Guest Wifi still has access to other subnet over VPN

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
rsenio
DD-WRT Novice


Joined: 18 Oct 2013
Posts: 17

PostPosted: Fri Oct 18, 2013 19:42    Post subject: Guest Wifi still has access to other subnet over VPN Reply with quote
Pulling my hair out, I'd love some help here. I'm not the most iptables savy guy out there.

I've got a wifi router running dd-wrt that also has a guest wifi setup on it. It works great for prventing traffic to my local lan, however I just noticed that I can still see my other subnets located over the site to site VPN link.

For example:
local lan - 192.168.50.0/24
Site to Site VPN Subnet 1- 192.168.30.0/24
Site to Site VPN Subnet 2- 192.168.40.0/24
Guest Wifi - 192.168.1.0/24

While connected to the guest wifi I cannot see the 192.168.50.0/24 subnet. Perfect.

However, I can still see both of the other 2 subnets located in remote offices. Here's my current firewall commands on the DD-WRT

iptables -I FORWARD -i br1 -d `nvram get wan_ipaddr`/`nvram get wan_netmask` -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
Sponsor
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Oct 18, 2013 20:16    Post subject: Reply with quote
iptables -I FORWARD -i br1 -d 192.168.30.0/24 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -d 192.168.40.0/24 -m state --state NEW -j DROP

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
rsenio
DD-WRT Novice


Joined: 18 Oct 2013
Posts: 17

PostPosted: Fri Oct 18, 2013 20:33    Post subject: Reply with quote
Yep, thanks for the clarification. I had that in, but perhaps the positioning was incorrect. Either way, I'm set.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum