ASUS RT AC66U Disable 2.4GHz

[kevindd992002]

Is there a way to disable the 2.4GHz band for the main network in the RT AC66U while still enabling it for the Guest network? If I go to Wireless -> Professional, it turns the 2.4GHz band completely.

 

[ColinTaylor]

No. Guest networks are just virtual interfaces created off of the primary wireless interface. So you can't turn off the primary without turning off the guests. I suppose the best you could do is to assign a really complex password to the primary network.

 

[kevindd992002]

I see. My goal is to have both bands enabled on the Guest network and have only 5GHz in my primary network. I don't have issues with security because I use a RADIUS server anyway. I just want to be able to be more granular just like how I can with my Ubiquiti ecosystem in my other house. I guess the best I can do is to really just separate the SSID's of the 2.4GHz and 5GHz bands for the primary network.

 

[kevindd992002]

Thanks for the suggestion. And I guess I should also change the SSID of the 2.4GHz band for the primary network (even while hidden) so that connecting to the primary SSID will only be through 5GHz, correct?

 

[ColinTaylor]

Thanks for the suggestion. And I guess I should also change the SSID of the 2.4GHz band for the primary network (even while hidden) so that connecting to the primary SSID will only be through 5GHz, correct?

Sounds like a good idea.

 

[kevindd992002]

Also, I'm only using the AC66U as an AP (not a router). I have pfSense as my main firewall/router. In that scenario, can the AC66U guest network still be able to "isolate" clients connected to it?

 

[ColinTaylor]

No. In access point mode there is no differentiation between guest and non-guest in the sense that both have access to the LAN (intranet). IIRC that option isn't even selectable when in AP mode.

 

[Val D.]

No. In access point mode there is no differentiation between guest and non-guest

Guest Network option shouldn't be there at all in Access Point mode. What it creates is not a Guest Network anyway.

 

[kevindd992002]

That's what I thought. But the option to create it is there. Not even sure why.

Sent from my SM-G950F using Tapatalk

 

[ColinTaylor]

That's what I thought. But the option to create it is there. Not even sure why.

People mistakenly assume that "guest network = isolated from LAN", it doesn't (necessarily). You can equally create a guest network that isn't isolated from the LAN even in router mode.

Why? Well I suppose if you had guests staying with you and you wanted to give them access to your LAN services, like a printer or media server you could create a guest network with a random password for them without them having to know your "real" password. And then just delete the guest network when they've gone. Or maybe you want to setup your kids devices so they only connect to the guest network so that when it's bedtime it's easy to just turn off their access by turning off the guest network.

 

[kevindd992002]

People mistakenly assume that "guest network = isolated from LAN", it doesn't (necessarily). You can equally create a guest network that isn't isolated from the LAN even in router mode.

Why? Well I suppose if you had guests staying with you and you wanted to give them access to your LAN services, like a printer or media server you could create a guest network with a random password for them without them having to know your "real" password. And then just delete the guest network when they've gone. Or maybe you want to setup your kids devices so they only connect to the guest network so that when it's bedtime it's easy to just turn off their access by turning off the guest network.

Hmmm, makes sense. I didn't think that that was the case because the description of guest network in the UI is this:

The Guest Network provides Internet connection for guests but restricts access to your local network.

I mean, I'm still comparing it to my Ubiquiti ecosystem where the guest network is on a different VLAN but that's a different story, of course.

 

[Val D.]

I didn't think that that was the case because the description of guest network in the UI is this:

Indeed. And this is what it doesn't do in Access Point mode.

I'm still comparing it to my Ubiquiti ecosystem

Well... one is a consumer router <$100 currently, the other is a business solution for >$600. Can't compare it.

 

[PDinDetroit]

Consider making the RT-AC66U a Router instead of an Access Point. You could possibly use the following script (with the correct firmware version):

https://www.snbforums.com/threads/y...-merlin-guest-wifi-inc-ssid-vpn-client.45924/

1. Setup pfSense for an OpenVPN Server, internal that provides Internet access only.

2. Setup RT-AC66U as a Router.

3. Setup a Client OpenVPN from RT-AC66U to pfSense OpenVPN Server.

4. Install and configure YazFi script

This can then keep the Guest WiFi traffic off the internal network. There may be additional steps, this is just an overview.

 

[Val D.]

3. Setup a Client OpenVPN from RT-AC66U to pfSense OpenVPN Server.

This will cut down the throughput to about 10Mbps, this is what the router is capable of with OpenVPN. And it’s too complicated, requires John’s fork of Asuswrt-Merlin, etc.

 

[kevindd992002]

Indeed. And this is what it doesn't do in Access Point mode.



Well... one is a consumer router <$100 currently, the other is a business solution for >$600. Can't compare it.

More like a prosumer solution rather than an enterprise/business solution. I use a pfsense router with my Ubiquiti ecosystem too. But yeah, I get what you're saying.

Consider making the RT-AC66U a Router instead of an Access Point. You could possibly use the following script (with the correct firmware version):

https://www.snbforums.com/threads/y...-merlin-guest-wifi-inc-ssid-vpn-client.45924/

1. Setup pfSense for an OpenVPN Server, internal that provides Internet access only.

2. Setup RT-AC66U as a Router.

3. Setup a Client OpenVPN from RT-AC66U to pfSense OpenVPN Server.

4. Install and configure YazFi script

This can then keep the Guest WiFi traffic off the internal network. There may be additional steps, this is just an overview.

Thanks for the insight but I can't give up my pfsense as a router. Too many customizations with it already for it to just become an OpenVPN server.

 

[Val D.]

Too many customizations with it already for it to just become an OpenVPN server.

OpenVPN Server is just another service running on pfSense. You won't lose your current functionality. My point is running VPN, replacing the firmware with something not supported and installing scripts for the purpose or Guest Network separation is a bit too complicated approach and the RT-AC66U router has a weak CPU for VPN, capable to process only about 10Mbps. I would replace the RT-AC66U with UAP-AC-LITE (if we talk about Ubiquiti), it's <$100.