RT-AC68 guest network in AP mode

[Imaohw]

I have 3 Asus RT-AC68 wireless "routers" to cover a large area. All are running the latest Asus firmware and all are set up as Access Points. They are connected to Zyxel Gs1910-24 smart switches which are connected to a Zywall 110 firewall/router which provides load balanced Internet access across multiple ISPs and dhcp services.

Everything works fine however I would like to use the guest feature of the RT-AC68 to limit WIFI guest access to only the internet and not the intranet (local network). I can set up a vlan on the switches and if needed a separate DHCP server on the firewall for that vlan. I can also route the traffic from the vlan only to the internet. I have tested this configuration with a spare access point.

The problem I have have is that even though the RT-AC68 has a guest network feature it does not seem to differentiate guest traffic from "regular" traffic. It does not appear to support vlans nor have a way of directing different traffic to different ports. Once the RT-AC68 is set to Access Point mode the Guest WIFI network acts exactly as the "home" WIFI network. The solutions I can see is to get another set of RT-AC68s to use to create a guest network or swap the RT-AC68 for access points that support vlans. I would like to keep the RT-AC68 as it has great throughput.

Any suggestions?

 

[starfall]

I posted this in another thread but I think it will be useful for you here -

Actually you can make it work with Asuswrt-Merlin (I tested this on a RT-AC68U and RT-AC56U). As the guess access separation is handled by ebtables, you need to put the following ebtables config into your secondary AP -

ebtables -I FORWARD 1 -d Broadcast -j ACCEPT
ebtables -I FORWARD 1 -s xx:xx:xx:xx:xx:xx -j ACCEPT
ebtables -I FORWARD 1 -d xx:xx:xx:xx:xx:xx -j ACCEPT

Where xx:xx:xx:xx:xx:xx is the MAC address of the primary router's LAN interface (br0).

In short, this will allow the secondary AP guest networks to send broadcast traffic to your LAN for ARP and DHCP, and it will allow your router's LAN interface to communicate with guest users on your AP. By inserting the rules at the front of the FORWARD chain, the traffic will be allowed before it hits the DROP rules that does the guest separation -

-i wl0.1 -j DROP
-o wl0.1 -j DROP
-i wl1.1 -j DROP
-o wl1.1 -j DROP