Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I tried separating my WLAN from the lan following this tutorial.

Unfortunately after the settings are changed, DCHP on the WLAN isn't working any more. I guess it may have to do with incorrect firewall setting, but I don't know where to begin troubleshooting.

I also tried this guide. There are also some comments on the firewall settings, but I don't know what are the correct settings.

I want:

  • No Access from WLAN to the LAN subnet
  • Internet Access from WLAN

Router:

  • Model: WRT54GL
  • Firmware: DD-WRT 24 v2 BETA (dd-wrt.v24_usb_generic.bin)

It is office usage. I have created a pool for the wlan point and configured it. I guess it has something to do with the firewall. Has someone a proof firewall script to get the following behaviour:

Wlan und Lan separated Wlan has internet access + dhcp

share|improve this question

migrated from serverfault.com Apr 20 '11 at 18:59

This question came from our site for professional system and network administrators.

    
Is this home or office usage? –  Dan Apr 20 '11 at 18:52
    
start with the DHCP serving. Have you made sure that both DHCP pools are set up correctly and set to serve on the correct interfaces? –  MaQleod Apr 20 '11 at 19:09
add comment

1 Answer 1

i had the same thing running in my pre-openwrt linksys dd-wrt-24sp2 setup. this is what i managed to dig out of an nvram backup:

rc_firewall=EXTIP=`nvram get wan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j logdrop
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j logdrop
iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.1.2 --dport 443 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.1.2 --dport 25 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -p tcp -d 192.168.1.2 --dport 22 -j ACCEPT

br1 is the guest bridge, bridging the secondary guest wlan and a single rj-45 port. 192.168.1.2 is my main server, to which I allow access only to specific services from the guest network (443, 25 22). ditto for access to only some crucial services on the router itself (67, 53, 1194). tun0 is the openvpn adapter.

You should also define better what "not working" is. Do the DHCP requests get to the router at all? I think there were two choices available for DHCP and DNS servers, are you using dnsmasq? Is it listening on all the interfaces? Temporarily enable syslog on the router, you could make it send stuff to another syslog running or just tail -f /var/log/messages (probably) on the router.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.