(SOLVED) No internet on wl0.1 SSID on client wrt-320n

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Thu Mar 18, 2010 21:00    Post subject: (SOLVED) No internet on wl0.1 SSID on client wrt-320n Reply with quote
Hi, I tried all the tutorials and howto's I could find to create multiple SSID's for one public Wifi, but I don't get it to work.

For example:
http://www.dd-wrt.com/wiki/index.php/Multiple_WLANs#DHCP

Setup:
Host : wrt-320n with original linksys firmware
Client : wrt-320n DD-WRT v24-sp2 (02/23/10) mega (build 13972).

The host is the DHCP server and provides internetconnection with local ip set to 192.168.1.2
The client is connected with WAN port to host LAN and needs to serve the LAN ports, 1 private wifi and one public wifi (with later on Chillispot or http redirect, but thats for later..)


Client config:
Connection Type : Disabled
Local IP Address : 192.168.1.1
Subnet Mask : 255.255.255.0
Gateway : 192.168.1.2
Local DNS : 192.168.1.2

Assign WAN Port to Switch : checked
DHCP Server : disabled
Use DNSMasq for DHCP : checked
Use DNSMasq for DNS : checked
DHCP-Authoritative : checked

Wireless Physical Interface wl0
Wireless Mode : AP
Wireless Network : NG-Mixed
Wireless Network Name : xxxxx
Wireless Channel : Auto
Channel Width : Auto
Wireless SSID Broadcast : Enable
Security Mode : WPA2 Personal/AES

Virtual Interfaces wl0.1 SSID
Wireless Network Name : AP
Wireless SSID Broadcast : Enable
AP Isolation : Enable
Network Configuration : Bridged
Security Mode : NONE

Bridging
http://nl.tinypic.com/view.php?pic=hvt5k3&s=5

DNSMasq
http://nl.tinypic.com/view.php?pic=6578rt&s=5

SPI Firewall : Off

Currently no iptables are set in the Managment/Commands tab (the tutorial assumes that it should work without any rules), and previous attempts with rules did not work as well.

Result
Wired networking and internet works.
Wireless Physical Interface networking and internet works.

Virtual Interfaces wl0.1 NOPE

My laptop AGN 5100 NIC gets :
Ipaddress : 192.168.2.127
Subnet : 255.255.255.0
Gateway : 192.168.2.1
DHCP Server : 192.168.2.1
DNS Server : 192.168.2.1

This last one seems a little bit odd, since in DNS Masq the Local DNS is disabled...

I'm struggling for more then a week now, bricked my first dd-wrt router after trying different builds to solve the problem, but it should not be that hard...

What am I missing to give the virtual SSID internet access without network access?


Last edited by martijn on Fri Mar 19, 2010 14:39; edited 1 time in total
Sponsor
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Fri Mar 19, 2010 1:05    Post subject: Reply with quote
OK, I am playing with the iptables and in my search i came to this post:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=68149

So i'm not the only one who thinks that it is a little unclear that you need some iptable rules to make multiple SSID works with WAN port disabled in this part of the tutorial :

http://www.dd-wrt.com/wiki/index.php/Multiple_WLANs#Restricting_Access

Im trying some iptable rules now, but its a little unclear to me which tables are required for muliteple SSID's on a router with WAN disabled.

As far as I understand, these rules are required:

iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`

but still.... no luck :(

EDIT: Windows show me that I have internet connection, bu I cant connect to it...

I can ping to the router and virtual SSID ip addresses from the laptop, so I must be close now...

Just one little firewal rule more... or less?
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 19, 2010 1:18    Post subject: Re: No internet on wl0.1 SSID on client wrt-320n Reply with quote
martijn wrote:
Currently no iptables are set in the Managment/Commands tab (the tutorial assumes that it should work without any rules), and previous attempts with rules did not work as well.

For the past ~2 weeks it has clarified this for WAP's.
Quote:
You should now be able to connect to VAP's SSID and receive a DHCP lease with an IP address that is in the 192.168.2.0/24 subnet. Make sure that you can connect to it, receive a DHCP lease, and connect to the router's 192.168.2.1 address from the VAP before you do anything further. If your WAN port is active (ie. you're not making a WAP) then you should also be able to browse the internet.

You need to add the iptables NAT rule for WAP's to give the VAP internet access.

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Fri Mar 19, 2010 1:34    Post subject: Reply with quote
Thanks for your reply...

I think im a little too stupid...

I added the rule (I tried several combinations):

Code:
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


(nvram get lan_ipaddr gives 192.128.1.1 (router ip)) with telnet.
I even replaced nvram get lan_ipaddr with 192.168.1.1, but no luck.

Could you please post the rules I need from the example list?
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 19, 2010 1:49    Post subject: Reply with quote
Those were the correct rules. (I started replying but got occupied so I didn't finish my post until after you had made the 2nd post)

The fact that windows says you have internet suggests that you might be having a DNS problem. From the client, try to ping google.com and see what it says.

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Fri Mar 19, 2010 1:56    Post subject: Reply with quote
ping google.nl from cmd:

Ping to [209.85.229.104]

But then I only get time outs..

EDIT

ping from the webgui results in this:

PING google.nl (74.125.77.104): 56 data bytes
64 bytes from 74.125.77.104: seq=0 ttl=55 time=13.281 ms
64 bytes from 74.125.77.104: seq=1 ttl=55 time=12.322 ms
64 bytes from 74.125.77.104: seq=2 ttl=55 time=12.474 ms
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 19, 2010 2:17    Post subject: Reply with quote
Telnet/ssh to the router and ping from the router to google. If it fails too, then you might have an IP address conflict with another device using the 192.168.1.1 address.
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Fri Mar 19, 2010 2:24    Post subject: Reply with quote
ping with telnet 192.168.1.1 works:

64 bytes from 209.85.229.104: seq={int++} ttl=55 time 13 ms

note : my Wireless Physical Interface wl0 does work
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 19, 2010 3:17    Post subject: Reply with quote
Paste the output from these commands.

iptables -vnL FORWARD
iptables -t nat -vnL POSTROUTING
route -n

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Fri Mar 19, 2010 3:37    Post subject: Reply with quote
Thanks for your effort..

Firewall rules :

iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


iptables -vnL FORWARD :
Chain FORWARD (policy ACCEPT 4 packets, 208 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- br1 * 0.0.0.0/0 192.168.1.0/24 state NEW
0 0 ACCEPT 0 -- br1 * 0.0.0.0/0 0.0.0.0/0

iptables -t nat -vnL POSTROUTING
Chain POSTROUTING (policy ACCEPT 7 packets, 863 bytes)
pkts bytes target prot opt in out source destination
83 3443 SNAT 0 -- * br0 0.0.0.0/0 0.0.0.0/0

route -n:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 192.168.1.2 0.0.0.0 UG 0 0 0 br0

windows internet connection message ig gone btw for virtual SSID...
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 19, 2010 7:18    Post subject: Reply with quote
Some of the output seems to be missing, but don't worry about it for now... Instead try using just the NAT rule in your firewall and nothing else, then check if you can ping 192.168.1.2 from a client connected to the VAP.

iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


You could also try another way of doing the NAT with this rule.

iptables -t nat -I POSTROUTING -o br0 -j MASQUERADE


I'm starting to think that you may need to hard reset using the WPS button and reconfigure it though.

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
martijn
DD-WRT Novice


Joined: 12 Mar 2010
Posts: 14

PostPosted: Fri Mar 19, 2010 14:35    Post subject: Reply with quote
Ok, it works now.

This is what I did.

I telnetted in to the router and and entered:

Code:
erase nvram


to reset the router.

Then I followed the instructions again and I really don't know why but it works now!!!!!!!

iptable settings I use now:

Code:
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


But your alternative worked as well:

Code:
iptables -t nat -I POSTROUTING -o br0 -j MASQUERADE


It only takes about a minute or longer before the laptop connects to the virtual SSID, but it does work!!

Thanks a lot!!!!!!
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10143

PostPosted: Fri Mar 19, 2010 20:30    Post subject: Reply with quote
Not the first time crazy unexplained behavior has happened because of left over nvram data. Glad that ya got it solved.
_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum