Give Guest Wi-Fi Users Access To Printer?

[HarryMuscle]

I currently have my guest Wi-Fi networks setup to allow guests to access each other but they are blocked from accessing the non guest LAN devices, which is exactly what I want. However, it turns out I also need to give my guests access to the printer which is located on the LAN.

I'm assuming this needs to be done via iptable changes (unless there's a way to do this via the GUI which would be ideal). Also since my printer has a web interface, I would prefer to only allow access to certain ports of the printer that are actually used for printing and not to open up the whole IP to the guest Wi-Fi.

Any help in putting together the correct iptable rules would be greatly appreciated.

Thanks,
Harry

 

[L&LD]

Check out YazFi.

 

[HarryMuscle]

Check out YazFi.

Seems like overkill for what I'm trying to do but if I can't find a more surgical approach I definitely will check it out. Thanks.

 

[HarryMuscle]

I noticed @Martineau created a script called GuestPrinter.sh that he posted years and years ago (https://www.snbforums.com/threads/guest-network-question.36500/#post-298242).

In case you see this @Martineau, do you know if that script still works on the latest Merlin firmware versions? Also, what were your reasons for using ebtables instead of iptables?

Thanks,
Harry

 

[bennor]

YazFi can do it. See my post here for an example of the scripting:
https://www.snbforums.com/threads/allowing-access-to-selected-network-devices.80405/#post-784521
YazFi Custom Firewall Rules:
https://github.com/jackyaz/YazFi#custom-firewall-rules

 

[Yota]

using ebtables instead of iptables?

Asuswrt used to use ebtables to isolate guest network and LAN, now they use VLAN to isolate guest network 1, while guest networks 2 and 3 still use ebtables.

 

[HarryMuscle]

YazFi can do it. See my post here for an example of the scripting:
https://www.snbforums.com/threads/allowing-access-to-selected-network-devices.80405/#post-784521
YazFi Custom Firewall Rules:
https://github.com/jackyaz/YazFi#custom-firewall-rules

Any way to do it without YazFi (which does quite a bit more than what I'm after)? I'd rather not introduce yet another script and possible point of failure if I don't have to.

Thanks,
Harry

 

[HarryMuscle]

Asuswrt used to use ebtables to isolate guest network and LAN, now they use VLAN to isolate guest network 1, while guest networks 2 and 3 still use ebtables.

I assume guest network 1 would be the wl0.1 interface which is the first 2.4GHz guest network, correct?

 

[Yota]

I assume guest network 1 would be the wl0.1 interface which is the first 2.4GHz guest network, correct?

Yes wl0.1 is 2.4 GHz guest network 1, wl0.2 is 2.4 GHz guest network 2, wl1.1 is 5 GHz guest network 1...

 

[bennor]

Any way to do it without YazFi (which does quite a bit more than what I'm after)?

Yes but as you already know, it involves scripting. With YazFi you do have examples of the script to work with at the previously provided links.

 

[HarryMuscle]

Yes wl0.1 is 2.4 GHz guest network 1, wl0.2 is 2.4 GHz guest network 2, wl1.1 is 5 GHz guest network 1...

So VLANs are used to isolate both 2.4GHz wl0.1 and 5GHz wl1.1 networks, correct? Does that mean etables could not be used to bypass the isolation if I'm using those two guest networks?

 

[HarryMuscle]

Yes but as you already know, it involves scripting. With YazFi you do have examples of the script to work with at the previously provided links.

Anyone know if YazFi works with AiMesh nodes? Apparently VLANs are used for the first 2.4 and 5 GHz guest networks so that the AiMesh nodes can also handle guests. Would using YazFi prevent that?

 

[bennor]

Anyone know of YazFi works with AiMesh nodes?

No. See this reply by Jack Yaz.

YazFi doesn't work on Aimesh nodes. The guest network on the node will be unrestricted

 

[HarryMuscle]

No. See this reply by Jack Yaz.

I guess that then becomes the main reason why I'm trying to find a solution that doesn't use YazFi.

 

[drinkingbird]

I guess that then becomes the main reason why I'm trying to find a solution that doesn't use YazFi.

The routing between guest VLAN and main VLAN is already there, IPTables filters what can or can't go through (by default, main LAN can access guest and guest can reply, but cannot initiate to main LAN). So you'll have to find those rules and add one to allow printing from guest.

Option 2 - if your printer has both wired and wireless, use wired for LAN and join the wireless to guest (some printers only allow one or the other, some work on both).

Option 3 - if your printer won't allow both to be used at the same time, enable wifi direct on the printer for guests to use and keep wired for LAN (the ones that don't allow both for regular LAN use do typically allow wired LAN plus wifi direct).

Option 4 - use the print server built into the Asus, not 100% sure if guests can see that, worth a try. You'd still use LAN cable for regular printing and USB to router for guest print server, or you could potentially use USB for both. No idea if it'll work, just an idea.

Option 5 - Just put it on the guest network, since main LAN can access guest network and should be able to print fine. But if you attempt to initiate something from the printer (like scan to pc from the printer control panel) that won't work anymore.

 

[HarryMuscle]

The routing between guest VLAN and main VLAN is already there, IPTables filters what can or can't go through (by default, main LAN can access guest and guest can reply, but cannot initiate to main LAN). So you'll have to find those rules and add one to allow printing from guest.

Option 2 - if your printer has both wired and wireless, use wired for LAN and join the wireless to guest (some printers only allow one or the other, some work on both).

Option 3 - if your printer won't allow both to be used at the same time, enable wifi direct on the printer for guests to use and keep wired for LAN (the ones that don't allow both for regular LAN use do typically allow wired LAN plus wifi direct).

Option 4 - use the print server built into the Asus, not 100% sure if guests can see that, worth a try. You'd still use LAN cable for regular printing and USB to router for guest print server, or you could potentially use USB for both. No idea if it'll work, just an idea.

Option 5 - Just put it on the guest network, since main LAN can access guest network and should be able to print fine. But if you attempt to initiate something from the printer (like scan to pc from the printer control panel) that won't work anymore.

Option 1 is definitely most ideal. I'm just surprised that no one has done it yet on their router and shared the needed iptable changes. I would have thought that it's a fairly common requirement.

 

[drinkingbird]

Option 1 is definitely most ideal. I'm just surprised that no one has done it yet on their router and shared the needed iptable changes. I would have thought that it's a fairly common requirement.

Never seen anyone ask for it before, and personally have never needed it. Plus the new Guest setup with different VLANs has only existed since 386 code base so still fairly recent, any IPTABLES rules someone may have come up with for the old design (which GW2 and 3 still use) wouldn't apply to GW1.