Guest network problem

[bigtreiber]

Hi there,

I'm using two ASUS Routers (N66U and AC87U, both running Merlinwrt 380.61) as access points in my Homenetwork.

Internet Access and DHCP is managed via a Fritzbox and the two ASUS Routers are connected via LAN to the Fritzbox.

Everything works fine and as expected apart from "guest network".

When I enable guest network on one of the ASUS Routers there is a separate WiFi with a different SSID and WPA2 Key, but the network is not seperated. Devices connected to the ASUS Router still have COMPLETE access to my home network.

I just tried it with https://gist.github.com/the-darkvoid/c6a1c112603cc33e68a7 and inserted the code from the script to "services-start" in /jffs/scripts, but that didn't change anything :-(

What am I doing wrong? Any suggestions?

Regards,
bigtreiber

 

[RMerlin]

AP mode is unable to isolate guest clients, because the network routing is handled by the Fritzbox, not by the Asus device.

 

[pjotr2k]

Issue accures for Me on the 5ghz wifi ,even though i just use the ac87u as a router and not in ap mode.
The 2.4 isolates correctly but not on 5ghz. Even exchanged the router but same issue, contacted asus about it but they havent got back to me about the issue.

Skickat från min LG-H815 via Tapatalk

 

[bigtreiber]

AP mode is unable to isolate guest clients, because the network routing is handled by the Fritzbox, not by the Asus device.

Thanks for the info. Any suggestions how to set things up to reach the goal? Do I have to use "router" mode on the Asus Devices?

 

[RMerlin]

Thanks for the info. Any suggestions how to set things up to reach the goal? Do I have to use "router" mode on the Asus Devices?

Yes, however this will create different problems, where you will be double NATed.

 

[Fitz Mutch]

Devices connected to the ASUS Router still have COMPLETE access to my home network.

For your Guest Network, is "Access Intranet" = OFF? Have you played around with the Ebtables BROUTING chain?

# EXAMPLE:  block computers attached to a Guest Network (wl0.1) from seeing computers on your other local networks
/usr/sbin/ebtables -t broute -I BROUTING -p IPv4 -i wl0.1 --ip-dst 192.168.2.0/24 --ip-proto tcp -j DROP
/usr/sbin/ebtables -t broute -I BROUTING -p IPv4 -i wl0.1 --ip-dst 192.168.3.0/24 --ip-proto tcp -j DROP
/usr/sbin/ebtables -t broute -I BROUTING -p IPv4 -i wl0.1 --ip-dst 192.168.4.0/24 --ip-proto tcp -j DROP
/usr/sbin/ebtables -t broute -I BROUTING -p IPv4 -i wl0.1 --ip-dst 192.168.5.0/24 --ip-proto tcp -j DROP

# Legend
# wl0.1 is the 2.4GHz guest #1 Wi-Fi interface
# wl1.1 is the 5GHz guest #1 Wi-Fi interface
# wl0.2 is the 2.4GHz guest #2 Wi-Fi interface
# wl1.2 is the 5GHz guest #2 Wi-Fi interface
# wl0.3 is the 2.4GHz guest #3 Wi-Fi interface
# wl1.3 is the 5GHz guest #3 Wi-Fi interface

 

[bigtreiber]

For your Guest Network, is "Access Intranet" = OFF?

Where can I find that setting?

 

[greggy101]

Where can I find that setting?

 

[bigtreiber]

I don't have that setting. I think because I'm running the Router in "Access Point" Mode ...

 

[Fitz Mutch]

I don't have that setting. I think because I'm running the Router in "Access Point" Mode ...

This example may or may not work with Access Point mode. I only use Wireless Router mode.

#!/bin/sh
# EXAMPLE:  Block all Guest Network devices from accessing various local networks
for interface in wl0.1 wl1.1 wl0.2 wl1.2 wl0.3 wl1.3; do
  for network in 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24; do
    /usr/sbin/ebtables -t broute -I BROUTING -p IPv4 -i $interface --ip-dst $network --ip-proto tcp -j DROP
  done
  /usr/sbin/ebtables -t filter -I FORWARD -i $interface -j DROP
  /usr/sbin/ebtables -t filter -I FORWARD -o $interface -j DROP
done

 

[CaptainSTX]

Where can I find that setting?

On my TM AC1900 which I am running as an AP using the stock ASUS firmware the guest network is by default restricted from accessing the LAN. (see verbiage below)

I have tested it and it seems to work as it should. I use one SSID for guests and to protect my network as much is possible these days I run my connected home automation devices on another guest SSID.

Guest Network

The Guest Network provides Internet connection for guests but restricts access to your local network.