Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to setup two wireless access points (APs) with the following characteristics:

  • all of my devices will connect to the first AP
  • guests will connect their devices to the second AP
  • both APs will provide Internet access
  • devices connected to the second AP should not be able to see or connect to devices on the first AP

I've managed to configure two APs in DD-WRT and I can connect to both without problems. Unfortunately, the second access point doesn't seem to provide Internet access. Any attempts to connect to external (WAN) IP addresses fail.

Here is what the routing table looks like:

A couple of important points here:

  • the first AP is associated with interface ath0 and the second with ath0.1
  • the second AP is connected to a bridge br1

Since I am not really an expert at networking, I will simply include a screenshot of the "network settings" page and the current values for various configuration settings:

enter image description here

Basically my question is:

How come devices on the second AP don't have Internet access?

share|improve this question
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP 
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP 
iptables -I INPUT -i br1 -m state --state NEW -j DROP 
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT 
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT 
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT 
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`

Add this to your firewall and run this command and then save.

share|improve this answer

Seems like this is actually a bug with DD-WRT. The solution was to run the following command on the router:

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.