Feature Request: "Guest" Wireless Intranet ONLY

[Potato Sack]

Merlin,

Thanks for what you do - great firmware, rock solid. I'm wondering if there's a possibility you could add a third option to the Guest Wireless feature.

Basically, I want the option of a Guest Wireless network that can access the internal network, but NOT the internet. Bonus points if you could firewall certain ports and IPs between the untrusted guest network and the trusted network.

I have some devices on my network that I explicitly don't want to talk to the internet for any reason (think IP cameras with suspect Chinese firmware), and I think this would be a good compromise.

Happy to donate for your time!

Thanks!

 

[RMerlin]

Try creating a rule for that camera's IP under Firewall -> Network Services Filter, blocking ports 1:65535.

 

[Potato Sack]

Try creating a rule for that camera's IP under Firewall -> Network Services Filter, blocking ports 1:65535.

Good thinking -- I'll give this a shot. I appreciate the response!

 

[Nullity]

Try creating a rule for that camera's IP under Firewall -> Network Services Filter, blocking ports 1:65535.

Does this block the "ping" command?

If not, is it possible to stop pings through the GUI?

 

[Potato Sack]

Does this block the "ping" command?

If not, is it possible to stop pings through the GUI?

This was actually going to be my next question. The Network Services Filter is OK for making broad rules (blocking 1:65535 on either TCP or UDP), but a little short on doing other things, like:

1) blocking ICMP (this has to be done globally, not per-IP)
2) Adding an exception for certain other types of communication (block everything outbound except NTP, or block everything except to one specific internal IP)
3) Adding more than one type of rule per IP

etc.

I suppose you could start mucking with iptables via CLI, but not sure how to make those changes persist.

 

[Nullity]

The iptables setup should be easy, but I have no experience with iptables. I wish I could help.

You could use the information in the following link to add your iptables rules at boot. https://github.com/RMerl/asuswrt-merlin/wiki/User-scripts