Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a router on which I installed DD-WRT firmware. I am trying to set up a virtual interface to use as a guest network. The guest network should be on the 192.168.8.0/24 subnet while our LAN is on the 192.168.1.0/24 subnet. The guest network should have full internet access, but no access to our LAN. I think I have everything set up correctly as far as creating the virtual interface and assigning it to a bridge (br1). I am able to connect to the guest network and the client gets an IP on the correct subnet. I am not able to access anything outside the 192.168.8.0/24 subnet however. I'm guessing I need to setup some iptables rules, but I'm pretty shaky with them. Here is what I currently have under firewall:

iptables -I INPUT -i br1 -m state --state NEW -j logaccept
iptables -I FORWARD -i br1 -o $wanif -m state --state NEW -j ACCEPT

Edit, more info:

I set up a wireless virtual interface (ath0.1) to be my guest network. Under Setup>Networking I then created a bridge called br1 with the ip 192.168.8.1 and assigned ath0.1 to it. I added a DHCP server to the bridge. Then under Services>Services I added the following to Additional DNSMasq Options

interface=br1
dhcp-range=br1,192.168.8.100,192.168.8.200,255.255.255.0,1440m

Finally, I added the iptables rules above to the firewall under Administration>Commands.

share|improve this question

migrated from serverfault.com Aug 5 '11 at 16:25

This question came from our site for system and network administrators.

1  
what is the full ip schema, meaning where/what are the gateway addresses. Also as a side note, you could just drop packets from .8 going to .1 via iptables –  Jimsmithkka Aug 5 '11 at 16:15
    
The gateway for the our LAN is 192.168.1.1 the router is acting as the gateway for the guest network 192.168.8.1. Dropping IPs to the .1 network would be great, but I still can't access outside addresses on the .8 network. –  rybl Aug 5 '11 at 16:35
    
Should post under the DD-WRT forums. Make sure to specify your router model and what version of DD-WRT (minimal, standard, VOIP, etc). –  surfasb Aug 5 '11 at 17:02
1  
I'm missing a major information here. How/where is the separate network created? Are you VLAN some of the routers switch ports? –  derchris Aug 5 '11 at 17:47
    
@derchris The router is plugged into our main .1 network. I want the virtual adapter on the .8 network to bridge to this connection for outside IP addresses, but block any attempt to connect to the .1 network. I'm not sure if that answered your question or not. –  rybl Aug 5 '11 at 18:36

1 Answer 1

For this you need to have a default route setup for the .8 network, which means you need something to handle routing between the two networks.

However, if you are only interested in keeping traffic from the connections off of ath0.1 from getting to anything but the outside (your border router and beyond), you could set that up without having a second network. what you would need to do is setup iptables rules that block traffic from ath0.1 to the network range, and a reverse rule as well, that blocks traffic from the network range. You would also need a rule pair that allows traffic to and from the gateway router.

Something like :

iptables -t INPUT -i ath0.1 -d 192.168.1.254 -j ACCEPT     
iptables -t OUTPUT -o ath0.1 -d 192.168.1.254 -j ACCEPT     

iptables -t OUTPUT -o ath0.1 -s 192.168.1.0.24 - j DROP
iptables -t INPUT -i ath0.1 -d 192.168.1.0.24 - j DROP

These rules should allow you to have everything on 192.168.1.0/24 without allowing traffic to get to the main net, except to the router (named 1.254 here). They may need some minor tweaking as well.

share|improve this answer
    
let me know if my syntax is correct or not, i don't have iptables memorized –  Jimsmithkka Aug 6 '11 at 2:35
    
Thanks for the answer. I will give it a try first thing Monday morning and get back to you. –  rybl Aug 7 '11 at 4:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.