Expand the Guest Network to two merlin routers

Yota · Jan 16, 2020

Today, I will show you how to set up the same guest network on the primary router and the secondary router, and prevent the guest network from accessing resources on the LAN.

What do I need?
I have two RT-AC68U routers, they both flashed Merlin 384.14_2, One is running router mode, the other one is running in AP mode. I need to set a guest network on the AP, and make sure that the guest network cannot access the devices on my LAN.

If you want to do that, you need to set VLANs. but, asus doesn't support setting the VLAN in the GUI of the firmware, which is very troublesome. however, thanks to this great forum, I used two weeks reading each relevant threads and testing scripts, and now I have achieved some results, I think no one has discussed similar topics, so I will share my results and code.

First, enable the guest network on your Primary router and enable JFFS custom scripts and config. Then create the following, you may need to edit it according to your use case.

Primary router (Router mode)
/jffs/scripts/services-start

Code:

#!/bin/sh
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"


robocfg show | grep -i vlan101 > /dev/null 2>&1 || \
(

# Assign a physical port to the VLAN. Note that 5T is a
# RT-AC68U CPU, and different models have different numbers.
robocfg vlan 101 ports "4t 5t"

# I don t understood why to do this,
# looks like setting a VLAN for the WAN.
vconfig add eth0 101
ifconfig vlan101 up

# wl1.1 is Guest WiFi 5GHz 1, I don t enable more SSID,
# so if you want to use it yourself, you may need to edit it.
brctl addbr br1
brctl stp br1 on
brctl delif br0 wl1.1
brctl addif br1 vlan101
brctl addif br1 wl1.1

# Most models use 192.168.50.1 as the default LAN,
# so I use this subnetwork as the guest network.
ifconfig br1 192.168.1.1 netmask 255.255.255.0
ifconfig br1 up

nvram set lan_ifnames="vlan1 eth1 eth2"
nvram set lan_ifname="br0"
nvram set lan1_ifnames="vlan101 wl1.1"
nvram set lan1_ifname="br1"
nvram commit
)

Primary router (Router mode)
/jffs/scripts/firewall-start

Code:

#!/bin/sh
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

# I don t know anything about the rules of iptables and ebtables,
# so I can t guarantee that this setting is safe enough.

# Allow BR1 to access WAN
iptables -D FORWARD -i br1 -m state --state NEW -j ACCEPT >/dev/null 2>&1
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT

# Prevent BR1 from accessing BR0 and vice versa
iptables -D FORWARD -i br1 -o br0 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP

iptables -D FORWARD -i br0 -o br1 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP

# I don t know what it does.
iptables -D INPUT -i br1 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I INPUT -i br1 -m state --state NEW -j DROP

# Allow DNSMASQ to distribute IP addresses for br1.
iptables -D INPUT -i br1 -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

# Allow DNSMASQ to distribute IP addresses for br1.
iptables -D INPUT -i br1 -p udp -m multiport --dport 53,67 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -p udp -m multiport --dport 53,67 -j ACCEPT

sleep 1
killall eapd
eapd

Primary router (Router mode)
/jffs/configs/dnsmasq.conf.add

Code:

interface=br1
dhcp-range=br1,192.168.1.2,192.168.1.254,255.255.255.0,86400s
dhcp-option=br1,3,192.168.1.1
dhcp-option=br1,6,192.168.1.1

Then, set up the same guest network on the secondary router (AP mode), and connect the WAN of the secondary router to the LAN 4 of the primary router. Create the following script for the secondary router

Secondary router (AP Mode)
/jffs/scripts/services-start

Code:

#!/bin/sh
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"

robocfg show | grep -i vlan101 > /dev/null 2>&1 || \
(
robocfg vlan 101 ports "0t 5t"
vconfig add eth0 101
ifconfig vlan101 up

brctl addbr br1
brctl delif br0 wl1.1
brctl addif br1 vlan101
brctl addif br1 wl1.1
ifconfig br1 up

nvram set lan_ifnames="vlan1 eth1 eth2"
nvram set lan_ifname="br0"
nvram set lan1_ifnames="vlan101 wl1.1"
nvram set lan1_ifname="br1"
nvram commit

killall eapd
eapd
)

Finally restart both routers and you should get a perfect extended guest network. However, it is not a hundred percent perfect. For example, you cannot to PING secondary router from the guest network of the primary router, and vice versa. I don't know how to solve it.

What does the scripts do?
Created a VLAN, added Guest WIFI 5GHz 1 to the VLAN, and passed the VLAN to another one router, and the other router also added Guest WIFI to the VLAN.
Allow DHCP to assign different subnets to the VLAN.
Set up some iptables rules to prevent VLANs from accessing the LAN.

Code:

         ╲           ╱            ╲            ╱
  Guest WiFi      LAN WiFi    Guest WiFi   LAN WiFi
           ╲       ╱                ╲        ╱
          │─────────│              │─────────│
          │  Router │──────────────│    AP   │
          │─────────│   LAN&VLAN   │─────────│

Yota · Jan 16, 2020

Reserved

oso2276 · Jan 16, 2020

Nice summary. Thanks

Enviado desde mi moto g(8) plus mediante Tapatalk

FaUst · Jan 29, 2020

Nice - i used your tutorial to make VLAN with only one Asus in router mode, but i cannot forward port to guest (DMZ) network with another address (port forwarding in gui doesnt work).

Yota · Feb 16, 2020

FaUst said:
Nice - i used your tutorial to make VLAN with only one Asus in router mode, but i cannot forward port to guest (DMZ) network with another address (port forwarding in gui doesnt work).

Sorry, I don't know much about that. but, I think that requires more scripts because it involves firewalls, routing tables, etc.

Ronald Schwerer · Feb 16, 2020

Subscribed. Very interesting. I currently solve this problem (extending guest network) by configuring repeaters of my Guest SSID. This is for my dozens of IoT devices scattered over my property (especially the garage and backyard areas). Using your method, I'd also extend my primary SSID coverage. I'd need to get a wired connection to the remote AP(s) but I could use powerline adapters.

Vispen74 · Mar 23, 2020

I´m about to do this on my rt-ac86u. Have anyone tried if the scripts are working with this router, or know what has to be changed?

Stephen Harrington · Mar 23, 2020

Vispen74 said:
I´m about to do this on my rt-ac86u. Have anyone tried if the scripts are working with this router, or know what has to be changed?

Well there is no "robocfg" command for starters ...

Yota · Mar 23, 2020

Vispen74 said:
I´m about to do this on my rt-ac86u. Have anyone tried if the scripts are working with this router, or know what has to be changed?

Stephen Harrington said:
Well there is no "robocfg" command for starters ...

Yes, there are many places that need to be changed. for ac86u the last link might help you.

Vispen74 · Mar 25, 2020

Jack Lee said:
Yes, there are many places that need to be changed. for ac86u the last link might help you.

If I just had the skills to do something useful out of it... I need more or less a ready-to-use script.

Skickat från min HD1913 via Tapatalk

robca · May 15, 2020

Hello @Yota, thanks for putting this together, I was trying something similar (also have two RT-AC68U and I gave up.

Question on a part of your script:

# Most models use 192.168.50.1 as the default LAN,
# so I use this subnetwork as the guest network.
ifconfig br1 192.168.1.1 netmask 255.255.255.0
ifconfig br1 up

Are you saying that your LAN DHCP range is 192.168.50.1-255 and that you are reserving 192.168.1.1-255 for the guest LAN? The reason i'm asking is that my home network uses 192.168.1.1-255, so I would have to choose something else

Just trying to make sure I understand your script before starting to make changes on my routers

Yota · May 16, 2020

robca said:
Hello @Yota, thanks for putting this together, I was trying something similar (also have two RT-AC68U and I gave up.

Question on a part of your script:

# Most models use 192.168.50.1 as the default LAN,
# so I use this subnetwork as the guest network.
ifconfig br1 192.168.1.1 netmask 255.255.255.0
ifconfig br1 up

Are you saying that your LAN DHCP range is 192.168.50.1-255 and that you are reserving 192.168.1.1-255 for the guest LAN? The reason i'm asking is that my home network uses 192.168.1.1-255, so I would have to choose something else

Just trying to make sure I understand your script before starting to make changes on my routers

Hello, the subnet of your guest network should not be the same as your main network (LAN), so you need to change these lines:

Code:

ifconfig br1 192.168.1.1 netmask 255.255.255.0
dhcp-range=br1,192.168.1.2,192.168.1.254,255.255.255.0,86400s
dhcp-option=br1,3,192.168.1.1
dhcp-option=br1,6,192.168.1.1

robca · May 16, 2020

That's what I thought, thanks for confirming (incidentally: thanks for having shared this)

I changed everything to 192.168.20.x, and I can see that I can finally get a DHCP address on the guest lan. Good

I'm still having problems, though. Even if the device on the guest lan gets an IP address (so the iptables for the DHCP traffic works), I can't connect to anything from the AP router (can connect to the internet and nothing else from the main router using guest networks)

It looks as if the vlan101 traffic from the AP router is not being redirected properly, even if at least some portions of the configuration (e.g. DHCP) work

Would it be asking too much to have you post the output of "brctl show" and "robocfg show" for both the main router and the AP? And possibly "iptables -L -v"? Given we have the same router, everything should work just fine.

EDIT: I did notice that my main router had a CPU value of 8t not 5t

1: vlan1: 1 2 3 4 8t
2: vlan2: 0 8

And in another post I found that if the NAT acceleration is enabled (Auto), CTF is on and it shows the CPU as 8t instead of 5t. Disabling that setting it goes back to 5t and now the basic redirection works. CFT optimization messes up quite a few things, so disabling it makes sense

Problem is, it's incredibly unreliable. The connection stops working every few seconds, and even trying to run a speedtest.net test, it usually hangs halfway or shows very unreliable speeds (I usually have around 80 mbps, with the vlan101 enabled it jumps from a few mbps to ~30mbps maximum). I checked the CPU load on the main router (and it's really low), so I'm not sure what I did wrong

Do you have acceptable performance when using a guest network connection?

Yota · May 17, 2020

robca said:
Problem is, it's incredibly unreliable. The connection stops working every few seconds, and even trying to run a speedtest.net test, it usually hangs halfway or shows very unreliable speeds (I usually have around 80 mbps, with the vlan101 enabled it jumps from a few mbps to ~30mbps maximum). I checked the CPU load on the main router (and it's really low), so I'm not sure what I did wrong

Do you have acceptable performance when using a guest network connection?

I apologize for not conducting detailed tests. In fact, I don't use the guest network often, so I don't know this issue.
I would love to help you solve this problem, but these scripts are beyond my ability, and I may not be able to help, sorry.

robca · May 17, 2020

Yota said:
I apologize for not conducting detailed tests. In fact, I don't use the guest network often, so I don't know this issue.
I would love to help you solve this problem, but these scripts are beyond my ability, and I may not be able to help, sorry.

No need to apologize. You have been very kind in sharing this, and in trying to help.

I actually did solve my issue thanks to another suggestion (https://www.snbforums.com/threads/rt-ac68u-guest-networks-in-ap-mode-using-vlan-and-iptables.64172/): the problem is that CTF was enabled on both AC68U, and that creates problems. I did disable CTF on the main router via the UI, but was still enabled in the AP (where there is no UI to turn it off, and I didn't realize i was still active). In order to disable CTF and ensure everything works, you need to issue just once the following (no need to add this to any custom script)

nvram set ctf_disable=1
nvram set ctf_disable_force=1
nvram commit

And then everything works just fine. Thanks again for getting me started

EDIT: just noticed that you have /jffs/script in your explanation, but the actual directory is /jffs/scripts with an s at the end. Just leaving his here for other users that might want to use your scripts as well

Yota · May 18, 2020

robca said:
No need to apologize. You have been very kind in sharing this, and in trying to help.

I actually did solve my issue thanks to another suggestion (https://www.snbforums.com/threads/rt-ac68u-guest-networks-in-ap-mode-using-vlan-and-iptables.64172/): the problem is that CTF was enabled on both AC68U, and that creates problems. I did disable CTF on the main router via the UI, but was still enabled in the AP (where there is no UI to turn it off, and I didn't realize i was still active). In order to disable CTF and ensure everything works, you need to issue just once the following (no need to add this to any custom script)

nvram set ctf_disable=1
nvram set ctf_disable_force=1
nvram commit

And then everything works just fine. Thanks again for getting me started

Thank you for providing the solution, I am glad to see it useful for you. Actually, I think you can test to turn on the CTF of the primary router. I think it will work, because in my use, I have not turned off the CTF of the primary router. and my guests did not complain.

And you can always use this link

Code:

https://SECONDARY_ROUTER_IP:PORT/Advanced_SwitchCtrl_Content.asp

to turn off the CTF of your secondary router, because the page is just hidden and does not disappear.

robca said:
EDIT: just noticed that you have /jffs/script in your explanation, but the actual directory is /jffs/scripts with an s at the end. Just leaving his here for other users that might want to use your scripts as well

The error has been fixed, thank you for telling me that!

robca · May 20, 2020

Adding one more note for any future visitor. Every time the wireless service restarts (for example due to changes to the wireless configuration or even if the system decides to restart the service for any other reasons), the guest networks would go back to the original configuration on br0. I'm not sure how common that is, but if it happens, only a reboot would make the guest networks work again as expected.

It was suggested to add a service-event-end script to handle any wireless service restart and automatically restoring the correct configuration. I provide a simple script to handle this case on this thread https://www.snbforums.com/threads/r...-and-iptables-solved.64172/page-2#post-586080

robca · May 28, 2020

And one more note again for the users of Diversion (https://diversion.ch/), the amazing ad-blocker extension for AsusWRT Merlin.

When using Diversion with pixelserv-tls, clients on the vlan (br1) cannot access pixelserv-tls (usually on the router IP address+1), since all non DNS traffic from br1 to br0 is blocked by the IPTABLES rules. That prevents web pages from loading correctly, while everything else works normally. So two more IPTABLES rules are needed to allow certain pages to load properly

Code:

iptables -I INPUT -i br1 -d 192.168.1.2/32 -p tcp -m multiport --dport 80,443 -j ACCEPT

to unblock the web page. But this alone won't make pixelserv-tls reachable, only allows web pages to load with the ugly grey "can't load the element' box

adding also

Code:

iptables -I FORWARD -i br1 -d 192.168.1.2/32 -p tcp -m multiport --dport 80,443 -j ACCEPT

allows clients on the vlan (hence br1) to reach pixelserv-tls, assuming that it is on 192.168.1.2 (change it to the proper pixelserv-tls address for your installation)

So the updates firewall-start script is

Code:

/jffs/scripts/firewall-start

# Allow BR1 to access WAN
iptables -D FORWARD -i br1 -m state --state NEW -j ACCEPT >/dev/null 2>&1
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT

# Prevent BR1 from accessing BR0 and vice versa
iptables -D FORWARD -i br1 -o br0 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP

iptables -D FORWARD -i br0 -o br1 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP

# DROP NEW packets, will let thru only ESTABLISHED packets
iptables -D INPUT -i br1 -m state --state NEW -j DROP >/dev/null 2>&1
iptables -I INPUT -i br1 -m state --state NEW -j DROP

# Allow DNSMASQ to distribute IP addresses for br1.
iptables -D INPUT -i br1 -p tcp --dport 53 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

# Allow DNSMASQ to distribute IP addresses for br1.
iptables -D INPUT -i br1 -p udp -m multiport --dport 53,67 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -p udp -m multiport --dport 53,67 -j ACCEPT

# Allow guest network devices to access pixelsrv-tls on 192.168.1.2
iptables -D INPUT -i br1 -d 192.168.1.2/32 -p tcp -m multiport --dport 80,443 -j ACCEPT >/dev/null 2>&1
iptables -I INPUT -i br1 -d 192.168.1.2/32 -p tcp -m multiport --dport 80,443 -j ACCEPT

iptables -D FORWARD -i br1 -d 192.168.1.2/32 -p tcp -m multiport --dport 80,443 -j ACCEPT >/dev/null 2>&1
iptables -I FORWARD -i br1 -d 192.168.1.2/32 -p tcp -m multiport --dport 80,443 -j ACCEPT

sleep 1
killall eapd
eapd

WillyTP · Aug 17, 2020

Hello everybody.
I've tried this setup on a 2x RT-AC68U setup, the first as Main Router, the second as AiMesh node.

Guest network configuration on the Main Router seems to work properly, I get the IP in the correct / dedicated range.
However, from the AiMesh node the Guest network isn't transmitted at all.

I believe I'm missing something...
From other guides I've found here, I've enabled SSH on node, disabled CTF, enabled JFFS scripts.

However, post #1 says
Set up the same guest network on the secondary router (AP mode), and connect the WAN of the secondary router to the LAN 4 of the primary router

I have no idea about how doing this in AiMesh node mode.
Any hint?

Thank you all!

paboski · Oct 15, 2020

WillyTP said:
Hello everybody.
I've tried this setup on a 2x RT-AC68U setup, the first as Main Router, the second as AiMesh node.

Guest network configuration on the Main Router seems to work properly, I get the IP in the correct / dedicated range.
However, from the AiMesh node the Guest network isn't transmitted at all.

I believe I'm missing something...
From other guides I've found here, I've enabled SSH on node, disabled CTF, enabled JFFS scripts.

However, post #1 says
Set up the same guest network on the secondary router (AP mode), and connect the WAN of the secondary router to the LAN 4 of the primary router

I have no idea about how doing this in AiMesh node mode.
Any hint?

Thank you all!

Did you managed to get it working ?
I also have an Aimesh setup and need to have guest network propagate to the node

Thread starter	Title	Forum	Replies	Date
M	Any workaround to expand Guest Network 'features' on Mesh for IoT Devices \| AX86U	Asuswrt-Merlin	2	Aug 28, 2024
	package to expand Parental Controls - Web & Apps Filters?	Asuswrt-Merlin	4	Monday at 9:56 AM
R	Disable Intranet access for a LAN port (not the WiFi Guest network)?	Asuswrt-Merlin	10	Nov 10, 2024
T	GT BE98 Pro Guest Network Cannot Disable Intranet Access	Asuswrt-Merlin	3	Nov 6, 2024
	Printing from Guest Network (ASUSWRT-Merlin 3004.388.8_2)	Asuswrt-Merlin	5	Oct 4, 2024
W	Quick Network/Guest question	Asuswrt-Merlin	14	Sep 30, 2024
R	RT-AX86U Pro LAN Port on Guest Network	Asuswrt-Merlin	9	Sep 25, 2024
I	Guest net / subnet for wired connections?	Asuswrt-Merlin	4	Sep 13, 2024
J	Devices connected through wifi extender are showing up under guest IP subnet	Asuswrt-Merlin	3	Sep 5, 2024
	Solved Guest network On VPN on 3004-388.8_2	Asuswrt-Merlin	2	Aug 14, 2024

Expand the Guest Network to two merlin routers

Very Senior Member

Very Senior Member

Regular Contributor

New Around Here

Very Senior Member

Very Senior Member

Occasional Visitor

Very Senior Member

Very Senior Member

Occasional Visitor

Regular Contributor

Very Senior Member

Regular Contributor

Very Senior Member

Regular Contributor

Very Senior Member

Regular Contributor

Regular Contributor

Regular Contributor

New Around Here

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest