How to use a different subnet for WiFi guest network?

[Jack Yaz]

First attempt here: https://pastebin.com/WnEeg41E

Usage notes and further commenting for which bits to edit will follow - tonight was not a good night, most of it spent in the hospital visiting a very poorly relative =[

General usage is:

./GuestWifi.sh wl0.2
./GuestWifi.sh wl0.1 vpnall 1 #redirects all wl0.1 over VPN client 1 N.B. subnet/clients must be added in Policy Routing (i have been working on the ip rule lookup bit to save this step, lets call that v2)
./GuestWifi.sh wl0.3 vpn 1 #allows wl0.3 to be routed over VPN client 3, for use with selective port routing over VPN N.B. same as example above

 

[Zentachi]

First attempt here: https://pastebin.com/WnEeg41E

Usage notes and further commenting for which bits to edit will follow - tonight was not a good night, most of it spent in the hospital visiting a very poorly relative =[

General usage is:

./GuestWifi.sh wl0.2
./GuestWifi.sh wl0.1 vpnall 1 #redirects all wl0.1 over VPN client 1 N.B. subnet/clients must be added in Policy Routing (i have been working on the ip rule lookup bit to save this step, lets call that v2)
./GuestWifi.sh wl0.3 vpn 1 #allows wl0.3 to be routed over VPN client 3, for use with selective port routing over VPN N.B. same as example above

Thank you Jack, much appreciated for this. I will start playing with it the weekend.

Don't apologize and no need to rush, Health and Family have highest priority.

 

[Alfsu]

First attempt here: https://pastebin.com/WnEeg41E

Usage notes and further commenting for which bits to edit will follow - tonight was not a good night, most of it spent in the hospital visiting a very poorly relative =[

General usage is:

./GuestWifi.sh wl0.2
./GuestWifi.sh wl0.1 vpnall 1 #redirects all wl0.1 over VPN client 1 N.B. subnet/clients must be added in Policy Routing (i have been working on the ip rule lookup bit to save this step, lets call that v2)
./GuestWifi.sh wl0.3 vpn 1 #allows wl0.3 to be routed over VPN client 3, for use with selective port routing over VPN N.B. same as example above

Thanks for this Jack Yaz; now I have some homework to do.

Cheers!

Sent from my ONEPLUS A3000 using Tapatalk

 

[Jack Yaz]

Thanks for this Jack Yaz; now I have some homework to do.

Cheers!

Sent from my ONEPLUS A3000 using Tapatalk

I'm working on an updated version to include parameters, and comments! At the moment it only does 2.4GHz as my 87U has a frankly weird 5GHz implementation. I'm lead to believe it's just wl1.1, wl1.2 etc.

 

[Martineau]

Hey Jack, would you please share these scripts? Thanks!

Sent from my ONEPLUS A3000 using Tapatalk

If you want to try

Spoiler: GuestSubnet.sh

#=========================================================================== © 2016-2018 Martineau, v01.01b (Public Beta)
#
# Configure Guest WiFi with new DHCP subnet and DNS using '/etc/dnsmasq.conf' and optionally allow LAN access to specified IPs
#
# Usage:    GuestSubnet  ['help' | '-h']
#                        {wifi_interface | ssid } | ['del[subnet]'] ['autodnsmasq'] [ 'ssid='name] ['ip='ipaddress[,ipaddress]]
#
#           GuestSubnet  wl0.1
#                        Guest WiFI 2.4GHz interface wl0.1 will have the new DHCP subnet and DNS applied (default)
#           GuestSubnet  wl0.1 del
#                        Guest WiFI 2.4GHz interface wl0.1 firewall rules will be removed but subnet remains.
#           GuestSubnet  wl0.1 delsubnet
#                        Guest WiFI 2.4GHz interface wl0.1 firewall rules will be removed and subnet will be reset to Asus default.
#           GuestSubnet  wl0.2 autodnsmasq
#                        Guest WiFi 2.4GHz interface wl0.2 will have new DHCP and DNS directives inserted into /jffs/configs/dnsmasq.conf.add
#                        if they don't already exist.
#                        NOTE: dnsmasq will be bounced.
#           GuestSubnet  wl1.2 ip=192.168.1.99,192.168.1.100
#                        Guest WiFi 5GHz interface wl1.2 will allow access to LAN devices 192.168.1.99,192.168.1.100
#           GuestSubnet  Guest242
#                        Guest WiFI SSID 'Guest242' (possibly wl0.2?) will have the new DHCP subnet and DNS applied

then let me know and I'll send you the link to the Public Beta.

 

[Jack Yaz]

v2RC here: https://gist.github.com/jackyaz/e0032dde93729104189e7e32d0192143

ToDo: remove configuration for disabled networks

Now works on a loop for all configured interfaces, rather than requiring separate script calls. 5GHz remains untested due to lack of appropriate hardware!

 

[ColinTaylor]

v2RC here: https://gist.github.com/jackyaz/e0032dde93729104189e7e32d0192143

I think you might have a typo in the following line:

IFACELIST="wl0.1 wl0.2 wl0.3 wl1.2 wl1.2 wl1.3"


I use something like this in my script (although it's still limited to dual-band Broadcom based routers like the AC68U):

IFACELIST="$(nvram get wl_ifnames) $(nvram get wl0_vifs) $(nvram get wl1_vifs)"

IFACELIST="$(nvram get wl0_vifs) $(nvram get wl1_vifs)"

 

[ColinTaylor]

Perhaps use:

LAN="$(nvram get lan_ipaddr)"

 

[Jack Yaz]

Good catch! The LAN IP was probably a remnant where I was testing this in an Ubuntu VM for fear of disturbing the router. The nvram approach makes a lot more sense.

 

[Zentachi]

If you want to try

then let me know and I'll send you the link to the Public Beta.

I would like to test your public beta Martineau if thats possible.

Thanks

 

[Jack Yaz]

Gist has been updated.

 

[Jack Yaz]

Further updates, script now adds subnets to RPDB as required, including a patch for default gateway + Exclusive DNS if the policy routing table is blank in GUI and they are not generated by the firmware for any reason.

Next on to-do: remove RPDB if a guest network is changed from VPN routed to non VPN routed

 

[ColinTaylor]

Hi Jack,

I see you're using this, presumably to remove the trailing space if it exists from $IFACELIST.

awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }'

It's a safe approach but is unnecessary as that variable is only used to generate a FOR word-list where whitespace is ignored.

Just sayin'

 

[Jack Yaz]

Hi Jack,

I see you're using this, presumably to remove the trailing space if it exists from $IFACELIST.

awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }'

It's a safe approach but is unnecessary as that variable is only used to generate a FOR word-list where whitespace is ignored.

Just sayin'

I was flipping the order of the list so the iptables -I appeared in interface ascending order...it bugs me otherwise !

 

[ColinTaylor]

I was flipping the order of the list so the iptables -I appeared in interface ascending order...it bugs me otherwise !

Ah, that makes sense.

 

[Martineau]

I would like to test your public beta Martineau if thats possible.

Thanks

Different DHCP range of different WLAN

 

[Alfsu]

If you want to try

Spoiler: GuestSubnet.sh

#=========================================================================== [emoji767] 2016-2018 Martineau, v01.01b (Public Beta)
#
# Configure Guest WiFi with new DHCP subnet and DNS using '/etc/dnsmasq.conf' and optionally allow LAN access to specified IPs
#
# Usage:    GuestSubnet  ['help' | '-h']
#                        {wifi_interface | ssid } | ['del[subnet]'] ['autodnsmasq'] [ 'ssid='name] ['ip='ipaddress[,ipaddress]]
#
#           GuestSubnet  wl0.1
#                        Guest WiFI 2.4GHz interface wl0.1 will have the new DHCP subnet and DNS applied (default)
#           GuestSubnet  wl0.1 del
#                        Guest WiFI 2.4GHz interface wl0.1 firewall rules will be removed but subnet remains.
#           GuestSubnet  wl0.1 delsubnet
#                        Guest WiFI 2.4GHz interface wl0.1 firewall rules will be removed and subnet will be reset to Asus default.
#           GuestSubnet  wl0.2 autodnsmasq
#                        Guest WiFi 2.4GHz interface wl0.2 will have new DHCP and DNS directives inserted into /jffs/configs/dnsmasq.conf.add
#                        if they don't already exist.
#                        NOTE: dnsmasq will be bounced.
#           GuestSubnet  wl1.2 ip=192.168.1.99,192.168.1.100
#                        Guest WiFi 5GHz interface wl1.2 will allow access to LAN devices 192.168.1.99,192.168.1.100
#           GuestSubnet  Guest242
#                        Guest WiFI SSID 'Guest242' (possibly wl0.2?) will have the new DHCP subnet and DNS applied

then let me know and I'll send you the link to the Public Beta.

Of course I would like to give it a try, thanks!

Sent from my ONEPLUS A3000 using Tapatalk

 

[sn2018]

Stupid question. What is the difference between Martineau and Jack Yaz' version? Is Martineau's version more restrictive in term of net access? I need something to keep my visitors from my PCs but not worry to much on they do with the internet access.

 

[Jack Yaz]

I can't speak for Martineau's but mine blocks all LAN access except DHCP and NTP.

 

[ColinTaylor]

I need something to keep my visitors from my PCs but not worry to much on they do with the internet access.

The normal guest networks will do that. No need for any extra scripts.