allow your router's LAN interface to communicate with guest users on your AP. By inserting the rules at the front of the FORWARD chain, the traffic will be allowed before it hits the DROP rules that does the guest separation -

-i wl0.1 -j DROP
-o wl0.1 -j DROP
-i wl1.1 -j DROP
-o wl1.1 -j DROP

 

[paraplu]

I wrote a post about guest mode when the router is an AP that may help you -

Actually you can make it work with Asuswrt-Merlin (I tested this on a RT-AC68U and RT-AC56U). As the guess access separation is handled by ebtables, you need to put the following ebtables config into your secondary AP -

ebtables -I FORWARD 1 -d Broadcast -j ACCEPT
ebtables -I FORWARD 1 -s xx:xx:xx:xx:xx:xx -j ACCEPT
ebtables -I FORWARD 1 -d xx:xx:xx:xx:xx:xx -j ACCEPT

Where xx:xx:xx:xx:xx:xx is the MAC address of the primary router's LAN interface (br0).

In short, this will allow the secondary AP guest networks to send broadcast traffic to your LAN for ARP and DHCP, and it will allow your router's LAN interface to communicate with guest users on your AP. By inserting the rules at the front of the FORWARD chain, the traffic will be allowed before it hits the DROP rules that does the guest separation -

-i wl0.1 -j DROP
-o wl0.1 -j DROP
-i wl1.1 -j DROP
-o wl1.1 -j DROP

above ebtables trick works. Thanks for that. But has an disadvantage: it has a negative performance impact on latency.