Using a wifi channel for a separate vlan with Merlin and IPV6

[PabloAbonia]

I have several Nest devices that have the unfortunate underpinning design that interferes with IPV6 router advertisements. As designed these devices broadcast their router advertisements across whatever lan they are hooked up to. These advertisements set M flag = 0, O flag = 0, which is a problem if you are trying to setup your IPV6 network to anything but SLAAC.

For my router In RA-stateless mode M flag = 0, O flag = 1, this is not as much of a problem, as I am able to dole out a DNS address. Windows 7 complains in the event viewer, but the IPV6 address remains unchanged. It also obtains a non-routeable ULA address (fdbe: from the Nest Protect RA messages, again not much of an issue. Save for the repeated log messages, this is only a nuisance.

However, the moment a managed address is attempted (M flag = 1, O flag = 1), all havoc breaks loose. The moment a device previously assigned IPV6 address receives a RA message from the Nest devices (M flag = 0, O flag = 0), it drops the assigned address, and can no longer be found by its assigned host name or address, until the router's RA a received again. This leads to disconnection of network drives, HomeGroups, etc. Right now all of my devices are on a AP that is separate from my router. It also impacts the performance of Apple devices

As I have not been using my router as a wifi device, I was hoping to use its wifi capabilities and place these Nest devices in a separate vlan and not expose the rest of my LAN to these invalid RA messages.

The router is a RT-AC56U. I need to know how to subnet under the IPV6 PD received from the ISP, as well as an IPV4 subnet.

Advice regarding this would be greatly appreciated.

Pablo


--
Pablo

 

[PabloAbonia]

SOLVED.

I placed the offending Nest devices on a Guest network, isolating their router advertisements to themselves and the router, based upon another post I saw here.

I have also noted that while the Asus Merlin access point mode 376.49 allows for the creation of a guest network, but provides complete access to the entirety of the network.

Unless there is a means of isolating the guest network on the AP to the router, it's use does not make sense. Is there a means of providing a vlan for the guest network AP to the router?

Thanks,




--
Pablo

 

[RMerlin]

SOLVED.

I placed the offending Nest devices on a Guest network, isolating their router advertisements to themselves and the router, based upon another post I saw here.

I have also noted that while the Asus Merlin access point mode 376.49 allows for the creation of a guest network, but provides complete access to the entirety of the network.

Unless there is a means of isolating the guest network on the AP to the router, it's use does not make sense. Is there a means of providing a vlan for the guest network AP to the router?

Access Point does not support isolating from the rest of the network because it's just an access point, with no control over the rest of your network. You need a router to do that.

 

[PabloAbonia]

That's what I figured and In that context, you may wish to remove the guest network capability in access point mode.

I would suggest this as it provides complete access and makes any security placed on the main SSIDs pointless while in AP mode.

Pablo


--
Pablo