Trying to understand Guest Network Pro limitations

[SSovets]

While I’d be comfortable making these specific rules, following these guidelines, for average users (me), wouldn’t it be nice if this IPTables forwarding rule (if that is what it is called) could be incorporated into Merlin Firmware or an Addon? It just makes it easier to add, amend and delete.

There must be other folks that would like to assign e.g. Guest users, access to a single device on the primary network, like a printer.

This sounds like a great suggestion!
My idea would be to have this as an additional option in the DHCP section: when you assign a fixed IP to a device, to have the option to allow access to and/or from the device from other networks (VLANs).

 

[CornfieldWin]

I am running into Guest Pro issues not to be reported until further tracked down. But, I notice a lot AVAHI in this thread. I want to clear out Avahi altogether to use pure DNS services through dsnmask mostly with DHCP IP and name assignments and very small DHCP pools per vlan/subnet/interface, if any, and a single unbound server for external recursive resolution. I suspect that sudden weird IOT device behavior, wireguard interactions, and vlan behaviors stem in part from DNS and mDNS interaction. According to Wikipedia, Multicast DNS (mDNS) is a computer networking protocol that resolves hostnames to IP addresses within small networks that do not include a local name server, which clearly is not the case. There are ancient threads regarding getting rid of Avahi that appear to be suggestive but inconclusive. Getting Avahi out nssswitch.config will help but I want to kill off any server or network debris related to Avahi, preferably before they can start. Concrete, workable suggestions appreciated.

 

[CornfieldWin]

This sounds like a great suggestion!
My idea would be to have this as an additional option in the DHCP section: when you assign a fixed IP to a device, to have the option to allow access to and/or from the device from other networks (VLANs).

Can we add a single field to each Guest Pro SDN page that to allow a local network name and domain be assigned which will be used in dnsmasq-SDN.conf and also in dnsmasq.conf as server forwards to those SDN unique local network names? As a bonus let the Vlan local network name also the a host address for the SDN's DNS service (dnsmasq)? My thought is to use the GUI to assign the local DNS server first in DHCP options and the main LAN server second.

 

[bennor]

I suspect that sudden weird IOT device behavior, wireguard interactions, and vlan behaviors stem in part from DNS and mDNS interaction.

What proof (like a system log or similar that can be verified) do you have that your Guest Network Pro issue stems from DNS and mDNS interaction? What proof (again system log or similar) is there that AVAHI is causing any issues with your Guest Network Pro configuration?

 

[Ripshod]

Can we add a single field to each Guest Pro SDN page that to allow a local network name and domain be assigned which will be used in dnsmasq-SDN.conf and also in dnsmasq.conf as server forwards to those SDN unique local network names? As a bonus let the Vlan local network name also be a host address for the SDN's DNS service (dnsmasq)? My thought is to use the GUI to assign the local DNS server first in DHCP options and the main LAN server second.

You can add whatever you want, it's your router. When it breaks I'm sure you'll be back asking for help again. Maybe you'll get "hacked" again

 

[bennor]

Can we add a single field to each Guest Pro SDN page that to allow a local network name and domain be assigned ...

One can probably try setting a domain name for a Guest Network Pro profile (SDN) using dnsmasq-INDEX.conf.add (INDEX = SDN index number), and adding a custom domain. Make sure to set the appropriate permissions on the dnsmasq-INDEX.conf.add file and save it to the proper location on the Asus router.

dnsmasq - ArchWiki

Adding a custom domain​

You can assign a domain simply by adding:

address=/router/192.168.1.1

Alternatively, if you continue to use add a custom domain to hosts in your (local) network:
local=/home.arpa/
domain=home.arpa

More general, possibly outdated, information here, adjusted to match the use of dnsmasq-INDEX.conf.add:

Custom domains with dnsmasq

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

PS: If you want to change the GUI itself, that's up to you and it may introduce issues or problems if done incorrectly.

 

[dave14305]

Concrete, workable suggestions appreciated

Put service stop_mdns in the /jffs/scripts/services-start script.

 

[CornfieldWin]

One can probably try setting a domain name for a Guest Network Pro profile (SDN) using dnsmasq-INDEX.conf.add (INDEX = SDN index number), and adding a custom domain. Make sure to set the appropriate permissions on the dnsmasq-INDEX.conf.add file and save it to the proper location on the Asus router.

dnsmasq - ArchWiki

More general, possibly outdated, information here, adjusted to match the use of dnsmasq-INDEX.conf.add:

Custom domains with dnsmasq

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

PS: If you want to change the GUI itself, that's up to you and it may introduce issues or problems if done incorrectly.

Not seriously thinking of hacking the GUI. Honestly, just a thought. But I am trying to automate the process with simple configurable scripts.