sbnMerlin 1.2.4 - Network Isolation Tool based on Guest Networks, May 11 2024

[janico82]

Hello thanks for working on this script. I may be a total noob but I am trying to just have 1 guest network for all my IoT devices, but allow my private main LAN one way access to it.

Your script automatically has br3 active with all others disabled. How would I be able to config this to? I am using a RT-AX86U and the guest LAN is using the 192.168.101.0 subnet.

@networkdown, I assume that you have enabled the 2.4GHz Guest Network 2.

The sbnMerlin will create the bridge(br3) to isolate that guest network.
Then you must change the following options of the configuration file:
br3_ipaddr="192.168.103.1" -> "192.168.101.1"
br3_dhcp_start="192.168.103.2" -> "192.168.101.2"
br3_dhcp_end="192.168.103.254" ->"192.168.101.254"
br3_allow_onewayaccess=0 -> 1.

For other options please check the FAQs.

 

[Rajjco]

@Rajjco, you can't run sbnMerlin script in AP mode devices, and also, sbnMerlin can't for now allow only dns requests.
I'm still developing a method to give more control to the custom firewall rules function, so stay tuned.

For your scenario, I would install the sbnMerlin script in the main device, activate the Guest Network 1 or 2 with AIMesh enabled to the AP mode device, and deny Internet access to that network.

Now I must ask you why you need to allow dns requests to pass through the main network?

I have Adguard Home on my main network which I would like it to filter dns requests coming out of the guest network.

 

[janico82]

I have Adguard Home on my main network which I would like it to filter dns requests coming out of the guest network.

Ok! I need to finish the development, and then I'll ask for your help to test it.

 

[Rajjco]

Ok! I need to finish the development, and then I'll ask for your help to test it.

Update:

Was able to achieve that by adding a static route for the guest network dns ip 192.168.101.1 to route traffic to Adguard Home ip all from the webui.

Also switched the second router from AP mode to Ai Mesh Node and from the main Router I broadcasted the Guest Network to the node using this option.

Thanks for giving me the idea to setup Ai Mesh.

Edit:
no need to add a static route enabling dns director and setting it to router did the trick.

Edit2:
Actually 192.168.101.1 automatically sends dns requests to the address set on the DHCP server which in my case Is Aduard Home.

 

[janico82]

Update:

Was able to achieve that by adding a static route for the guest network dns ip 192.168.101.1 to route traffic to Adguard Home ip all from the webui.

Also switched the second router from AP mode to Ai Mesh Node and from the main Router I broadcasted the Guest Network to the node using this option.
View attachment 59225

Thanks for giving me the idea to setup Ai Mesh.

Edit:
no need to add a static route enabling dns director and setting it to router did the trick.

Edit2:
Actually 192.168.101.1 automatically sends dns requests to the address set on the DHCP server which in my case Is Aduard Home.

Thanks for the feedback.