Guest wifi on second router

Post new topic   Reply to topic    DD-WRT Forum Index -> Qualcomm Atheros based Hardware
Author Message
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Wed Jan 07, 2026 18:37    Post subject: Guest wifi on second router Reply with quote
Hi,

Is there a quide to setup a guest network on a second router in the network?

This is what I am trying to set:
1. DD-WRT as gateway on router 1. This has WIFI and Guest network running fine.
2. DD-WRT as wired AP.

When trying to set the Guest network on the wired AP I never get an IP nor internet connection.

I have tried creating a second bridge br1 and this works fine in the router1 and it includes the Guest network but even if creating the same br1 on the router 2 it never works.

Is there a better way of setting this?
Sponsor
dplotz
DD-WRT User


Joined: 07 Jan 2025
Posts: 244
Location: Bethel Park, PA, USA

PostPosted: Wed Jan 07, 2026 18:48    Post subject: Reply with quote
You need some iptables rules to make it work on an AP.

Code:
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp -m multiport --dports 53,67 -j ACCEPT


Attached is the guide I used, downloaded from the forum.



DDWRT Virtual Access Point Public.doc
 Description:

Download
 Filename:  DDWRT Virtual Access Point Public.doc
 Filesize:  254.5 KB
 Downloaded:  4 Time(s)


_________________
Formerly dpp3530
Linksys MR7350
Gateway, 2 wired APs, NSS-ECM , Clock 1440MHz
VAPs on wlan0 and wlan1 for guest/IOT devices
IPv4 & IPv6 (Prefix Delegation)
Static Leases & DHCP
SmartDNS (DOT using NextDNS, Cloudflare), DNSMasq
Wireguard and OpenVPN server
2.4GHz: dd-wrt, AX Only, ACK Timing 1350, WPA3 SAE & WPA2 w/AES
5GHz: dd-wrt, AX/AC/N Mixed, ACK Timing 1350, WPA3 SAE & WPA2 w/AES
Verizon Fios, 500/500Mbps
dplotz
DD-WRT User


Joined: 07 Jan 2025
Posts: 244
Location: Bethel Park, PA, USA

PostPosted: Wed Jan 07, 2026 19:01    Post subject: Reply with quote
Technically if you want to do it right, you should have a VLAN on your primary router and just extend it to your secondary router. I have unmanaged switches between my devices so that doesn't work for me. So technically, I have three guest networks - one on my gateway router and one on each of my two access points. Since I have AP isolation turned on anyway, the only downside I see is that clients on two of the access points could get the same IP address. This would only be a problem if someone happened to roam from one AP to another. It's been a couple years and it hasn't happened yet, though. My guest network(s) aren't exactly high-traffic, to be fair.
_________________
Formerly dpp3530
Linksys MR7350
Gateway, 2 wired APs, NSS-ECM , Clock 1440MHz
VAPs on wlan0 and wlan1 for guest/IOT devices
IPv4 & IPv6 (Prefix Delegation)
Static Leases & DHCP
SmartDNS (DOT using NextDNS, Cloudflare), DNSMasq
Wireguard and OpenVPN server
2.4GHz: dd-wrt, AX Only, ACK Timing 1350, WPA3 SAE & WPA2 w/AES
5GHz: dd-wrt, AX/AC/N Mixed, ACK Timing 1350, WPA3 SAE & WPA2 w/AES
Verizon Fios, 500/500Mbps
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Wed Jan 07, 2026 20:48    Post subject: Reply with quote
I have tried with VLAN's but did not worked (maybe not well supported on Archer C7). Or I have done something wrong. This is why I was asking if there is a quide for this.
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Wed Jan 07, 2026 20:55    Post subject: Reply with quote
Hmm... what I have done was exactly like in your guide just that I have not done a reboot as stated there. I will try during the weekend again to see if this time it works.
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 3778
Location: Germany

PostPosted: Thu Jan 08, 2026 8:02    Post subject: Reply with quote
subject: Basic VLAN configuration via GUI
_________________
Quickstart guides:

use Pi-Hole as simple DNS-Server with DD-WRT

Routers
Marvell OCTEON TX2 - QHora-322 - OpenWrt 24.10.4 - Gateway
Qualcomm IPQ8065 - R7800 - dd-wrt r53562 - WAP
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Thu Jan 08, 2026 17:23    Post subject: Reply with quote
ho1Aetoo wrote:
subject: Basic VLAN configuration via GUI


Thank you so much for the link. It was exactly what I needed. Smile

I only have a small problem now that I have to find a way to fix it... one of the devices in the guest network it uses a tunnel (not DD-WRT) and that is not working. It manages to connect to the external server but apparently the external server cannot reach it back (no port forwarding was needed before).
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Thu Jan 08, 2026 17:49    Post subject: Reply with quote
The tunnel was also sorted. All good now. Thank you very much for the hints.
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 3778
Location: Germany

PostPosted: Thu Jan 08, 2026 19:05    Post subject: Reply with quote
I'm glad when everything works Very Happy
_________________
Quickstart guides:

use Pi-Hole as simple DNS-Server with DD-WRT

Routers
Marvell OCTEON TX2 - QHora-322 - OpenWrt 24.10.4 - Gateway
Qualcomm IPQ8065 - R7800 - dd-wrt r53562 - WAP
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Fri Jan 09, 2026 3:34    Post subject: Reply with quote
Well... i had to rollback to the previous configuration. The network is extremely slow with this setup. Sad It works but is super slow... 10Mbs. This happens especially on the devices connected to the wired AP.
Probably it uses the CPU and Archer C7 it doesn't have a powerful one.
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 3778
Location: Germany

PostPosted: Fri Jan 09, 2026 7:45    Post subject: Reply with quote
There could be several reasons for this, e.g., you did not follow the instructions and did not unbridge the necessary interfaces, or you activated SFE (which can also cause problems with VLANs).

VLANs do indeed consume slightly more CPU, but not by a factor of 10-100.

WLAN CLient -> WAP -> Gateway -> LAN Client

[SUM] 10.00-10.01 sec 640 KBytes 709 Mbits/sec 0

LAN CLient -> WAP -> Gateway -> LAN Client

[SUM] 9.00-10.00 sec 111 MBytes 930 Mbits/sec 0

Guest WLAN Client -> WAP -> Gateway -> LAN Client

[SUM] 9.00-10.00 sec 90.0 MBytes 755 Mbits/sec 0

You should be aware that newer builds may use nftables instead of iptables.

_________________
Quickstart guides:

use Pi-Hole as simple DNS-Server with DD-WRT

Routers
Marvell OCTEON TX2 - QHora-322 - OpenWrt 24.10.4 - Gateway
Qualcomm IPQ8065 - R7800 - dd-wrt r53562 - WAP
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Fri Jan 09, 2026 8:31    Post subject: Reply with quote
SFE is active on the Gateway and that is not that slow and it was not active in the wired AP. Maybe during the weekend I will add again the config (i have it saved).

The setup was identical with the one in the quide. I picked the setup that uses Trunk on port 4.
numerci
DD-WRT User


Joined: 02 May 2012
Posts: 163

PostPosted: Fri Jan 09, 2026 17:32    Post subject: Reply with quote
I have restored the setup and spotted a small mistake in the setup of main router. Now all speeds are as they should. Thank you for providing the link to the quide. Smile
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Qualcomm Atheros based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum