gnMerlin - Guest Network Isolation

[vlord]

I am aware of other projects out there that focus on various aspects of the guest network but none really fit my use case. I wanted an easy way to lock down my guest network on my access points not running Asus Mesh and from a simple script, this project was born. It has the added benefit of working on my router without needing to disable "access intranet" in the UI. With gnMerlin DNS, DHCP all still work the same including use of AdGuardHome.

gnMerlin - Guest Network Isolation for ASUS Merlin​

gnMerlin is a shell script designed to isolate guest wireless networks on routers running ASUS Merlin firmware. This script utilizes ebtables to block traffic between the main network and guest networks while allowing communication with the router.

Features​

• Isolates guest networks on selected wireless interfaces.
• Blocks forwarding of guest traffic, ensuring guest clients can only communicate with the router.
• Simple CLI interface to manage and configure isolation.
• Supports update checks and installation of the latest version.
• Handles custom network interface selection.
• Option to uninstall and remove all configured rules.

Requirements​

• ASUS Merlin firmware installed on your router.
• Access to /jffs partition for custom scripts.
• ebtables installed (can be checked via ebtables -L).

Installation​

1. Download Script
   Download gnMerlin.sh file to a suitable location. Options:
   • curl -o ./gnMerlin.sh https://raw.githubusercontent.com/phantasm22/gnMerlin/main/gnMerlin.sh
   • wget https://raw.githubusercontent.com/phantasm22/gnMerlin/main/gnMerlin.sh
2. Make Script Executable
   Run the following command to make the script executable:
   chmod +x ./gnMerlin.sh
   
   
3. Run Script
   To run the script and configure guest network isolation:
   ./gnMerlin.sh

Usage​

Once the script is running, you will be presented with a menu offering several options:

1. Install or Update Guest Network Isolation
   Configure or update network isolation for your guest interfaces. You can select from available wireless interfaces for isolation. Examples of interfaces:
   • wl0.1 = first guest network on 2.4GHz
   • wl0.2 = second guest network on 2.4GHz
   • wl1.1 = first guest network on 5GHz
   • wl1.1 = second guest network on 5GHz
2. List All Ebtables Rules
   Display the current ebtables rules and chains.
3. Delete Ebtables Rules for gnMerlin
   Remove the ebtables rules created by gnMerlin for network isolation.
4. Flush All Ebtables Rules
   Flush all ebtables rules, including those unrelated to gnMerlin.
5. Update gnMerlin Script
   Check for new versions of the script and update if available.
6. Uninstall Guest Network Isolation
   Remove all gnMerlin-related configurations, including the script and any applied rules.

Uninstall​

To uninstall gnMerlin and remove all its rules:

1. Run the script and select the Uninstall Guest Network Isolation option from the main menu.
2. Alternatively, you can manually delete the script and any related entries from /jffs/scripts/services-start:
   rm /jffs/scripts/gnMerlin.sh
   sed -i '/gnMerlin.sh/d' /jffs/scripts/services-start
   

Troubleshooting​

• No Wireless Interfaces Found
  Ensure that wireless interfaces on your router match the wl<digit>.<digit> format. The script will only recognize interfaces with this format.
• Ebtables Not Installed
  If ebtables is not found, install it using your router's package manager, or ensure your firmware includes it.
• MAC Address or Gateway Not Found
  The script relies on your router's default gateway and ARP table to configure forwarding exceptions. Ensure your router is properly configured and has an active network.

Versioning​

This project follows Semantic Versioning (SemVer). For the available versions, see the tags on this repository.

License​

This project is licensed under the GNU General Public License v3.0. See the LICENSE file for details.

Contact​

For any issues or suggestions, feel free to open an issue on the GitHub repository or contact me directly.

 

[vlord]

Reserved post

 

[SubNoize]

congrats and thanks for sharing.

Can this do the following? Isolate guest 1 2.4 and 5ghz from the main network whilst sharing access between the 2.4 & 5ghz guest network?

Say for example a share house. Room mate 1 has access to the main network, room mate 2 has access to guest 1 2.4 and 5ghz and a chromecast device on 2.4ghz can talk to a phone on 5ghz?

 

[vlord]

Thanks for the question. Each device on the isolated networks will not be able to communicate with other devices on that same network or other networks. They will only be able to communicate to the internet via the AP/GW IP addresses. For cloud based devices like Ring, for example, while isolated on the internal network, cloud communication works fine. I haven’t explored partial guest network isolation but it should be possible. There may be other network isolation tools that do this already on non-APs.

 

[tnkrer]

Thanks vlord! Worked great for 3 guest networks on my RT-AX88U set up as AP.