[Meph1st0]

Let's say for example I have 3 internet streaming devices, 2 are wired to my managed switch while the third is only wireless because of it's location and I only want to provide internet access to them while isolating them from the rest of my personal network. Let's just say; theoretically, I don't trust these devices and worry that if they were ever compromised then I'd want to prevent them from being able to send or receive traffic from the rest of my network. To do so I could create a separate VLAN and configure them on a separate subnet. On my router I can define an ACL that denies traffic to any of the other VLANs but still allow traffic to flow out to the internet. So I can do this easily if they're directly wired to an access port on my managed switch on the "Internet Streaming" VLAN.

For the devices on the wireless network; however, I would want to logically separate the devices in the same manner and put only the internet streaming devices on the same "Internet Streaming" VLAN.

Is this something that is possible with dd-wrt? How could someone achieve this? Would it be the same thing as configuring a guest wireless network while still using a WPA password for the specific internet streaming devices?

I've noticed that there is a VLAN section somewhere in the config. It seems that I could create a wireless network just for the internet streaming devices, and then I'd bridge that network to one of the available physical ports on the Access Point. From there I'd run a cable from that port to an access port on my switch that has been configured on the same VLAN. Does that sound correct?

Alternatively is it possible to configure one of the ports on the AP as a trunk, and then tag wireless client's access based on mac address? Something like that?

[ian5142]

What you could do is this. Create a separate wireless network (VAP) and turn on Net Isolation. Then the devices that connect to that network can only access the internet and not anything on the internal network.

As for Vlans, Broadcom routers support Vlans. All others only support Vlan tagging with the switch acting as single location (not per ethernet port). See this: https://wiki.dd-wrt.com/wiki/index.php/Category:VLANs
In particular the article about Switched Ports.

This is a good wiki for Guest AP: https://wiki.dd-wrt.com/wiki/index.php/Guest_WiFi_+_abuse_control_for_beginners
You only need the instructions section.

[Meph1st0]

ian5142,

Thank you for your response. I took a look at the wiki articles you linked to and I gotta say; I learned a lot. I've never had a clear understanding of the default internal device network and vlan tagging. That was perfect and makes perfect sense.

Given the information in there I think I can work this out; however, one thing you said makes me think I may still not be able to do this. You said;

[ian5142]

No idea if the article you are looking for has been written. I would suggest going through every page in the VLans Category I linked to above.

[Per Yngve Berg]

Netgear R7800 supports VLAN better than the Broadcoms.
You can configure 128 VLANs and use all 4096 PVIDs.

There is no wiki for it. VLAN is configured with the swconfig utility.

Please post in the Atheros forum.