Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried separating my WLAN from the lan following this tutorial.

Unfortunately after the settings are changed, DCHP on the WLAN isn't working any more. I guess it may have to do with incorrect firewall setting, but I don't know where to begin troubleshooting.

I also tried this guide. There are also some comments on the firewall settings, but I don't know what are the correct settings.

I want:

  • No Access from WLAN to the LAN subnet
  • Internet Access from WLAN


  • Model: WRT54GL
  • Firmware: DD-WRT 24 v2 BETA (dd-wrt.v24_usb_generic.bin)

It is office usage. I have created a pool for the wlan point and configured it. I guess it has something to do with the firewall. Has someone a proof firewall script to get the following behaviour:

Wlan und Lan separated Wlan has internet access + dhcp

share|improve this question

migrated from Apr 20 '11 at 18:59

This question came from our site for system and network administrators.

Is this home or office usage? – Dan Apr 20 '11 at 18:52
start with the DHCP serving. Have you made sure that both DHCP pools are set up correctly and set to serve on the correct interfaces? – MaQleod Apr 20 '11 at 19:09

i had the same thing running in my pre-openwrt linksys dd-wrt-24sp2 setup. this is what i managed to dig out of an nvram backup:

rc_firewall=EXTIP=`nvram get wan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j logdrop
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j logdrop
iptables -I FORWARD -i br1 -o br0 -p tcp -d --dport 443 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -p tcp -d --dport 25 -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -p tcp -d --dport 22 -j ACCEPT

br1 is the guest bridge, bridging the secondary guest wlan and a single rj-45 port. is my main server, to which I allow access only to specific services from the guest network (443, 25 22). ditto for access to only some crucial services on the router itself (67, 53, 1194). tun0 is the openvpn adapter.

You should also define better what "not working" is. Do the DHCP requests get to the router at all? I think there were two choices available for DHCP and DNS servers, are you using dnsmasq? Is it listening on all the interfaces? Temporarily enable syslog on the router, you could make it send stuff to another syslog running or just tail -f /var/log/messages (probably) on the router.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.