I have a router on which I installed DD-WRT firmware. I am trying to set up a virtual interface to use as a guest network. The guest network should be on the 192.168.8.0/24 subnet while our LAN is on the 192.168.1.0/24 subnet. The guest network should have full internet access, but no access to our LAN. I think I have everything set up correctly as far as creating the virtual interface and assigning it to a bridge (br1). I am able to connect to the guest network and the client gets an IP on the correct subnet. I am not able to access anything outside the 192.168.8.0/24 subnet however. I'm guessing I need to setup some iptables rules, but I'm pretty shaky with them. Here is what I currently have under firewall:
iptables -I INPUT -i br1 -m state --state NEW -j logaccept iptables -I FORWARD -i br1 -o $wanif -m state --state NEW -j ACCEPT
Edit, more info:
I set up a wireless virtual interface (ath0.1) to be my guest network. Under Setup>Networking I then created a bridge called br1 with the ip 192.168.8.1 and assigned ath0.1 to it. I added a DHCP server to the bridge. Then under Services>Services I added the following to Additional DNSMasq Options
Finally, I added the iptables rules above to the firewall under Administration>Commands.