Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to isolate guests connecting to my Wi-Fi to the 10.0.0.x subnet, while giving them Internet access. The OpenWrt router is at 192.168.1.48 ("wifi" interface has 10.0.0.1) and my gateway is at 192.168.1.254. How would I go around setting up OpenWrt so that guests access the Internet through my gateway but remain confined to the 10. subnet?

I've read the guest-wlan recipe over at the OpenWrt wiki, but I can't figure out how to do what I want to do. So far I've managed to set up a DHCP server for guests that gives out 10.x addresses.

I've also noticed that I can resolve hostnames from a laptop in the 10.x network. From dnsmasq logs I can see it knows there's a nameserver at 192.168.1.254 (because it looked in /etc/resolv.conf I assume). But how and why are the packets crossing the firewall?

I'm running Backfire 10.03.1 on a WRT54GL. The gateway is a Linksys E4200. This is my OpenWrt configuration at the moment:

/etc/config/dhcp

config 'dnsmasq'
        option 'domainneeded' '1'
        option 'boguspriv' '1'
        option 'filterwin2k' '0'
        option 'localise_queries' '1'
        option 'rebind_protection' '1'
        option 'rebind_localhost' '1'
        option 'local' '/lan/'
        option 'domain' 'lan'
        option 'expandhosts' '1'
        option 'nonegcache' '0'
        option 'authoritative' '1'
        option 'readethers' '1'
        option 'leasefile' '/tmp/dhcp.leases'
        option 'resolvfile' '/tmp/resolv.conf.auto'

config 'dhcp' 'lan'
        option 'interface' 'lan'
        option 'ignore' '1'

config 'dhcp' 'wan'
        option 'interface' 'wan'
        option 'ignore' '1'

config 'dhcp'
        option 'start' '100'
        option 'leasetime' '12h'
        option 'limit' '150'
        option 'interface' 'wifi'

/etc/config/network

config 'interface' 'loopback'
        option 'ifname' 'lo'
        option 'proto' 'static'
        option 'ipaddr' '127.0.0.1'
        option 'netmask' '255.0.0.0'

config 'interface' 'lan'
        option 'ifname' 'eth0.0'
        option 'proto' 'static'
        option 'netmask' '255.255.255.0'
        option 'ipaddr' '192.168.1.48'
        option 'gateway' '192.168.1.254'
        option 'dns' '192.168.1.254'

config 'interface' 'wan'
        option 'ifname' 'eth0.1'
        option 'proto' 'dhcp'

config 'interface' 'wifi'
        option 'proto' 'static'
        option 'ipaddr' '10.0.0.1'
        option 'netmask' '255.255.255.0'

/etc/config/wireless

config 'wifi-device' 'wl0'
        option 'type' 'broadcom'
        option 'channel' '11'

config 'wifi-iface'
        option 'device' 'wl0'
        option 'mode' 'ap'
        option 'ssid' 'OpenWrt'
        option 'encryption' 'none'
        option 'network' 'wifi'

/etc/config/firewall (haven't changed it from defaults)

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        option network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT

config zone
        option name             wan
        option network          'wan'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fe80::/10
        option src_port         547
        option dest_ip          fe80::/10
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# include a file with users custom iptables rules
config include
        option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp


### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

I realize this is more of a general networking question than a OpenWrt question, but I thought I should mention OpenWrt. I have the slightest idea that making this work involves some iptables black magic, but I can't figure out the correct incantations, so I wanted to ask for help.

Thanks in advance!

share|improve this question

1 Answer 1

Had the exact situation like you, except for the gateway (Cisco RV042G). However, my solution probably won't work on E4200 due to missing features. If it is possible by using other methods, then it is beyond my knowledge. I'm adding the answer for others that may be looking for a solution like this.

Let's assume that 10.0.0.0/24 is your main network with the gateway address 10.0.0.1 and 10.0.1.0/24 is the guest network. Steps for reproducing my solution:

  • Create a different subnet for the guests on the gateway. The gateway must support this feature as it creates multiple NAT tables for routing the Internet traffic to the appropriate subnet.
  • Add a firewall rule for blocking all traffic from 10.0.1.0/24 to 10.0.0.0/24 on the gateway.
  • Use an OpenWrt build with kernel 2.6+. brcm-2.4 builds won't due to lack of ebtables support. I used a 12.06 build with a config based onto the default brcm47xx config. With the default image opkg fails to work while I didn't try 10.03. I do recommend a Debian 7 i386 for buildroot as it wasted enough hours of my life with amd64 and various random compile errors. You may use the ImageBuilder, I think, but I didn't try it. For ebtables you need the following packages: ebtables, ebtables-utils, kmod-ebtables-ipv4. The kernel module isn't automatically added as dependency, so be careful.
  • These ebtables rules from below in /etc/firewall.user for blocking the DHCP broadcast from the gateway, if gateway doesn't support multiple DHCP pools. RV042G doesn't. Found them on the OpenWrt forums, adapted them for 12.06 which uses eth0.0 as interface name for the lan VLAN.

ebtables -F

ebtables -A INPUT --in-interface eth0.0 --protocol ipv4 --ip-protocol udp --ip-source-port 67:68 -j DROP

ebtables -A INPUT --in-interface eth0.0 --protocol ipv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP

ebtables -A FORWARD --in-interface eth0.0 --protocol ipv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP

ebtables -A FORWARD --in-interface eth0.0 --protocol ipv4 --ip-protocol udp --ip-source-port 67:68 -j DROP

  • Optional: Configure the lan interface for the secondary subnet. You need to change the address if both the gateway and the OpenWrt AP use the defaults (192.168.1.1).

config interface lan

option type bridge

option ifname "eth0.0"

option proto static

option ipaddr 10.0.1.2

option netmask 255.255.255.0

option gateway 10.0.1.1

option dns "8.8.8.8 8.8.4.4"

  • Tell the DHCP server which gateway to broadcast as it would normally use the ipaddr from the lan interface config:

config dhcp lan

option interface lan

option start 100

option limit 100

option leasetime 1h

list 'dhcp_option' '3,10.0.1.1'

  • Configure the wireless as a regular access point. Optional: encryption (recommended), client isolation (also recommended).

I found only one issue with this setup: a guest can still enter your main network if the subnet for that network is "guessed" and the network configuration is done manually for the wireless interface. Given the fact that the guests still see the arp broadcasts from the main network, it isn't that difficult for people that understand the previous statement. I think it can be fixed with some firewall rules onto the OpenWrt AP, but I have to research that part.

share|improve this answer
    
I think it may be done with double NAT as well. Tried this a while ago with a couple of OpenWrt devices: wiki.openwrt.org/doc/recipes/routedclient - same idea, except using a main lan address as wan address for the guest network, cable connection instead of WiFi link, and blocking all the traffic on the guest AP except the traffic that flows to the gateway and comes from the gateway. Should fix the manual address configuration issue. I'll try it and come back with another answer. –  SaltwaterC Jul 16 '13 at 6:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.