Solved Guest Wifi (index2) on same primary subnet - What & Why?

[Terrabytes]

OK going a little crazy with what I am seeing. Created Guest Wifi (index1-100.0) and working as expected isolating traffic from primary subnet but Guest Wifi (index2-10.0) is being place on the same subnet as primary. Same if I changed it to Guest Wifi (index3). What is happening?

RT-AX86U Pro - 3004.388.4

Your help is greatly appreciated. My sanity thanks you.

 

[RMerlin]

What is happening?

Working as intended. Only the first Guest Network uses a different subnet.

 

[Terrabytes]

So no isolation with other Guest Wifi. Trying to create a Guest and IoT Wifi. Guess my options are using iptables, Any suggestions or links of interest,

Thanks for your help and immense contribution to the community.

 

[ColinTaylor]

This is one of the reasons the YazFi addon was created.

 

[bennor]

YazFi - YazFi v4.x - continued

v4.4.4 Updated 2023-11-26 Feature expansion of guest WiFi networks on AsusWRT-Merlin, including, but not limited to: * Dedicated VPN WiFi networks * Separate subnets for organisation of devices * Restrict guests to only contact router for ICMP, DHCP, DNS, NTP and NetBIOS * Allow guest networks...

www.snbforums.com

GitHub - jackyaz/YazFi: Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more!

Feature expansion of guest WiFi networks on AsusWRT-Merlin, including SSID -> VPN, separate subnets per guest network, pinhole access to LAN resources (e.g. DNS) and more! - jackyaz/YazFi

github.com

 

[Terrabytes]

@ColinTaylor @bennor
Thank you both for pointing me in the right direction. Will review,,

 

[RMerlin]

So no isolation with other Guest Wifi. Trying to create a Guest and IoT Wifi. Guess my options are using iptables, Any suggestions or links of interest,

Thanks for your help and immense contribution to the community.

Isolation is done at the ebtables level, rather than just by using a different subnet (which is not really any isolation, a client would simply have to use a static IP to bypass it).

 

[Justinh]

a client would simply have to use a static IP to bypass it

Are you saying a client could set a primary network IP address and still connect to the GN1 network then talk to the other primary net devices?

 

[RMerlin]

Are you saying a client could set a primary network IP address and still connect to the GN1 network then talk to the other primary net devices?

All I'm saying is having a separate DHCP range does not isolate a network. You need further isolation at a lower level.

 

[Philsburry]

Working as intended. Only the first Guest Network uses a different subnet.

It does not matter whether it's 2.4 or 5ghz as long as it's the very first Guest network that's been created?

 

[ColinTaylor]

It does not matter whether it's 2.4 or 5ghz as long as it's the very first Guest network that's been created?

Correct. It's 192.168.101.x for 2.4GHz and 192.168.102.x for 5GHz.

 

[MDM]

For me, Isolation does not work on Guest 2...