Creating a virtual access point for guests with DD-WRT?

Question

I am attempting to setup two wireless access points (APs) with the following characteristics:

• all of my devices will connect to the first AP
• guests will connect their devices to the second AP
• both APs will provide Internet access
• devices connected to the second AP should not be able to see or connect to devices on the first AP

I've managed to configure two APs in DD-WRT and I can connect to both without problems. Unfortunately, the second access point doesn't seem to provide Internet access. Any attempts to connect to external (WAN) IP addresses fail.

Here is what the routing table looks like:

A couple of important points here:

• the first AP is associated with interface ath0 and the second with ath0.1
• the second AP is connected to a bridge br1

Since I am not really an expert at networking, I will simply include a screenshot of the "network settings" page and the current values for various configuration settings:

Basically my question is:

How come devices on the second AP don't have Internet access?

Answer 1

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP 
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP 
iptables -I INPUT -i br1 -m state --state NEW -j DROP 
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT 
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT 
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT 
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`

Add this to your firewall and run this command and then save.

Answer 2

Seems like this is actually a bug with DD-WRT. The solution was to run the following command on the router:

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`