Seperate wifi SSID seperate subnet

[Raymond74]

Hi all,

I have 1 requirement which is to seperate my IoT devices from my personal devices. So I am fine with vlan1 and then LAN subnet but want to bind the first Guest WLAN (wl0.1) to a seperate bridge and vlan (for tagging on wired ports).

vlan1 - personal stuff
vlan9 - IoT devices

Some devices need to communicate between vlan1 & vlan9 so besides outside NAT I will also need some extra iptables. My problem now is... I cannot even connect after my changes.

 

[Raymond74]

And I get blocked everytime on this forum? What is that ? I am trying to post what I did... but is it too long ?

 

[Raymond74]

Why have I been blocked?
This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

What can I do to resolve this?
You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

Cloudflare Ray ID: 466b07647f9f7265

 

[Raymond74]

So PM me or something....I can't post my config..... :-(

 

[octopus]

So PM me or something....I can't post my config..... :-(

You can post on Pastebin and share link here.

 

[agilani]

have you looked at yazfi?

 

[Raymond74]

I looked at yazfi, but isnt that for VPNs?

Here's my posting: https://pastebin.com/Grd5uznq

 

[Martineau]

I have 1 requirement which is to seperate my IoT devices from my personal devices. So I am fine with vlan1 and then LAN subnet but want to bind the first Guest WLAN (wl0.1) to a seperate bridge and vlan (for tagging on wired ports).

Perhaps this may be of use... WiFiVPN.sh to create the WLAN bridge(s), together with VLANSwitch.sh to allow both WLAN interfaces and a designated switch port to be on the same 'VLAN'

 

[Raymond74]

Perhaps this may be of use... WiFiVPN.sh to create the WLAN bridge(s), together with VLANSwitch.sh to allow both WLAN interfaces and a designated switch port to be on the same 'VLAN'

Maybe read the pastbin. I want the asus to be the router and DHCP, with IPtables. But I also want the 1 lan port in the guest vlan.

But currently I can not even connect on wl0.1 (Guest WLAN1 2.4Ghz)

 

[Raymond74]

And I'm not seeing my iptables entry back when added....

admin@RT-AC87U-D808:/jffs/scripts# iptables -I INPUT -i br1 -j ACCEPT
admin@RT-AC87U-D808:/jffs/scripts# iptables -L INPUT
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
logdrop icmp -- anywhere anywhere icmp echo-request
logdrop udp -- anywhere router.asus.com udp dpt:domain STRING match "ssm1.internet.sony.tv" ALGO name bm TO 65535
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
logdrop all -- anywhere anywhere state INVALID
PTCSRVWAN all -- anywhere anywhere
PTCSRVLAN all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state NEW
OVPN all -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
INPUT_ICMP icmp -- anywhere anywhere
logdrop all -- anywhere anywhere

 

[Martineau]

And I'm not seeing my iptables entry back when added....

admin@RT-AC87U-D808:/jffs/scripts# iptables -I INPUT -i br1 -j ACCEPT
admin@RT-AC87U-D808:/jffs/scripts# iptables -L INPUT
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
logdrop icmp -- anywhere anywhere icmp echo-request
logdrop udp -- anywhere router.asus.com udp dpt:domain STRING match "ssm1.internet.sony.tv" ALGO name bm TO 65535
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
logdrop all -- anywhere anywhere state INVALID
PTCSRVWAN all -- anywhere anywhere
PTCSRVLAN all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state NEW
OVPN all -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
INPUT_ICMP icmp -- anywhere anywhere
logdrop all -- anywhere anywhere

Maybe read the iptables man page for the correct/appropriate iptables list command to actually reveal/display your custom br1 rule.

 

[Raymond74]

In the pastbin I asked for help. Pointing me to the man page is not helpful. I read it. Next

 

[Raymond74]

Anyway thanks for the people that helped, I am trashing this router as I just need a proper router/switch without hacking like Meraki for example or RouterOS. I will keep it like this for now