Is this possible with Merlin? I don’t know where to start

[vmachiel]

Hi,

So I’ve got a BE86U running the latest Merlin. Basically, I want to isolate my work laptop (which is full of “corporate malware”) from the rest of my network. I think I have to create a new network with a different subnet for that right?

BUT: I want it to be able to acces 1 device on my main network: my raspberry pi running pihole. Is this doable with vlans/subnets etc? I’m not THAT tech savvy so I don’t know what to look for. If someone can point me in the right direction that would be awesome.

Thanks!

 

[bbunge]

Create a guest WIFI for the laptop. Install Diversion on the router and dump the Pi-Hole. Diversion does the same as Pi-hole and uses the same block lists.

 

[visortgw]

Create a guest WIFI for the laptop. Install Diversion on the router and dump the Pi-Hole. Diversion does the same as Pi-hole and uses the same block lists.

That depends on what block list(s) the PiHole uses. Couldn't the user explicitly point the guest network's DNS to the PiHole using DNS Director?

 

[bennor]

Basically, I want to isolate my work laptop (which is full of “corporate malware”) from the rest of my network.

If the laptop is connected via WiFi then create a Guest Network Pro profile and join the laptop to it. When creating the Guest Network Pro profile make sure to disable the option Use same subnet as main network.

BUT: I want it to be able to acces 1 device on my main network: my raspberry pi running pihole.

You can configure LAN> DNS Director to perform this step. DNS Director has a section for Guest Network Pro profiles where you can select the Guest Network Pro profile and assign a User defined DNS field to it. You would input the Pi-Hole's IP address into that User defined DNS field on the DNS Director page. There are likely more configuration one may need to do on the DNS Director page depending on one's use case. On the Pi-Hole you will likely need to change the DNS Settings > Interface Setting from Allow only local requests to Respond only on interface so the Pi-Hole correctly accepts DNS requests from the Guest Network Pro profile's IP subnet.

Edit to add: See attached example of how I have my Pi-Hole(s) configured under 3006.102.5 firmware on a RT-AX86U Pro. In my example the Guest Network Pro Profiles (two of them) use the Pi-Hole's IP address that is input into the User defined DNS #1 field.

 

[Clark Griswald]

I utilize PiHole to keep as much off the router as possible. I have been using the GNP, since upgrading to RMerlin's latest, to isolate our IoT devices.

 

[vmachiel]

If the laptop is connected via WiFi then create a Guest Network Pro profile and join the laptop to it. When creating the Guest Network Pro profile make sure to disable the option Use same subnet as main network.

You can configure LAN> DNS Director to perform this step. DNS Director has a section for Guest Network Pro profiles where you can select the Guest Network Pro profile and assign a User defined DNS field to it. You would input the Pi-Hole's IP address into that User defined DNS field on the DNS Director page. There are likely more configuration one may need to do on the DNS Director page depending on one's use case. On the Pi-Hole you will likely need to change the DNS Settings > Interface Setting from Allow only local requests to Respond only on interface so the Pi-Hole correctly accepts DNS requests from the Guest Network Pro profile's IP subnet.

Edit to add: See attached example of how I have my Pi-Hole(s) configured under 3006.102.5 firmware on a RT-AX86U Pro. In my example the Guest Network Pro Profiles (two of them) use the Pi-Hole's IP address that is input into the User defined DNS #1 field.

Cheers! I’ll try this tomorrow!

 

[vmachiel]

I utilize PiHole to keep as much off the router as possible. I have been using the GNP, since upgrading to RMerlin's latest, to isolate our IoT devices.

One thing I don’t get when looking at the GNP for IoT stuff: the “use same subnet” option is turned off. The reply by @bennor suggested that needs to be off in order to isolate your stuff.

Are you IoT devices really isolated then if that option is on? Or did you use the default IoT config and just turned that option off?

 

[visortgw]

One thing I don’t get when looking at the GNP for IoT stuff: the “use same subnet” option is turned off. The reply by @bennor suggested that needs to be off in order to isolate your stuff.

Are you IoT devices really isolated then if that option is on? Or did you use the default IoT config and just turned that option off?

Turn option off to create isolated VLAN.

 

[bennor]

Are you IoT devices really isolated then if that option is on? Or did you use the default IoT config and just turned that option off?

If you want to isolate your Guest Network Pro Profile clients from the main LAN/main WiFi clients you would set the option Use same subnet as main network to off/disable.

If Use same subnet as main network is enabled/on then Guest Network Pro Profile clients would receive an IP address from the main LAN IP address pool and will be accessible to main LAN clients (i.e. not isolated from main LAN).

PS: IF you still have questions about the Use same subnet as main network option, use the forum search feature to find the various past discussions that mention or discuss that option and what it does and doesn't do in the 3006.102.x firmware.

 

[Mikey Dread]

I use the addon sbnmerlin exactly for this, isolating my partner's work laptop. Seems to work well, been almost no trouble for about a year now.

 

[bennor]

I use the addon sbnmerlin exactly for this...

Does that script work with 3006.102.x firmware?
PS: It's script page indicates it may not.

**ATTENTION**: This script is not compatible with other network isolation scripts, and with Asus' Guest Network Pro available in the 3006.102.1-beta 1 firmware version [Thanks to @visortgw ].

 

[Mikey Dread]

Does that script work with 3006.102.x firmware?
PS: It's script page indicates it may not.

Thats a good question, I don't know, I am still on the 3004.388… maybe ping @janico82

 

[bbunge]

Or this

Tutorial - Pi-Hole for both LAN clients and Guest Network (VLAN) clients

This topic has been discussed several times before in these forums. One solution is to set up the RPI with the Ethernet connected to the LAN and the WIFI connected to the guest WIFI. This procedure will let you connect the RPI to the LAN Ethernet with a single cable and have IP addresses on the...

www.snbforums.com