DD-WRT Seperate WLAN from LAN

Question

I tried separating my WLAN from the lan following this tutorial.

Unfortunately after the settings are changed, DCHP on the WLAN isn't working any more. I guess it may have to do with incorrect firewall setting, but I don't know where to begin troubleshooting.

I also tried this guide. There are also some comments on the firewall settings, but I don't know what are the correct settings.

I want:

• No Access from WLAN to the LAN subnet
• Internet Access from WLAN

Router:

• Model: WRT54GL
• Firmware: DD-WRT 24 v2 BETA (dd-wrt.v24_usb_generic.bin)

---

It is office usage. I have created a pool for the wlan point and configured it. I guess it has something to do with the firewall. Has someone a proof firewall script to get the following behaviour:

Wlan und Lan separated Wlan has internet access + dhcp

Answer 1

i had the same thing running in my pre-openwrt linksys dd-wrt-24sp2 setup. this is what i managed to dig out of an nvram backup:

rc_firewall=EXTIP=`nvram get wan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j logdrop
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j logdrop
iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.1.2 --dport 443 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.1.2 --dport 25 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.1.2 --dport 22 -j ACCEPT

br1 is the guest bridge, bridging the secondary guest wlan and a single rj-45 port. 192.168.1.2 is my main server, to which I allow access only to specific services from the guest network (443, 25 22). ditto for access to only some crucial services on the router itself (67, 53, 1194). tun0 is the openvpn adapter.

You should also define better what "not working" is. Do the DHCP requests get to the router at all? I think there were two choices available for DHCP and DNS servers, are you using dnsmasq? Is it listening on all the interfaces? Temporarily enable syslog on the router, you could make it send stuff to another syslog running or just tail -f /var/log/messages (probably) on the router.