Guest Network in Access Point Mode

[L&LD]

Try using the main network with a higher (numerical) IP such as 192.168.100.1 to 254. Then put the RT-AC66U_B1 in router mode on its own IP such as 192.168.1.1. This will effectively isolate the 'AC66U_B1 and its clients to themselves.

 

[Vispen74]

Try using the main network with a higher (numerical) IP such as 192.168.100.1 to 254. Then put the RT-AC66U_B1 in router mode on its own IP such as 192.168.1.1. This will effectively isolate the 'AC66U_B1 and its clients to themselves.

Thanks for replying! The problem is that I need both a separated guest wifi as well as the main wifi on the AC66U, that´s because I have wireless surveillance cameras placed over there that needs access to the main wifi. I realize that setting up a VLAN might be the only working configuration for my needs.

 

[L&LD]

@Vispen74, you may want to see if YazFi may work for what you need.

 

[Vispen74]

@Vispen74, you may want to see if YazFi may work for what you need.

Unfortunately YazFi doesn't work in AP-mode [emoji22]

Skickat från min HD1913 via Tapatalk

 

[Grisu]

Or you wait, there are some hints that Aimesh will support guest wifi on nodes in near (whatever that means) future.

 

[Vispen74]

Or you wait, there are some hints that Aimesh will support guest wifi on nodes in near (whatever that means) future.

I have heard about this for years now it will be in the Asus aimesh 2.0, but it never happens (yet).
Do you have some source for new information about this?
If it's going to be implemented, it will be awesome!

Skickat från min HD1913 via Tapatalk

 

[Grisu]

Different from previous announcements of 2.0 Merlin found some code in last GPL which let him think that it may come with 386 firmwares.
Read Merlin threads from this year, dont want to search.

 

[L&LD]

Unfortunately YazFi doesn't work in AP-mode [emoji22]

Skickat från min HD1913 via Tapatalk

Exactly, that is why you put the router in router mode.

If you can logically segregate the clients to work like that.

 

[Vispen74]

Exactly, that is why you put the router in router mode.

If you can logically segregate the clients to work like that.

Would you mind explaining how to do this? If I put the AP in router mode, should it still be connected through a LAN port, or should it use the WAN port connecting to main router to make it work?

Skickat från min HD1913 via Tapatalk

 

[L&LD]

First, put your main router as outlined in post 21.

Then, with the current AP, perform a full reset to factory defaults, including checking the 'Initialize all settings...' checkbox and plug into the WAN port from the main router. Configure the second router with a lower (numerical) IP range and put on the guest access as you wish.

Those guests should now be isolated to themselves and to the internet.

HTH.

 

[supergreen]

First, put your main router as outlined in post 21.

Then, with the current AP, perform a full reset to factory defaults, including checking the 'Initialize all settings...' checkbox and plug into the WAN port from the main router. Configure the second router with a lower (numerical) IP range and put on the guest access as you wish.

Those guests should now be isolated to themselves and to the internet.

HTH.

Hi @L&LD !

Going to try this, as I have an AC86u (main router) and an AC68u (AP mode). I would like to isolate AC68u since it is only for help broadcasting to temporary neighbors, but it currently does not isolate the guest network due to being in AP mode. Below is what I have found from Asus:

Here is how AP Isolation works:

AP Isolation works per interface (hardware-wise), which means device on the same interface will see other devices that are located on the same interface.

AP node is connected to the main router via cable, here is how the packets are delivered from main router to AP node:

• 2.4GHz Client(main) --> Ethernet(main) --> Ethernet(AP) --> 2.4GHz Client(AP)

Since packets are transferring throughout the two 2.4G interfaces, thus AP isolation does not take effect.



Now in repeater mode, the connection is via Wi-Fi, so you can treat the repeater and main router as different interfaces, here is how packets are delivered from main router to repeater, Red X mark is where isolation takes effect:

• 2.4GHz Client(main) -X-> Repeater 2.4GHz Upstream(to main 2.4GHz) --> Repeater 2.4GHz Downstream --> 2.4GHz client(Repeater)

When I set it up in router mode to resolve my isolation issue like you have advised in earlier posts, do I need to worry about the gateway on the secondary AC68u?

 

[bbunge]

Hi @L&LD !

Going to try this, as I have an AC86u (main router) and an AC68u (AP mode). I would like to isolate AC68u since it is only for help broadcasting to temporary neighbors, but it currently does not isolate the guest network due to being in AP mode. Below is what I have found from Asus:

Here is how AP Isolation works:

AP Isolation works per interface (hardware-wise), which means device on the same interface will see other devices that are located on the same interface.

AP node is connected to the main router via cable, here is how the packets are delivered from main router to AP node:

• 2.4GHz Client(main) --> Ethernet(main) --> Ethernet(AP) --> 2.4GHz Client(AP)

Since packets are transferring throughout the two 2.4G interfaces, thus AP isolation does not take effect.



Now in repeater mode, the connection is via Wi-Fi, so you can treat the repeater and main router as different interfaces, here is how packets are delivered from main router to repeater, Red X mark is where isolation takes effect:

• 2.4GHz Client(main) -X-> Repeater 2.4GHz Upstream(to main 2.4GHz) --> Repeater 2.4GHz Downstream --> 2.4GHz client(Repeater)

When I set it up in router mode to resolve my isolation issue like you have advised in earlier posts, do I need to worry about the gateway on the secondary AC68u?

With the 386 code base available for both routers you can use AiMesh to get Guest WIFI on the AC68U. Just set the AX86U to use different SSID's for 2.4 and 5 GHz.

 

[supergreen]

With the 386 code base available for both routers you can use AiMesh to get Guest WIFI on the AC68U. Just set the AX86U to use different SSID's for 2.4 and 5 GHz.

Yes I am aware of that and did have that implemented. The only caveat is that AiMesh has a horrible time keeping the guest devices binded/bound to the AiMesh node, which is by far the closest AP to the neighbors. Not that it truly matters but maybe its my OCD that wants them always connected to the node. Node was in ethernet backhaul btw.

 

[Tech9]

What exactly you are planning to do? A router in double NAT connected to yours may not isolate much.

 

[supergreen]

What exactly you are planning to do? A router in double NAT connected to yours may not isolate much.

All good now, setup secondary router (AC68u) in router mode and configured. Its intended use is to broadcast to neighbors to provide a better wireless signal, but I wanted to ensure the network is isolated (which cant be done in AP mode) and the Aimesh was not keeping their clients bound to it when it was setup as the closest node.

Thanks to all for your help.

 

[Tech9]

If your neighbors have access to AC68U main network, they have access to your devices as well.

 

[supergreen]

If your neighbors have access to AC68U main network, they have access to your devices as well.

I have guest wifi setup with Yazfi installed configured with no access, which is the only connecting they have. From my limited experience, my testing seems to show that access is restricted. But obviously I could be missing something.

 

[Tech9]

Guest Network is good. Main network can access your devices. The only potential issue - your neighbors' online activities are your responsibility.

 

[ColinTaylor]

All good now, setup secondary router (AC68u) in router mode and configured. Its intended use is to broadcast to neighbors to provide a better wireless signal, but I wanted to ensure the network is isolated (which cant be done in AP mode) and the Aimesh was not keeping their clients bound to it when it was setup as the closest node.

I have guest wifi setup with Yazfi installed configured with no access, which is the only connecting they have. From my limited experience, my testing seems to show that access is restricted. But obviously I could be missing something.

Yazfi won't do anything to isolate the clients from your upstream router (unless you're forcing the clients through a VPN). It's only going to isolate clients from the LAN of the AC68U, just like the regular guest networks do.

By putting the AC68U into router mode you have created a separate subnet, but separate is not the same as isolated. Clients connected to the AC68U can still access devices on the other router's LAN if the client knows the address and the device allows it.

To block access from the AC68U to the AC86U's LAN you would likely need to use the Network Services Filter on the AC68U.

On the other hand having two different networks will stop casual browsing and discovery of network resources connected to the AC86U. If the guest users are trustworthy and unlikely to attempt a deliberate, technically advanced hack of your network that may be sufficient.

 

[Tech9]

He is using the Guest Network on this router to isolate clients from it's own subnet, as far as I understand. I don't know what YazFi is helping there.