airwoflsnb
Occasional Visitor
Hi,
I have a frustrating problem I am trying to solve with a couple of Asus RT-AC87U's. Rather than explain my desired network setup, please find the diagram below - a picture equals a thousand words
They are running Asuswrt-Merlin 3.80.59
The trunk (or cable) between the router and AP will carry both LAN (untagged) and private wifi traffic (tagged).
First of all, I am trying to get the guest network on the router (the AC-87U and will refer to this as the router forthwith) to run on a separate subnet so I can then create a VLAN to carry the tagged public wifi traffic to/from the AP whilst keeping it isolated from the LAN / private wifi. I basically want roaming capability for both the private and public SSID across the house.
And here is where the fun begins... I haven't even got as far as setting up the AP! ASUS implement guest networks by using bridge separation courtesy of ebtables on the guest wifi interface (wl0.1). So I thought it would be as simple as setting up a new bridge (br1), a VLAN to carry the public traffic on an ethernet port and map the guest wifi interface and vlan to the new bridge. Plus running a separate instance of dnsmasq to serve addresses for br1.
However, when I connect to the guest network with the password for it, I get served a 192.168.0.* address and the MAC address for the router is the one from br0 and not br1.
Any assistance to help me implement the desired state would be much appreciated. I did debate simply using the ASUS guest network implementation but am not sure how VLAN tagging to pass traffic between the AP and router would work to allow roaming on the guest (public) network? This might have to be the solution if someone can point in the right direction on getting the VLANs setup correctly between the two devices.
Also, how would I tag the 5Ghz radio to be part of the VLAN too given it is not a real interface on the RT-AC87U devices (appreciate that
Quantenna!)? Interesting side bar - I tried this in DD-WRT too by using a separate VLAN and bridge, and had the same results as experienced with Merlin. Thinking about this a bit more, is this really a Quantenna issue?
Thanks in advance!!
P.
Here are the config details:
Create /jffs/configs/dnsmasq-guests.conf:
Create /jffs/configs/hosts-guests.conf:
Create /jffs/configs/resolv-guests.conf:
# This file is empty:
I have a frustrating problem I am trying to solve with a couple of Asus RT-AC87U's. Rather than explain my desired network setup, please find the diagram below - a picture equals a thousand words
They are running Asuswrt-Merlin 3.80.59
Code:
Internet
|
+----------+
| ISP MOCA |
| router |
| no wifi |
+----------+
| 192.168.254.254
|
|
| 192.168.254.1 /----- SSID: public (on 192.168.1.254/24) using both 2.4Ghz and 5Ghz
+-------------+ /
| AC87U |-------------/
| |--------------------- SSID: private (on 192.168.0.254/24) using both 2.4Ghz and 5Ghz
| router mode |
+-------------+ br0: 192.168.0.254 (for LAN and private wifi)
| | | | br1: 192.168.1.254 (for public wifi)
| | | |
| | | \---------------------\
| | | |
| | \------------------\ |
| | | |
| \----------\ | |
| | | | /----- SSID: public (on 192.168.1.253/24) using both 2.4Ghz and 5Ghz
+--------+ +--------+ +-----+ | +---------+ /
| switch | | switch | | nas | | | AC87U |-----/
+--------+ +--------+ +-----+ | | |------------- SSID: private (on 192.168.0.253/24) using both 2.4Ghz and 5Ghz
| | | | | | | | | | AP mode |
| +---------+
devices devices | | | | |
\----/ | | |
| | |
devicesThe trunk (or cable) between the router and AP will carry both LAN (untagged) and private wifi traffic (tagged).
First of all, I am trying to get the guest network on the router (the AC-87U and will refer to this as the router forthwith) to run on a separate subnet so I can then create a VLAN to carry the tagged public wifi traffic to/from the AP whilst keeping it isolated from the LAN / private wifi. I basically want roaming capability for both the private and public SSID across the house.
And here is where the fun begins... I haven't even got as far as setting up the AP! ASUS implement guest networks by using bridge separation courtesy of ebtables on the guest wifi interface (wl0.1). So I thought it would be as simple as setting up a new bridge (br1), a VLAN to carry the public traffic on an ethernet port and map the guest wifi interface and vlan to the new bridge. Plus running a separate instance of dnsmasq to serve addresses for br1.
However, when I connect to the guest network with the password for it, I get served a 192.168.0.* address and the MAC address for the router is the one from br0 and not br1.
Any assistance to help me implement the desired state would be much appreciated. I did debate simply using the ASUS guest network implementation but am not sure how VLAN tagging to pass traffic between the AP and router would work to allow roaming on the guest (public) network? This might have to be the solution if someone can point in the right direction on getting the VLANs setup correctly between the two devices.
Also, how would I tag the 5Ghz radio to be part of the VLAN too given it is not a real interface on the RT-AC87U devices (appreciate that
Quantenna!)? Interesting side bar - I tried this in DD-WRT too by using a separate VLAN and bridge, and had the same results as experienced with Merlin. Thinking about this a bit more, is this really a Quantenna issue?
Thanks in advance!!
P.
Here are the config details:
Create /jffs/configs/dnsmasq-guests.conf:
Code:
pid-file=/var/run/dnsmasq-guests.pid
user=nobody
bind-dynamic
interface=br1
interface=ppp1*
no-dhcp-interface=ppp1*
no-hosts
resolv-file=/jffs/configs/resolv-guests.conf
servers-file=/jffs/configs/resolv-guests.dnsmasq
no-poll
no-negcache
cache-size=1500
min-port=4096
domain=guests.lan
expand-hosts
bogus-priv
local=/guests.lan/
dhcp-range=br1,192.168.1.1,192.168.1.240,255.255.255.0,86400s
dhcp-option=br1,3,192.168.1.254
dhcp-option=br1,15,guests.lan
dhcp-option=br1,252,"\n"
dhcp-authoritative
addn-hosts=/jffs/configs/hosts-guests.dnsmasqCreate /jffs/configs/hosts-guests.conf:
Code:
192.168.1.254 router.guests.lan routerCreate /jffs/configs/resolv-guests.conf:
Code:
nameserver 8.8.8.8
nameserver 4.4.4.4# This file is empty:
Code:
touch /jffs/configs/resolv-guests.dnsmasq
Code:
# Create the VLAN (vlan3) to carry the guest network traffic from other APs
vconfig add wl0.1 3
# Bring up the VLAN (vlan3) interface for the guest network traffic
ifconfig vlan3 up
# Tag vlan3 to have traffic coming in from ethernet port 4 (known as 5 on AC-87U)
robocfg vlan 3 ports "5t 7t"
# Create a new bridge for the guest networks
brctl addbr br1
# Remove guest wifi interface from br0:
brctl delif br0 wl0.1
# Add the guest wireless and LAN trunked guest wireless to br1
brctl addif br1 wl0.1 vlan3
# Enable STP on br1
brctl stp br1 on
# Configure and bring up br1
ifconfig br1 192.168.1.254 netmask 255.255.255.0
ifconfig br1 up
# Setup ebtables forwarding rules
ebtables -F FORWARD
ebtables -I FORWARD -o wl0.1 -j DROP
ebtables -I FORWARD -i wl0.1 -j DROP
ebtables -I FORWARD -o vlan3 -j DROP
ebtables -I FORWARD -i vlan3 -j DROP
# Have no idea what vlan4000 is for, but it is bound to the main bridge (br0) and local network MAC
# and this was in the ebtables config by default
ebtables -I FORWARD -o vlan4000 -j DROP
ebtables -I FORWARD -i vlan4000 -j DROP
# Run your separate DHCP daemon on br1 to serve the guest network
dnsmasq -C /jffs/configs/dnsmasq-guests.conf --log-async
# Run the link layer topology daemon on br1 to help guest network clients
lld2d br1
Last edited:
