Asus RT-AX88U Guest Printing

[Ace Perception]

Hi,
I've just bought an Asus RT-AX88U, it has several features over and above my ISP router that I want to use. So I've swapped all my devices over from the ISP router to the Asus router.
I have however come across one problem, one of the features I'm using on the Asus router is Guest wifi but using this means machines on the guest wifi are unable to print to my wireless printer.
I could resolve this by leaving the printer wirelessly connected to the ISP router, which as its considered part of the WAN would mean normal and guest connections could access it but I figured that having the Asus router sat next to my ISP router with the wifi active on both of them was a bad idea from an interference point of view.
I've had a look around for a solution and one that I've seen here seems to be to install the Merlin firmware, and then enable scripting functionality on the router and set up a script I've seen mentioned here to put an exception into the router firewall to allow guest connections to connect to the manually set IP of my printer.
One question I have is that the firmware supplied with my router is 3.0.0.4.384_9107, whereas the Merlin firmware version is 384.18.
So how does this Merlin version number relate to the Asus version number? Could I be losing any functionality by switching to the Merlin firmware?

 

[tekrich]

In the settings for the Guest network, enable "Access Intranet" for the guest account that you have set up.

 

[Ace Perception]

In the settings for the Guest network, enable "Access Intranet" for the guest account that you have set up.

But if I do that it completely negates the point of using the Guest wi-fi feature, in that it isolates the guest network from my LAN.

 

[Klueless]

Well, you could have "guest" and then "trusted guest" for printing (and regularly change passwords as trusted guests rotate in and out)?

Or maybe use Bluetooth for printing?

 

[ColinTaylor]

But if I do that it completely negates the point of using the Guest wi-fi feature, in that it isolates the guest network from my LAN.

I take your point but "Guest" doesn't mean "isolated from the LAN", that's why there's a separate option for that.

Side note: Unfortunately the router's LAN isolation is a binary choice, on or off. If it weren't things start to get complicated in the GUI. For example, you don't trust your guests (maybe they're members of the public) so you isolate them from the LAN. If you want to make an exception for the LAN printer you have broken your security. If you allow guest access to the printer IP guests might be able to telnet or ssh onto the printer effectively giving them complete access to the LAN. You could restrict access by IP and port number but then things really get complicated and confusing for the average user. And it still doesn't mitigate against vulnerabilities using the standard printer ports.

Regarding Merlin's firmware, you can look in the change log and see which Asus GPL is being used for your particular model. It's usually the latest version available, although obviously there will always be a delay between Asus releasing it and Merlin implementing it. So for you it looks like Merlin's 384.18 is based on 384_8563, and the upcoming 384.19 will be based on a combination of 384_9354 and 384_9107. Merlin adds functionality, he doesn't remove any.

 

[Ace Perception]

I take your point but "Guest" doesn't mean "isolated from the LAN", that's why there's a separate option for that.

Side note: Unfortunately the router's LAN isolation is a binary choice, on or off. If it weren't things start to get complicated in the GUI. For example, you don't trust your guests (maybe they're members of the public) so you isolate them from the LAN. If you want to make an exception for the LAN printer you have broken your security. If you allow guest access to the printer IP guests might be able to telnet or ssh onto the printer effectively giving them complete access to the LAN. You could restrict access by IP and port number but then things really get complicated and confusing for the average user. And it still doesn't mitigate against vulnerabilities using the standard printer ports.

Regarding Merlin's firmware, you can look in the change log and see which Asus GPL is being used for your particular model. It's usually the latest version available, although obviously there will always be a delay between Asus releasing it and Merlin implementing it. So for you it looks like Merlin's 384.18 is based on 384_8563, and the upcoming 384.19 will be based on a combination of 384_9354 and 384_9107.

You're right, I didn't consider that some people may want to use the Guest wi-fi feature to simply time limit guest's access to both their internet and LAN resources, but that is why the option is there.
I understand what you mean re the security risk of a firewall exception for the printer but none of my relatives are that tech savvy and even the security software on my work laptop isn't that intrusive (I think!).
My intention is to figure something out from one of these options :
https://www.snbforums.com/threads/printing-to-lan-printer-from-guest-wireless-networks.34972/
https://www.snbforums.com/threads/allow-guest-network-access-to-single-ip-for-printer.41525/
https://www.snbforums.com/threads/guest-network-question.36500/#post-298242

Thanks for the info re the Merlin build, I think I might wait until 384.19 is out then and then have a go at it. In the meantime I'll swap the printer back and fore as required, although its a real pain to connect to the router as WPS doesnt seem to work for it to the Asus router for some reason (works fine for my ISP router), so I don't want to be doing that forever.

 

[L&LD]

@Ace Perception, install the current (latest) Alpha RMerlin build and use YazFi and you can have it all.

 

[ColinTaylor]

@Ace Perception, install the current (latest) Alpha RMerlin build and use YazFi and you can have it all.

I was wondering about using YazFi but couldn't see where to pinhole the printer. Where/how do you do that?