0

I want to create a WLAN where I have 3 separate WiFi access points (connected to each other via Ethernet cable) and where all the clients attached to these WAPs can communicate with each other while also being behind a firewall.

If I add one more device, a router and firewall, I know how to create this network configuration:

[Cable Modem]
192.168.0.1
│
└─[Wireless Router & Firewall]
        192.168.1.0
        │
        ├── Wireless Access Point #1 - 192.168.1.1
        ├── Wireless Access Point #2 - 192.168.1.2
        └── Wireless Access Point #3 - 192.168.1.3

However, is it possible to accomplish the same thing without adding a 4th device?

All 3 of the wireless access points are actually wireless routers. If I put them in router mode and connect as shown below, how do I set up the routing and firewall rules so the devices attached to each router form one network and also have some protection from the outside world?

[Cable Modem]
192.168.0.1
│
├── Wireless Router #1 - 192.168.1.1
├── Wireless Router #2 - 192.168.1.2
└── Wireless Router #3 - 192.168.1.3

The cable modem does NAT, it is a DHCP server and it has a 4 port switch. The 3 wireless routers are capable of running dd-wrt.

My goal is to have either 1 router/firewall behind the cable modem, as in the first network layout, or to have 3 router/firewalls behind the cable modem (avoiding the cost of buying a 4th device) where all 3 of those router/firewalls can act as one network. I do not want to just put access points behind the cable modem.

I assume I would set up unique 192.168.1.X address ranges in the DHCP servers of each of the 3 routers.

  • Do you want the access points to be in router mode? As davidgo noted, you already have a router/firewall – the "4th device" is your cable modem. (As is common for cable "modems".) – grawity Oct 9 '18 at 6:59
  • @grawity - I do not trust the security of the cable modem. I prefer to have either 1 or 3 routers behind it. I updated the question to clarify that. Thanks. – MountainX Oct 9 '18 at 7:04
  • Can you post up the wireless router makes/models? If they're wireless routers and have ethernet switches at the back then you could use one of the three access points as the router AND AP, then connect the other routers (in AP mode) to the "router" AP – Kinnectus Oct 9 '18 at 7:12
  • @Kinnectus - yes, they're wireless routers with ethernet switches. Netgear R7000. – MountainX Oct 9 '18 at 7:16
  • @MountainX - grawity's answer seems pretty much precisely what I was thinking... so much so my comment and his answer look like they were posted simultaneously! For a single subnet 9where all devices can talk/discover each other) then method 1.... also very easy to achieve. A little configuration where you'll need to give each AP its own IP outside the DHCP pool, create a DHCP pool on router #1 and turn off DHCP on all the other APs. – Kinnectus Oct 9 '18 at 7:19
3

Assuming you do require a router/firewall (let's say the cable modem doesn't provide one), you have two ways of doing this:

Obvious method: Turn the 1st access point into a router.

[Cable Modem]
192.168.0.1
│
└─[Wireless Access Point #1 & Router & Firewall]
        192.168.1.1/24
        │
        ├── Wireless Access Point #2 - 192.168.1.2/24
        └── Wireless Access Point #3 - 192.168.1.3/24

The access points #2 and #3 would remain in bridge mode.

Advantage: This lets you have a single subnet across all access points (allowing automatic device discovery, such as for Chromecasts &c.)

The other method: Have separate subnets.

I assume I would set up unique 192.168.1.X address ranges in the DHCP servers of each of the 3 routers.

No – you would set up unique 192.168.X.0 address ranges in each router.

[Cable Modem]
192.168.0.1/24
│
├── WAN 192.168.0.2 - Wireless Router #1 - LAN 192.168.2.1/24
├── WAN 192.168.0.3 - Wireless Router #2 - LAN 192.168.3.1/24
└── WAN 192.168.0.4 - Wireless Router #3 - LAN 192.168.4.1/24

Every router should, generally, have its own subnet. This allows each router to have routes towards the remaining subnets. For example, router #1 could have a route table:

DESTINATION        GATEWAY        INTERFACE
192.168.2.0/24     -              lan
192.168.3.0/24     192.168.0.3    wan
192.168.4.0/24     192.168.0.4    wan

Disadvantage: This requires each router/AP to have a different SSID (no automatic roaming because subnets are different), and does not allow device discovery across different subnets.

Disadvantage: Requires more complex NAT and firewall configuration. You should make traffic to other LAN subnets "pass through" (be forwarded without any sort of NAT). Similarly, your filter rules in each router must accept incoming packets from other routers' subnets.

Here's a rough iptables example:

-t filter
    -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -s 192.168.2.0/24 -j ACCEPT
    -A FORWARD -s 192.168.3.0/24 -j ACCEPT
    -A FORWARD -s 192.168.4.0/24 -j ACCEPT
    -A FORWARD -j REJECT
-t nat
    -A PREROUTING -d 192.168.2.0/24 -j ACCEPT
    -A PREROUTING -d 192.168.3.0/24 -j ACCEPT
    -A PREROUTING -d 192.168.4.0/24 -j ACCEPT
    -A PREROUTING -o <wan> -j MASQUERADE (or SNAT or whatever)

Yet another method: Have one subnet and three DHCP servers.

You can probably get away with this:

[Cable Modem]
192.168.0.1/24
│
├── WAN 192.168.0.2 - Wireless Router #1 - LAN 192.168.1.1/24
│                                           │
├── WAN 192.168.0.3 - Wireless Router #2 - LAN 192.168.1.2/24
│                                           │
└── WAN 192.168.0.4 - Wireless Router #3 - LAN 192.168.1.3/24

Yes, this indicates all three routers' LANs connected to form a single ethernet – although importantly not in a loop (unless DDWRT supports RSTP, in which case go wild). The interconnection of all LANs is required if you want a common SSID.

Yes, all three routers can do DHCP. In this situation, each router's DHCP address range should be different although from the same subnet (e.g. 192.168.1.101–192.168.1.125, 192.168.1.126-192.168.1.150, etc.)

Advantage: You have a single subnet – all three APs can share the same SSID, roaming works, device discovery works.

Disadvantage: Troubleshooting this can get annoying. Port-forwarding will be hell.


(That said, it's not a crazy method. It's similar to how large networks implement router failover: they have two routers sharing the same ethernet, the same LAN subnet, and sharing an IP address using a protocol such as VRRP. Only one DHCP server and pool is needed then.)

  • Thanks for the comprehensive answer. The main reason I did not do your obvious solution is that I wanted to learn about the alternatives. You helped me understand the alternatives. In the end, I think I will do the most obvious solution now that I understand the disadvantages of the other solutions. – MountainX Oct 9 '18 at 7:20
  • Aren't the easiest solutions, that entirely fullfil a problem, often the best? – Kinnectus Oct 9 '18 at 7:20
  • @Kinnectus: Not always. Stacking two NAT routers seems like the easiest solution to most (literally plug two wireless routers together) and yet it has all the disadvantages: no wireless roaming, no device discovery, no bidirectional reachability between the subnets, no automatic UPnP port forwarding, difficult port forwarding through all the layers... – grawity Oct 9 '18 at 7:22
  • I just checked and dd-wrt does appear to have STP (Not sure about RSTP.). I don't know exactly how spanning tree protocol would be used in my situation, so I'll search it and ask a new question if needed. – MountainX Oct 9 '18 at 7:25
  • RSTP was just a side note to a side note. (It's a protocol for Ethernet loop detection and failover.) – grawity Oct 9 '18 at 7:30
1

It sounds like the cable modem is more then just a modem (because it had multiple Ethernet ports). Assuming it is doing NAT, which is reasonable to addume)

To set this up I'd disable DHCP on the DDWRT routers, configure them as APs with the same SSUD and password (but different non-overlapping channels) and connect etherenet from the modem to s LAN port - in this way you have a time Network where the modem is providing DHCP for everything and roaming between devices is seamless because the APs are bridging rather then routing.

  • updated the question – MountainX Oct 9 '18 at 7:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.