Guest Network Pro and printer

[Jherb]

Hello,
I am using an AX86U pro on 3006 firmware. I have a couple of questions about guest network pro with printers, etc.

I've connected a printer to one of the routers ports, and associated that with the same VLAN as the guest network. So the guest network and printer are all on the same subnet, and vlan. When I connect to the guest network, I can use the printer fine.
I would like to be able to print to that printer from the main LAN as well, but I can't in the default state. I'm assuming this is because the printer is on a different subnet. If this is correct, how would I allow the printer to be accessible from the main LAN. Is there some kind of firewall rule I can add to the stock firmware to bridge the two subnets. Ideally, just one way from the main subnet to guest subnet.

I'm just learning about this stuff, so I'm not sure I've assessed this correctly. Any guidance would be appreciated.

Another question regarding guest network pro: How can you reserve a guest address for the printer? The main DHCP reservation page won't accept guest subnets. Perhaps its a limitation?

 

[PunchCardBoss]

how would I allow the printer to be accessible from the main LAN

Turn off intranet isolation (LAN > VLAN). But beware. This will allow all devices on your guest subnet to access all devices on your main LAN. There is no way with stock Asus firmware to give a single device on a VLAN intranet access. It is all devices or none.

How can you reserve a guest address for the printer?

With stock asus firmware, there is no way to reserve a DHCP address for a device on a VLAN. You can, however, assign a static IP on your printer within the VLAN range, and your router will use that address. You will need to reboot both router and printer after making the change.

 

[Jherb]

Thank you. The vlan implementation seems quite limited. As far as I can tell, There is no way to allow vlans to talk to each other, or to control granular access to devices within a vlan, etc. This really limits the utility for me, so far.

 

[Tech9]

This is a consumer router after all. Just place the printer on your main LAN like 99% of home users do for convenience.

 

[PunchCardBoss]

This really limits the utility for me, so far.

Agreed.

I suggest you use the Router's comment/feedback page to voice your dissatisfaction. I've sent several to Asus about this matter. Perhaps more voices will help the cause.

 

[Jherb]

This is a consumer router after all. Just place the printer on your main LAN like 99% of home users do for convenience.

When I did that, the guest couldn't access it. Even with "intranet access enabled". I'm not sure why.

 

[Tech9]

So far and for many years no one coming to my place and connecting to my isolated Guest Network had the need to use my printers.

 

[bennor]

The vlan implementation seems quite limited.

Yes the Guest Network Pro in its current form has some limitations. Like others in all my years never had someone connected to my Guest Network need to access my network printer which sits on the main LAN.

If one isn't using AiMesh one could install Asus-Merlin firmware and then run the YazFi guest network addon script. With YazFi there are ways to both set manual IP reservations in addition to using custom scripting to allow YazFi clients to access main LAN clients if/when the YazFi one way to Guest and two way to guest are not what someone needs.

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - jackyaz/YazFi

github.com

YazFi - YazFi v4.x - continued

v4.4.4 Updated 2023-11-26 Feature expansion of guest WiFi networks on AsusWRT-Merlin, including, but not limited to: * Dedicated VPN WiFi networks * Separate subnets for organisation of devices * Restrict guests to only contact router for ICMP, DHCP, DNS, NTP and NetBIOS * Allow guest networks...

www.snbforums.com

 

[Jherb]

I have a followup question. I am a novice at this, so please bear with me.

What does "enable intranet" do in the guest network pro setting? I see that the guest still gets a different subnet than the main network. My assumption was that this setting would allow the main network and guest to be able to communicate. However, I'm not able to be on either network and connect to the other.

For example, when I try to access another windows laptop by IP, it can't be found.
I also cannot access the router interface either from the guest network with "enable intranet" on.

Am I misunderstanding how this works? or do I need to do something to the windows firewall?

A second question is about accessing another laptop by its computer name, and not IP. Could that be done if they are on different subnets?

Thanks in advance. I know these are basic questions for those with experience, so thanks for the education.

 

[bennor]

What does "enable intranet" do in the guest network pro setting? I see that the guest still gets a different subnet than the main network. My assumption was that this setting would allow the main network and guest to be able to communicate. However, I'm not able to be on either network and connect to the other.

Guest Network Pro's Access Intranet option is supposed to allow client access to the main LAN/WiFi intranet when enabled. As you found out, it sometimes doesn't work as intended/designed. In fact much of the Guest Network Pro option has a number of issues, at least on the RT-AX86U Pro. The Access Intranet tooltip when you mouse over the text and click on it:

Edit to add: Just did a quick test and the Access Intranet option is working for me, when enabled, on a Customized Network. I have Use same subnet as main network disabled.

 

[Jherb]

Guest Network Pro's Access Intranet option is supposed to allow client access to the main LAN/WiFi intranet when enabled. As you found out, it sometimes doesn't work as intended/designed. In fact much of the Guest Network Pro option has a number of issues, at least on the RT-AX86U Pro. The Access Intranet tooltip when you mouse over the text and click on it:
View attachment 63099

Thanks. So its a bug probably? Would you expect them to still have different subnets, or would that option make them use one subnet?

Its really unfortunate that there are so many inconsistent behaviors in this router. Hopefully, they can be resolved in future updates.

 

[bennor]

Thanks. So its a bug probably? Would you expect them to still have different subnets, or would that option make them use one subnet?

Its really unfortunate that there are so many inconsistent behaviors in this router. Hopefully, they can be resolved in future updates.

See my post edit above. The Access Intranet feature is working for me on a RT-AX86U Pro running 3.0.0.6.102_34336 with a Customized Network.

 

[Jherb]

See my post edit above. The Access Intranet feature is working for me on a RT-AX86U Pro running 3.0.0.6.102_34336 with a Customized Network.

How did you test it. I'll try to do the same. Just with a ping? Or did you connect to something?

 

[bennor]

How did you test it. I'll try to do the same. Just with a ping? Or did you connect to something?

Tested using a mobile phone connected to a 5Ghz Guest Network to ping and connect via SMB to a NAS on the main LAN. Attached is the basic settings I'm using for that particular Guest Network Pro Customized Network. (PS: with Access Intranet temporarily enabled.)