Guest network in AP mode on RT-AC87U

[P_R]

———
Hi everyone,

I installed Merlin on two new RT-AC87U which will cover my house to replace my aging DLink routers.
One will be in router mode and the other will be in AP mode. One thing I hoped to get working with the Merlin firmware was roaming guest networking between the devices whilst keeping the intranet out of reach from devices on the guest network.

However, I have hit a dead end with trying to get this working. I know on my existing DLinks that all guest network traffic is forcibly routed out of the WAN interface which is not helpful when I have an ethernet trunk running between the two routers on their LAN interfaces.

Given the write ups on Merlin, I had hoped to change the networking configurations on the Access Point ones to bridge / route the guest networks (2.4 and 5Ghz) over the LAN trunks I have and out via the one in Router mode. When going through the interface, robocfg, vlan and bridge configurations, they were terribly misleading (especially coming from a Linux networking background) and am in need of some help. One thing I noticed also that setting the device into AP mode and configuring the guest wireless, the guest networks (both 2.4 and 5Ghz) can access the local network which is obviously not supposed to be able to happen.

If I can get it to work, I will purchase another to replace the 3rd DLink I have (the second one in AP mode on the diagram below).

Here is what my network looks like:

+—————————————————————+
| ISP router          |
|                     |
| wan: <ISP ip>       |
| lan: 192.168.10.254 |
+—————————————————————+
  | lan1
  |
  \————————\
           | w
+————————————————————————+
| RT-AC87U (router mode) |
|                        |
| wan: 192.168.10.1      |
| lan: 192.168.1.1       |
|                        |
| 2.4ghz:       net24    |
| 5ghz:         net5     |
| guest 2.4ghz: guest24  |
| guest 5ghz:   guest5   |
+————————————————————————+
  | lan1  | lan2
  |       |
  |       \—————————————————————\
  | lan1                        | lan1
+———————————————————————+    +———————————————————————+
| RT-AC87U (AP mode)    |    | RT-AC87U (AP mode)    |
|                       |    |                       |
| lan: 192.168.1.2      |    | lan: 192.168.1.3      |
|                       |    |                       |
| 2.4ghz:       net24   |    | 2.4ghz:       net24   |
| 5ghz:         net5    |    | 5ghz:         net5    |
| guest 2.4ghz: guest24 |    | guest 2.4ghz: guest24 |
| guest 5ghz:   guest5  |    | guest 5ghz:   guest5  |
+———————————————————————+    +———————————————————————+

Any help is very much appreciated!!

P.

 

[kvic]

One thing I hoped to get working with the Merlin firmware was roaming guest networking between the devices whilst keeping the intranet out of reach from devices on the guest network.

If you disable "Access Intranet" on the page where you enable guest networks, won't it do what you want?

(I'm not sure if this option is available in AP mode but I can find it in router mode.)

 

[octopus]

———
Hi everyone,

I installed Merlin on two new RT-AC87U which will cover my house to replace my aging DLink routers.
One will be in router mode and the other will be in AP mode. One thing I hoped to get working with the Merlin firmware was roaming guest networking between the devices whilst keeping the intranet out of reach from devices on the guest network.

However, I have hit a dead end with trying to get this working. I know on my existing DLinks that all guest network traffic is forcibly routed out of the WAN interface which is not helpful when I have an ethernet trunk running between the two routers on their LAN interfaces.

Given the write ups on Merlin, I had hoped to change the networking configurations on the Access Point ones to bridge / route the guest networks (2.4 and 5Ghz) over the LAN trunks I have and out via the one in Router mode. When going through the interface, robocfg, vlan and bridge configurations, they were terribly misleading (especially coming from a Linux networking background) and am in need of some help. One thing I noticed also that setting the device into AP mode and configuring the guest wireless, the guest networks (both 2.4 and 5Ghz) can access the local network which is obviously not supposed to be able to happen.

If I can get it to work, I will purchase another to replace the 3rd DLink I have (the second one in AP mode on the diagram below).

Here is what my network looks like:

+—————————————————————+
| ISP router          |
|                     |
| wan: <ISP ip>       |
| lan: 192.168.10.254 |
+—————————————————————+
  | lan1
  |
  \————————\
           | w
+————————————————————————+
| RT-AC87U (router mode) |
|                        |
| wan: 192.168.10.1      |
| lan: 192.168.1.1       |
|                        |
| 2.4ghz:       net24    |
| 5ghz:         net5     |
| guest 2.4ghz: guest24  |
| guest 5ghz:   guest5   |
+————————————————————————+
  | lan1  | lan2
  |       |
  |       \—————————————————————\
  | lan1                        | lan1
+———————————————————————+    +———————————————————————+
| RT-AC87U (AP mode)    |    | RT-AC87U (AP mode)    |
|                       |    |                       |
| lan: 192.168.1.2      |    | lan: 192.168.1.3      |
|                       |    |                       |
| 2.4ghz:       net24   |    | 2.4ghz:       net24   |
| 5ghz:         net5    |    | 5ghz:         net5    |
| guest 2.4ghz: guest24 |    | guest 2.4ghz: guest24 |
| guest 5ghz:   guest5  |    | guest 5ghz:   guest5  |
+———————————————————————+    +———————————————————————+

Any help is very much appreciated!!

P.

This guide can help you: http://www.dd-wrt.com/wiki/index.php/Linking_Subnets_with_Static_Routes

 

[P_R]

Yes - it's not available in AP mode. In theory I should be able to setup a separate subnet / VLAN for the guest network and configure a bridge to send the traffic down one of the LAN ports (i.e. the trunk to the main router). But I couldn't figure it out.

Would be nice if that functionality was configurable within the UI

If you disable "Access Intranet" on the page where you enable guest networks, won't it do what you want?

(I'm not sure if this option is available in AP mode but I can find it in router mode.)

 

[P_R]

That scenario works for when the two APs are on their own subnets, or are you saying that bridging the same subnet between all devices isn't possible and has to be done this way with static routes?

Either way, how do I get the guest network setup on a separate VLAN or subnet when in AP mode?

This guide can help you: http://www.dd-wrt.com/wiki/index.php/Linking_Subnets_with_Static_Routes