[mafkikker]

Hello,

I have a DDWRT ifrmware based linksys e3000 with lan connected to my modem from my provider. The version I use is "Firmware: DD-WRT v3.0-r47608 mega (10/28/21)".
Config of the DDWRT router is as follow :
- two wireless networks in bridged mode
- dhcp is disabled
- wan port is connected to the internetmodem by cable
- operation mode is Router
I followed this https://wiki.dd-wrt.com/wiki/index.php/Wireless_Access_Point during the installation

Now I want to create a guest netwwork on the ddwrt router so that the guests connected to the guest network cannot acces my devices on my private lan.
I'v tried https://wiki.dd-wrt.com/wiki/index.php/Guest_WiFi_+_abuse_control_for_beginners, https://wiki.dd-wrt.com/wiki/index.php/Guest_Network and https://support.flashrouters.com/setup-guides/advanced-wireless-setup/wireless-guest-network-setup-bridged-advanced/ but they don't work for me.
I get messages like "cannot get ip-adres" or "cannot cannect to the network" on my client.

Does anyone have a solution on how to set up a guest network so that network traffic is seperated?

[egc]

So actually you have set up the router as a WAP:
https://wiki.dd-wrt.com/wiki/index.php/Wireless_access_point
(I always leave the router in gateway mode but that does not matter in this case)

I am not sure if there are mega K2.6 builds but if that is what you are using then I recommend to use a K3 build:
https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2021/11-05-2021-r47618/broadcom_K3X/

See the following thread post 7 and 10:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1248905#1248905

Especially take note of VAP on a WAP in the attached document of post 7

Hope that helps

[mafkikker]

[egc]

[kernel-panic69]

That info will be on the main router status page. I don't think the linked information in the upper right corner for firmware revision will show that in the popup?

[mafkikker]

I followed the directions from the word document section "Separate (unbridged) VAP".
I disabled network isolation because that does not work.
Added dhcp to wl0.1.

Then followed these instructions :
VAP on WAP
If you place the unbridged VAP on a wireless access point (a secondary router with a disabled WAN, no DHCP and on the same subnet as a the primary router) then you have to add the following rule to the firewall in order to get internet access from the VAP.
In the web-interface of the router: Administration/Commands save Firewall:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to $(nvram get lan_ipaddr)
Net Isolation does not work on a WAP so just keep it disabled and add the following line to the firewall:
iptables -I FORWARD -i wl0.1 -d $(nvram get lan_ipaddr)/$(nvram get lan_netmask) -m state --state NEW -j REJECT

For isolating the WAP itself from the guest network:
iptables -I INPUT -i wl0.1 -m state --state NEW -j REJECT
iptables -I INPUT -i wl0.1 -p udp -m multiport --dports 53,67 -j ACCEPT
(note: not all firmwares have the multiport directive)

Reboot the router.
Tried Setup/commands/run command to try this out.
sleep 20; stopservice nas; wlconf eth1 down; wlconf eth2 down; wlconf eth1 up; wlconf eth2 up; startservice nas; logger "VAP workaround executed";

Client cannot get an ip-adres.

[mafkikker]

Here are the sesstings from my VAP fot guest network.
Can someone explain why under status/lan the dhcp range shown is from 192.168.1.100 to 192.168.1.149 and not from 192.168.20.100 to 192.168.20.149 ?

My clients don't get ip-adresses when connecting to the vap guste network.[/code]

[bushant]

[mafkikker]

@bushant

[egc]

Remove everything which you added to the Firewall except the nat rule

Maybe it will start to work then after a reboot and it is even possible that you do not need the VAP workaround at all (to be tested if it works)

[kernel-panic69]

1) You have to be careful how you copy and paste into the webUI.
2) Syntax and escape characters do apply as far as the webUI functionality. What works via telnet/ssh doesn't always work via that input box, save and except for saving scripts.

[mafkikker]

[jwh7]

I would reset and start over using the WAP wiki (as you did) and the dnsmasq VAP setup (it's what I use for all my WAP/CM+VAP's. No dhcpd.
https://wiki.dd-wrt.com/wiki/index.php/Guest_Network#DNSMasq_method

Note: I don't know this device's switch/cpu architecture (the WAN might be a special switch port, different switch, or on the cpu itself), but you could be limiting your speed/latency if connecting (a non-gateway) via WAN. I only use WAN ports for lower speed/importance things (doorbell cam, A/V Rx to stream Pandora, testing older 100Mb PCs, telnet/ssh admin access, etc). If you know the architecture and that it isn't an issue, then nm me.

[mafkikker]

[kernel-panic69]

Why are you passing the upstream router IP as a DNS server? Do you still have E3000 WAN connected to upstream router's LAN? This may not work, might require LAN to LAN. Do the main AP interfaces work properly? Wondering if you need to set upstream router IP as gateway (option 3)...

That "DNSMasq method" makes me wonder if the process of a WAP configuration is counter-intuitive and should be done in a specific order so that disabling the WAN is the last step.