Menu
What's new
By:
Filters Better Search

YazFi YazFi - enhanced AsusWRT-Merlin Guest WiFi inc. SSID <-> VPN Client

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Bubbagump210 said:
So I tried a few things. DNS fails. However, pings, SSH and HTTP to the internet works. After the testing, I have set wl01_CLIENTISOLATION to false to see what that does in the meantime.

ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=119 time=47.491 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=119 time=36.655 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=119 time=221.526 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=119 time=139.665 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 36.655/111.334/221.526/75.163 ms
$ nslookup
> server 192.168.178.5
Default server: 192.168.178.5
Address: 192.168.178.5#53
> google.com
;; connection timed out; no servers could be reached
> server 8.8.8.8
Default server: 8.8.8.8
Address: 8.8.8.8#53
> reddit.com
;; connection timed out; no servers could be reached
> exit

$ ssh 68.183.106.34
qwerty@68.183.106.34's password:
Last login: Sun Jan 27 14:12:14 2019 from cpe-75-187-52-188.columbus.res.rr.com

$ curl 68.183.106.34
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html><head>

EDIT: wl01_CLIENTISOLATION set to false shows the same behavior. Think that is a red herring.
Click to expand...
I'm putting together an update to provide a Diagnostics option to dump out everything i need. Presumably the pi-hole device is still reachable from the main network when the guests fail?
 
oldlady said:
complete total newb here...

i have a 68u running Merlin 384.9. If I add this YazFi, will it help me protect my main network from IoT hackers? Right now these devices are on a guest network with "access intranet" off. I probably need to do more than that to secure my primary network. I was looking into other routers (ubiquiti) to manage vlans and such, but if not necessary, I'd just stay with my current router or move to a 86u.

please advise if I can protect my main network using some of the things the brilliant people here have created.. thanks
Click to expand...

It may not be the last line of defense, but it will certainly trip up the code-babies. :)

For example, with YazFi, you can run your main network/router on 192.168.1.1. Your 2.4GHz guest network on 10.x.x.x and your 5GHz guest network on the 172.16.x.x to 172.31.x.x private IP range.

The following table is the private IP ranges we can use internally:
  • 192.168.0.0 - 192.168.255.255 (65,536 IP addresses)
  • 172.16.0.0 - 172.31.255.255 (1,048,576 IP addresses)
  • 10.0.0.0 - 10.255.255.255 (16,777,216 IP addresses)
It would take a sophisticated hacker to jump from one network to another (assuming they even got access to one of them).
 
Hi Jack!

Just tried to create an IOT guest network for my chinese cam.. ;) My configuration looks like that:

wl01_ENABLED=true
wl01_IPADDR=192.168.2.0
wl01_DHCPSTART=2
wl01_DHCPEND=254
wl01_DNS1=127.0.0.1
wl01_DNS2=127.0.0.1
wl01_FORCEDNS=true
wl01_REDIRECTALLTOVPN=false
wl01_VPNCLIENTNUMBER=2
wl01_LANACCESS=false
wl01_CLIENTISOLATION=true

I want that the clients in this network are also using my router with stuby to do dns things.

I can see that my cam is connected to that network:

INTERFACE: wl0.1
SSID: MB-WLAN_IOT

HOSTNAME IP ADDRESS MAC
? 192.168.2.110 XXX

But without hostname..?

Also I can't connect anymore to that cam if I am at my normal WLAN network or from the outside :(

Any hints?
 
TheUntouchable said:
Hi Jack!

Just tried to create an IOT guest network for my chinese cam.. ;) My configuration looks like that:

wl01_ENABLED=true
wl01_IPADDR=192.168.2.0
wl01_DHCPSTART=2
wl01_DHCPEND=254
wl01_DNS1=127.0.0.1
wl01_DNS2=127.0.0.1
wl01_FORCEDNS=true
wl01_REDIRECTALLTOVPN=false
wl01_VPNCLIENTNUMBER=2
wl01_LANACCESS=false
wl01_CLIENTISOLATION=true

I want that the clients in this network are also using my router with stuby to do dns things.

I can see that my cam is connected to that network:

INTERFACE: wl0.1
SSID: MB-WLAN_IOT

HOSTNAME IP ADDRESS MAC
? 192.168.2.110 XXX

But without hostname..?

Also I can't connect anymore to that cam if I am at my normal WLAN network or from the outside :(

Any hints?
Click to expand...
Hostnames are generated by arp - does
Code: 
 arp -a
show the hostname?
If not, the IP camera might not be registering the hostname properly.

Setting DNS to 127.0.0.1 might not work (oversight on my part). Can you try replacing blanking out DNS 1 and 2 and re-running please? (I'm improving this in the next version)
 
Jack Yaz said:
Hostnames are generated by arp - does
Code: 
 arp -a
show the hostname?
If not, the IP camera might not be registering the hostname properly.
Click to expand...

Yeah youre right, arp -a also reports the "?" as hostname. Sadly I can't remember if it reported the hostename in the normal wlan as I have all network devices renamed :D

Setting DNS to 127.0.0.1 might not work (oversight on my part). Can you try replacing blanking out DNS 1 and 2 and re-running please? (I'm improving this in the next version)
Click to expand...

Changed the dns to empty and I can confirm that DNS is working now as I have connected my laptop to the guest network. Sadly I can't reach that damn cam even after a reboot of it.. I can view and change the configuration of that cam with the corresponding app, but if i try to open the stream with it it tells me the network is busy..

EDIT: Just tried the same with my Xiaomi Smart Mi Air Humidifier and here everything works fine.. F*** china cams! :D

EDIT2: Omg.. Without any changes this piece of s*** is working now.. Nevermind and thanks a lot :D
 
Last edited:
@Jack Yaz This script is freaking awesome man!! I just got a IoT camera and it insists on WAN access, this really helps me sleep knowing if it gets hacked, they won't have access to my network. Nice work my friend!:D:D:D:D
 
YazFi v3.0.2 has been uploaded!

Changelog:
Code: 
Add support for router IP running on addresses ending in non .1
Add diagnostics gathering option d to main menu
To update use option 3 in the YazFi menu

Thanks to @L&LD for testing YazFi on a router using .254 for it's LAN IP
 
Last edited:
Nice work Jack!! I have one issue that I came across, when configuring the script and entering the ip pool, if I use my number pad lets say to enter the number 3, it sends me into the script further instead of just entering the number 3. If I use the number keys at the top of the keyboard everything works fine. I am using Ubuntu though so I'm not sure if this is part of it. Again this is a cosmetic thing the script still works just fine. Thanks @Jack Yaz this script is awesome!!
 
skeal said:
Nice work Jack!! I have one issue that I came across, when configuring the script and entering the ip pool, if I use my number pad lets say to enter the number 3, it sends me into the script further instead of just entering the number 3. If I use the number keys at the top of the keyboard everything works fine. I am using Ubuntu though so I'm not sure if this is part of it. Again this is a cosmetic thing the script still works just fine. Thanks @Jack Yaz this script is awesome!!
Click to expand...
I think that's just how nano works
 
Jack Yaz said:
I think that's just how nano works
Click to expand...
Hey @Jack Yaz one last question, does the new network created by YazFi get any protection from things like; Skynet, or AI-Protection? I know Diversion won't work because of DNS, I was just wondering. Thanks again for the fantastic script, it's a great idea!;):)
 
skeal said:
Hey @Jack Yaz one last question, does the new network created by YazFi get any protection from things like; Skynet, or AI-Protection? I know Diversion won't work because of DNS, I was just wondering. Thanks again for the fantastic script, it's a great idea!;):)
Click to expand...
If you point DNS to your router then you can use Diversion (and stubby, dnscrypt and pixelserv-tls for that matter). YazFi will open up only the relevant ports for those services.

Skynet filters on the raw table so will protect everything connected to the WAN, as far as I know, so you don't lose any protection on guests
 
Jack Yaz said:
If you point DNS to your router then you can use Diversion (and stubby, dnscrypt and pixelserv-tls for that matter). YazFi will open up only the relevant ports for those services.

Skynet filters on the raw table so will protect everything connected to the WAN, as far as I know, so you don't lose any protection on guests
Click to expand...
Awesome Jack!!:D
 
Jack Yaz said:
If you point DNS to your router then you can use Diversion (and stubby, dnscrypt and pixelserv-tls for that matter). YazFi will open up only the relevant ports for those services.

Skynet filters on the raw table so will protect everything connected to the WAN, as far as I know, so you don't lose any protection on guests
Click to expand...
Ok I'm still seeing adds on the new network. I have my router dns as dns1 and YazFi inserted a default for dns2. I have not restarted the script or the router yet. Any thoughts?
 
skeal said:
Ok I'm still seeing adds on the new network. I have my router dns as dns1 and YazFi inserted a default for dns2. I have not restarted the script or the router yet. Any thoughts?
Click to expand...
Can you see the device's queries in Diversion's log trailing?
Also check the device's DHCP config (i.e. has it picked up the correct DNS?)
 
Jack Yaz said:
Can you see the device's queries in Diversion's log trailing?
Also check the device's DHCP config (i.e. has it picked up the correct DNS?)
Click to expand...
No there are no entries with the new ip range, also if I follow the logs in skynet as they appear, using the ip as the filter, there are no entries there either.
 
Without access to lan I don't see how this would work. My ip of the device is 192.168.2.x the ip of my router is 192.168.x.1
 
You must log in or register to reply here.

Similar threads

Astronautspiff
YazFi GUI Tab not showing up under Guest Networks Page
Replies
3
Views
330
Tech9
Tech9
M
YazFi Problem with YazFi
Replies
19
Views
1K
bennor
B
Jack Yaz
YazFi YazFi v4.x - continued
6 7 8
Replies
147
Views
24K
fotingo
F
T
Make IoT devices on one-way-to-guest YazFi VLANs discoverable on main LAN
Replies
8
Views
2K
fotingo
F
B
Yazfi: VPN Server for guest network access only
Replies
10
Views
1K
jrmathis
jrmathis
Similar threads
Thread starter Title Forum Replies Date
Z YazFi YazFi on Subnet Router Asuswrt-Merlin AddOns 10
Siff Solved YazFi Offline Install Asuswrt-Merlin AddOns 3
Astronautspiff YazFi GUI Tab not showing up under Guest Networks Page Asuswrt-Merlin AddOns 3
M YazFi Problem with YazFi Asuswrt-Merlin AddOns 19
macster2075 YazFi YazFi on AC86U Asuswrt-Merlin AddOns 3
SevenFactors YazFi YazFi 4.4.4 GUI Page Becomes Unscrollable on Merlin 386.14 Asuswrt-Merlin AddOns 3
novusB YazFi Issues with YazFi - Gnuton - RT-AX58U_V2 3004.388.7_1-gnuton1 Asuswrt-Merlin AddOns 1
P YazFi YazFi on GT-BE98 Pro Asuswrt-Merlin AddOns 15
R YazFi YazFi and Port forwarding to get to server? Asuswrt-Merlin AddOns 2
B YazFi YazFi Guest Network unable to access Pi-Hole DNS server Asuswrt-Merlin AddOns 23

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 836 (members: 23, guests: 813)
Top