What's new

Give Guest Wi-Fi Users Access To Printer?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

HarryMuscle

Senior Member
I currently have my guest Wi-Fi networks setup to allow guests to access each other but they are blocked from accessing the non guest LAN devices, which is exactly what I want. However, it turns out I also need to give my guests access to the printer which is located on the LAN.

I'm assuming this needs to be done via iptable changes (unless there's a way to do this via the GUI which would be ideal). Also since my printer has a web interface, I would prefer to only allow access to certain ports of the printer that are actually used for printing and not to open up the whole IP to the guest Wi-Fi.

Any help in putting together the correct iptable rules would be greatly appreciated.

Thanks,
Harry
 
Check out YazFi.
 
Asuswrt used to use ebtables to isolate guest network and LAN, now they use VLAN to isolate guest network 1, while guest networks 2 and 3 still use ebtables.
I assume guest network 1 would be the wl0.1 interface which is the first 2.4GHz guest network, correct?
 
I assume guest network 1 would be the wl0.1 interface which is the first 2.4GHz guest network, correct?
Yes wl0.1 is 2.4 GHz guest network 1, wl0.2 is 2.4 GHz guest network 2, wl1.1 is 5 GHz guest network 1...
 
Any way to do it without YazFi (which does quite a bit more than what I'm after)?
Yes but as you already know, it involves scripting. With YazFi you do have examples of the script to work with at the previously provided links.
 
Yes wl0.1 is 2.4 GHz guest network 1, wl0.2 is 2.4 GHz guest network 2, wl1.1 is 5 GHz guest network 1...
So VLANs are used to isolate both 2.4GHz wl0.1 and 5GHz wl1.1 networks, correct? Does that mean etables could not be used to bypass the isolation if I'm using those two guest networks?
 
Yes but as you already know, it involves scripting. With YazFi you do have examples of the script to work with at the previously provided links.
Anyone know if YazFi works with AiMesh nodes? Apparently VLANs are used for the first 2.4 and 5 GHz guest networks so that the AiMesh nodes can also handle guests. Would using YazFi prevent that?
 
Last edited:
I guess that then becomes the main reason why I'm trying to find a solution that doesn't use YazFi.

The routing between guest VLAN and main VLAN is already there, IPTables filters what can or can't go through (by default, main LAN can access guest and guest can reply, but cannot initiate to main LAN). So you'll have to find those rules and add one to allow printing from guest.

Option 2 - if your printer has both wired and wireless, use wired for LAN and join the wireless to guest (some printers only allow one or the other, some work on both).

Option 3 - if your printer won't allow both to be used at the same time, enable wifi direct on the printer for guests to use and keep wired for LAN (the ones that don't allow both for regular LAN use do typically allow wired LAN plus wifi direct).

Option 4 - use the print server built into the Asus, not 100% sure if guests can see that, worth a try. You'd still use LAN cable for regular printing and USB to router for guest print server, or you could potentially use USB for both. No idea if it'll work, just an idea.

Option 5 - Just put it on the guest network, since main LAN can access guest network and should be able to print fine. But if you attempt to initiate something from the printer (like scan to pc from the printer control panel) that won't work anymore.
 
The routing between guest VLAN and main VLAN is already there, IPTables filters what can or can't go through (by default, main LAN can access guest and guest can reply, but cannot initiate to main LAN). So you'll have to find those rules and add one to allow printing from guest.

Option 2 - if your printer has both wired and wireless, use wired for LAN and join the wireless to guest (some printers only allow one or the other, some work on both).

Option 3 - if your printer won't allow both to be used at the same time, enable wifi direct on the printer for guests to use and keep wired for LAN (the ones that don't allow both for regular LAN use do typically allow wired LAN plus wifi direct).

Option 4 - use the print server built into the Asus, not 100% sure if guests can see that, worth a try. You'd still use LAN cable for regular printing and USB to router for guest print server, or you could potentially use USB for both. No idea if it'll work, just an idea.

Option 5 - Just put it on the guest network, since main LAN can access guest network and should be able to print fine. But if you attempt to initiate something from the printer (like scan to pc from the printer control panel) that won't work anymore.
Option 1 is definitely most ideal. I'm just surprised that no one has done it yet on their router and shared the needed iptable changes. I would have thought that it's a fairly common requirement.
 
Option 1 is definitely most ideal. I'm just surprised that no one has done it yet on their router and shared the needed iptable changes. I would have thought that it's a fairly common requirement.

Never seen anyone ask for it before, and personally have never needed it. Plus the new Guest setup with different VLANs has only existed since 386 code base so still fairly recent, any IPTABLES rules someone may have come up with for the old design (which GW2 and 3 still use) wouldn't apply to GW1.
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top