[SOLVED] Wireless Guest Network on different subnet
Yes, the RT-N65U does utilize Gigabit on the LAN ports (and on the WAN port). I use it all the time to do large transfers between systems.
Thanks for the info, Guz. There was a mistake in re-sellers e-shop. I went ahead and purchased the WiFi AP.
Guz said:
The Wireless Guest Network can be setup as an isolated network (meaning anyone on the Wireless Guest, will not see anything but the internet). There is a switch on the Guest AP configuration page(s) called "Isolation between Guest AP and LAN?" on Pavadan's firmware. Not sure if it's there on Asus's firmware (I haven't run that firmware since Pavadan came out).
Asus does not offer Guest AP on this model.
Padavan's firmware creates separate SSID and BSSID for standard AP and Guest AP, respectively, however, they all share the same DHCP pool of LAN.
The issue is that RT-N56U's WAN (internet) port will be connected to another Router1 on my home network and I guess that despite the use of AP and LAN isolation, the Guest AP's clients will be able to see the Router1's network (which is in the realm of "internet" from the view point of RT-N56U).
DD-WRT uses separate DHCP pools (subnets) for standard AP and Guest AP, which allows to set proper routing/filtering on the Router1.
I am away until Sunday so I cannot test myself. But: is there some workaround? I thought about manual edit of dnsmasq.conf and set different pools for the virtual devices instead of br0, though I am not sure if it is just so simple....
Guz said:
Now... if you want the WIRED ports to be isolated.... Nope. Wired ports see everyone on the LAN and WAN side.
I could live with that limitation or I could try to disable LAN ports at all (DD-WRT on Asus allows that on command line).
EDIT: Ok, there are more ways to go, however I have chose the following:
- Set RT-N56U into AP operation mode (all clients use existing subnet connected to WAN port) and enable Guest AP.
- Enable Main and Guest AP isolation (this will isolate clients between normal and guest networks. It is done on a lower protocol level therefore no netfilter is engaged).
- Enable AP Isolation for Guest AP (this will isolate clients within Guest Network).
- Create own startup script to:
- exclude NIC rai1 (which is the Guest AP on 2.4 MHz radio) from bridge br0.
- setup ip address/netmaks/broadcast for rai1 - on a different subnet than your main one.
- run dnsmasq server to provide DHCP service on rai1 (no config file needed, all can be setup via command parameters)
- set some iptables rules for forwarding chain (I block any communication from rai1 to my main subnet and allow to connect to main subnet's router and public internet).
- enable IP forwarding in kernel (echo 1 > /proc/net/bla bla bla.. - search google)
- run the script from /etc/storage/started_script.sh. I actually put my script into /opt/home/admin/bin folder on external flash disk, since I installed Entware already. This has the advantage that if the start up script fails and blocks my access to the RT-N56U, I simply unplug the pendrive and reboot again...
It is possible to have RT-N56U in router mode, though it complicates the startup script a bit (there are already netfilter rules in place + nat) and it is more prone to error due to more versatile configuration options in web interface of RT-N56U. I anyway prefer to have all "authorised" computers on my home LAN and only Guest computers on a separate subnet - hence the above approach fits better.
I have not succeeded to physically disable LAN ports, though, since I have not found a way to do so (no nvram options seem fit).