resources: Buffalo router with DD-WRT, new Comcast Xfi Gateway
connections: Alexa devices, Chinese big screen TVs, android TV PCs, laptops, tablets, cell phones, PCs
objective: untrusted devices use WiFi on Buffalo for internet and isolated from LAN

My Buffalo router running DD-WRT was working well. For each of the two radios I had a VAP for guest use, isolated from the LAN. I decided to upgrade Comcast to the new Xfi Gateway for unlimited data and extra speed. The new modem/router combo works good, but of course is not as configurable. For instance I cannot create a VAP. The unit provides an isolated "Home Hotspot", but a Comcast login is needed and anyone on the street can connect. I could use the Home Hotspot for untrusted devices, but those won't show up on my list of connections and I can't follow use.

I decided to connect my Buffalo without DHCP and use for device isolation. Because I must connect the Buffalo with ethernet, if I isolate, I cannot get to the main router for DHCP, gateway, and internet.

It seems the best thing to do is use either port or IP filtering on the Buffalo. On the Access Restrictions tab the only section is WAN Access. Though there is a place to block services by port number, I don't think that will apply to LAN access because the settings are in the WAN Access section. I need advice how to do the port or IP filtering.

  • You need a router that supports VLANs. – DavidPostill Jan 5 '19 at 18:42
  • @DavidPostill I should be able to enter appropriate router commands such as IPTABLE, but these are complex, and I don't want to do that if there's a better way. – subjectivist Jan 5 '19 at 18:51
  • I don't understand the question. Why don't you connect the WAN interface if the buffalo to a LAN interface on the Comcast router (disabling wifi on the Comcast router) and run everything through the Buffalo, using VAPs and network isolation there? – davidgo Jan 5 '19 at 18:55
  • @davidgo The Xfi combo unit has a bridge mode. Documentation says that turns off WiFi and I assume the modem would then be available through one or both ethernet ports. I don't want to do that because the Xfi has better WiFi and whiz bang features are disabled such as getting notifications on my phone and using the phone app. – subjectivist Jan 5 '19 at 19:16
  • I don't think AP Isolation does does what you claim.Specifically you should be able to get to the main router for Internet and gateway, provided the buffalo router WAN port connects to the XFi. I'm not sure this helps you, as it will put the traffic on the LAN side of the XFi and allow access to resources. I expect you will need to resort to iptables rules to get your desired outcome. I do note that if you switch things arround so your "trusted" network connects to your Buffalo and everything else connects to your Xfi it will have the desired affect... – davidgo Jan 5 '19 at 19:56

What I want to do with the question is not possible for the model of Buffalo router. IPTABLE commands apply to routing, when I want to affect switching. It is not possible to filter IP addresses or ports within the LAN on the router. A router with VLAN capability is needed as mentioned in comments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.