DDWRT guest network

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3  Next
Author Message
jwh7
DD-WRT Guru


Joined: 25 Oct 2013
Posts: 2666
Location: Indy

PostPosted: Mon Nov 15, 2021 1:54    Post subject: Reply with quote
kernel-panic69 wrote:
That "DNSMasq method" makes me wonder if the process of a WAP configuration is counter-intuitive and should be done in a specific order so that disabling the WAN is the last step.
If Wireless Mode isn't being changed from AP, WAN should be changed/Apply'd first.
mafkikker wrote:
Reset the router, and created a new guest network with the dnsmasq option. No Firewall settings in administration/commands.
You -must- have these firewall settings when using a VAP w/ an AP:
https://wiki.dd-wrt.com/wiki/index.php/Guest_Network#VAP_with_no_WAN
VAP_with_no_WAN wrote:
If the router is not used as a gateway (like an AP, thus WAN and DHCP are disabled, but the same subnet as the primary gateway router), firewall rules are needed for client access restrictions and internet access.
And this if it still isn't working:
https://wiki.dd-wrt.com/wiki/index.php/Guest_Network#No_VAP_at_boot_.28Broadcom.29

_________________
# NAT/SFE/CTF: limited speed w/ DD # Repeater issues # DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo #
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250
|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 13112
Location: Texas, USA

PostPosted: Mon Nov 15, 2021 3:08    Post subject: Reply with quote
jwh7 wrote:
kernel-panic69 wrote:
That "DNSMasq method" makes me wonder if the process of a WAP configuration is counter-intuitive and should be done in a specific order so that disabling the WAN is the last step.
If Wireless Mode isn't being changed from AP, WAN should be changed/Apply'd first.
Which breaks the normal process of adding a VAP, hence my reasoning.

EDIT: I was under the impression that the multiple dhcp server configs were not present after disabling the WAN. I will pull out my E4200s when I get a chance to check unbridged and bridged VAP when configured as a WAP at some point.

_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
At some point, people just get plain tired of this place.
Because they are tired of bottom-feeders and the same old hat.

----------------------
Linux User #377467 counter.li.org / linuxcounter.net


Last edited by kernel-panic69 on Mon Nov 15, 2021 23:20; edited 1 time in total
mafkikker
DD-WRT Novice


Joined: 08 Nov 2021
Posts: 12

PostPosted: Mon Nov 15, 2021 12:59    Post subject: Reply with quote
jwh7 wrote:
If Wireless Mode isn't being changed from AP, WAN should be changed/Apply'd first.


Should the WAN be disabled first an the create the WAP (AP) and VAP ?
I almost know for sure that I disabled the WAN first and then created the WAP.

If this is not the case do I have to start all over again ?

jwh7 wrote:
You -must- have these firewall settings when using a VAP w/ an AP:
https://wiki.dd-wrt.com/wiki/index.php/Guest_Network#VAP_with_no_WAN


I saved these commands in "administration/firewall/save firewall"

iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
iptables -I INPUT -i wl0.1 -m state --state NEW -j REJECT
iptables -I INPUT -i wl0.1 -p udp -m multiport --dports 53,67 -j ACCEPT

Rebooted the router

jwh7 wrote:

And this if it still isn't working:
https://wiki.dd-wrt.com/wiki/index.php/Guest_Network#No_VAP_at_boot_.28Broadcom.29


Entered this in "administration/commands/save startup"
sleep 10; stopservice nas; wlconf eth1 down; wlconf eth2 down; wlconf eth1 up; wlconf eth2 up; startservice nas

reboot the router
Result : connected without internet
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 5946
Location: Texas

PostPosted: Mon Nov 15, 2021 15:02    Post subject: Reply with quote
mafkikker wrote:
I saved these commands in "administration/firewall/save firewall"

iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j REJECT
iptables -I INPUT -i wl0.1 -m state --state NEW -j REJECT
iptables -I INPUT -i wl0.1 -p udp -m multiport --dports 53,67 -j ACCEPT


Maybe you are running over yourself just a bit Shocked
NO need to make this so difficult Wink
From what I understand this is a WAN disabled....WAP (Wireless Access Point) with a guest network
Get rid of your last 3 lines in the firewall & reboot

This is all you need for guest on WAP ---
Code:
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


1. NO access to main subnet
2. gives guest network access to internet

in the 1st rule I have always used -j DROP although -j REJECT is ok also.
-j DROP = just get dead connection and waits for whatever is trying to access it gets a timeout.
-j REJECT = immediate reject of connection. Most like this because it shows a rejection in less than a second...
...the problem I have with that is---> a REJECT command
also tells whomever there is something there because it is rejecting connections from this subnet. Twisted Evil

---
EDIT: just a bit more...
The above is for a correctly configured WAP unit.
router mode ... NOT in Gateway mode
mafkikker
DD-WRT Novice


Joined: 08 Nov 2021
Posts: 12

PostPosted: Mon Nov 15, 2021 15:53    Post subject: Reply with quote
[quote="mrjcd"]
Maybe you are running over yourself just a bit Shocked
NO need to make this so difficult Wink
From what I understand this is a WAN disabled....WAP (Wireless Access Point) with a guest network
Get rid of your last 3 lines in the firewall & reboot

This is all you need for guest on WAP ---
Code:
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


1. NO access to main subnet
2. gives guest network access to internet

in the 1st rule I have always used -j DROP although -j REJECT is ok also.
-j DROP = just get dead connection and waits for whatever is trying to access it gets a timeout.
-j REJECT = immediate reject of connection. Most like this because it shows a rejection in less than a second...
...the problem I have with that is---> a REJECT command
also tells whomever there is something there because it is rejecting connections from this subnet. Twisted Evil

Deleted the three lines.
This in my firewall entry now
iptables -I FORWARD -i wl0.1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
---

mrjcd wrote:

EDIT: just a bit more...
The above is for a correctly configured WAP unit.
router mode ... NOT in Gateway mode


Changed from gateway to router mode...

Client connected to guest network, gets ip-address .... no internet
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 5946
Location: Texas

PostPosted: Mon Nov 15, 2021 16:02    Post subject: Reply with quote
Probably need the Broadcom VAP work-around.

To simplify this whole mess YOU should have created a simple VAP.
If that is good then add more until you get what you want.
There are many things that can cause VAP not to get IP address.
BEST guess is the stupid Broadcom VAP problem...that is why you need the workaround.

BCM units did NOT always have this problem with DD-WRT 🙄
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 10788
Location: Netherlands

PostPosted: Mon Nov 15, 2021 16:41    Post subject: Reply with quote
It is really simple I did it in 5 minutes:

See the following thread post 7 and 10:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1248905#1248905

Especially take note of VAP on a WAP in the attached document of post 7

_________________
Routers:Netgear R7800, R7000, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 13112
Location: Texas, USA

PostPosted: Mon Nov 15, 2021 16:53    Post subject: Reply with quote
Someone introduced non-applicable information into the discussion. And I must've misread it. So the multiple dhcpd server is available to configure with WAN disabled, correct? I don't know why we went on the tangent of DNSMasq method... as it likely does not apply here. Only thing that could be causing issue is not picking up DNS servers or gateway information. And I could've sworn NET and AP isolation were fixed...
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
At some point, people just get plain tired of this place.
Because they are tired of bottom-feeders and the same old hat.

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 5946
Location: Texas

PostPosted: Mon Nov 15, 2021 16:54    Post subject: Reply with quote
mafkikker wrote:
Client connected to guest network, gets ip-address .... no internet

from previous page--
Code:
This is the dnsmasq entry :
interface=wl0.1
dhcp-option=wl0.1,3,192.168.10.1
dhcp-option=6,192.168.178.1,84.116.46.22,84.116.46.23
dhcp-range=wl0.1,192.168.10.100,192.168.10.200,255.255.255.0,12h


WTH ---> GET RID of dhcp-option=6

see ---> https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1047143#1047143
scroll down to the E2500 setup which is a broadcomy unit
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 13112
Location: Texas, USA

PostPosted: Mon Nov 15, 2021 17:05    Post subject: Reply with quote
Seems like you want to rely on not using the multiple dhcpd server function in the webUI on the networking page. Is it because it is broken? @egc has shown that he successfully set it up using it. Device-specific bug? Or too much confusing information...
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
At some point, people just get plain tired of this place.
Because they are tired of bottom-feeders and the same old hat.

----------------------
Linux User #377467 counter.li.org / linuxcounter.net
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 5946
Location: Texas

PostPosted: Mon Nov 15, 2021 22:36    Post subject: Reply with quote
Alright then Shocked Evil or Very Mad Rolling Eyes
I be damn but you, mafkikker are correct.
see ---> https://mrjcd.com/junk/dd-wrt/r43028/
Need to see the 'ReadMe.html' in that directory before anything else Twisted Evil
mafkikker
DD-WRT Novice


Joined: 08 Nov 2021
Posts: 12

PostPosted: Tue Nov 16, 2021 13:34    Post subject: Reply with quote
mrjcd wrote:
Alright then Shocked Evil or Very Mad Rolling Eyes
I be damn but you, mafkikker are correct.
see ---> https://mrjcd.com/junk/dd-wrt/r43028/
Need to see the 'ReadMe.html' in that directory before anything else Twisted Evil


I was starting to wonder if I was seeing everything clearly. But fortunately I am.
Older firmware is the solution.....
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 5946
Location: Texas

PostPosted: Tue Nov 16, 2021 14:07    Post subject: Reply with quote
mafkikker wrote:
I was starting to wonder if I was seeing everything clearly. But fortunately I am.
Older firmware is the solution.....

yeahuh, for now I reckon Twisted Evil
Let us know iffin you get setup what you wanted.
I might try it more on some other BCM units I have if find the time....the RTN12-D1 is a bit cranky bitch anyways Laughing
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 10788
Location: Netherlands

PostPosted: Tue Nov 16, 2021 14:17    Post subject: Reply with quote
Well I recently did it on an E2000 using build 47581 Kernel 4.4
No problem, up in a couple of minutes.

But I use the modern method using the GUI to setup and always leave the router in Gateway mode but I do not think that that matters.

As the E3000 is using the same builds you would expect it to work, but I have no E3000 to test

_________________
Routers:Netgear R7800, R7000, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 10788
Location: Netherlands

PostPosted: Tue Nov 16, 2021 14:52    Post subject: Reply with quote
Just redid it for build 47644 and no problem connecting to the VAP and connecting to the internet see attached doc


VAP on a WAP E2000.pdf
 Description:

Download
 Filename:  VAP on a WAP E2000.pdf
 Filesize:  180.51 KB
 Downloaded:  66 Time(s)


_________________
Routers:Netgear R7800, R7000, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Goto page Previous  1, 2, 3  Next Display posts from previous:    Page 2 of 3
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum