I have a network and a WAP connected to that main network. The WAP is a Buffalo WZR-HP-AG300H running DD-WRT, serving DHCP on a different subnet than the main. What I would like to have is a setup in which clients of the WAP cannot access the main network, while still allowing traffic to and from the internet (via the main network). Is this possible?

Here is a diagram of the current network structure:

                      /    \
                      AP1. AP2 (Forwards to a new subnet)

If you can't tell from the diagram, AP 1 just acts as a WiFi forwarding device, but AP 2 acts as the base of a new network. What I'm trying to do is block the nets from communication, but still allow for an internet connection.

Also, for iptables commands, the two subnets are, and NOTE: I don't own the network. I'm just making a private network, so that if something within gets hacked, it can't reach main, and so everything outside of the subnet is safe. NOTE 2: I have a Netgear prosafe plus connected to the WAN port so I can control traffic outside of the router, to solve that problem.

  • 1
    You can do this in dd-wrt, but you will have to use the CLI to make a access control list with IPtables. You will need to provide more information about your network and subnets for anyone to give you a reasonable answer. Jan 28 '19 at 1:16
  • @Tim_Stewart I gone done do add a diagram and some more info
    – Menotdan
    Jan 28 '19 at 12:24
  • 1
    Which of these devices are acting as NAT gateways? It sounds like your "modem" is really a NAT gateway router with integrated modem functionality, and it sounds like AP2 is also a NAT gateway, correct?
    – Spiff
    Jan 29 '19 at 0:02
  • @Spiff I'm not sure. I'm not the owner, my dad is. I just have the buffalo and have it set up as the base of a new subnet, where then, I can forward my web server and whatnot to the internet, and if it gets hacked, it can't reach my dad's network. Although I know the AP2 hands out DHCP (because I configured it), so it may have Network Address Translation on.
    – Menotdan
    Jan 29 '19 at 0:21
  • 1
    The wzr-hp-ag300h is a router with a wireless AP. But if that is all that you have control of, then no, it is not possible. You cannot control the flow of data beyond the WAN port. If you had access to the switch you could setup a VLAN and that would separate AP1 traffic from AP2 traffic. Somewhere beyond the switch there must be another device that also performs routing and if you had access to that, you could separate the traffic . But if all you can do is control AP2 then there is nothing you can do to control the flow of data once it leaves that device.
    – Larryc
    Jan 29 '19 at 8:05

I have solved the issue with the following firewall:

iptables -I FORWARD -d -j logdrop
iptables -I FORWARD -d -j logaccept

I can access the router, but I can't access any other computers in the network, I'm also going to disable ping requests to the router so it's harder to tell that the network is there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.