I have an ASUS Dark Knight (RT-N66U) running Tomato (by Shibby) firmware, which I am currently using as a repeater for a very weak network. Since recently I have been given access to a wireless access point (some obscure Asian brand) with a single port, and a single cable running to it. For various reasons I cannot setup the RT-N66U as a repeater for this external AP, besides the fact that I prefer my outgoing connection to be wired. Unfortunately I don't have exclusive access to the AP, so it has to keep working for the neighbours. Hence, I was thinking about the following setup:

  • Plug the incoming network cable into one of the ports on the RT-N66U (say, port 1).
  • Plug the external AP into one of the other ports (say, port 2). I cannot configure this AP, so it should just keep working, and basically the RT-N66U should just relay whatever connects to the external AP to the cable in port 1.
  • Use one or both of the WiFi antennas on the RT-N66U for my own internal network in a similar setup as I have now, which includes
    • using the RT-N66U's DHCP server with a separate subnet for WiFi clients, so that all my own devices can see each other but my neighbours' devices connecting through the external AP cannot see mine
    • tunneling all the traffic from/to my devices through a VPN connection using the OpenVPN Client functionality on the RT-N66U
    • (optionally) using QoS for my own devices without restricting the traffic through the external AP

So basically I would like my private WiFi network and the cable to the public AP to share the main cabled connection to the ISP router, but be completely separated from the rest of my local network (e.g. DHCP, VPN client).

Concretely, my questions are:

  • Is this setup possible at all?
  • In particular, is it possible such that clients to the external AP don't notice any difference; and such that clients to my RT-N66U's WiFi are completely shielded from the semi-public one (I would like to keep my private stuff private, even if - say - the downstairs neighbours decide to tap into the cable; on the other hand I don't feel the need to tunnel all my neighbours' traffic through my VPN as well).
  • How do I set this up in practice? I have little knowledge about VLANs and bridges, and my iptables skills really suck, so any pointers there would be helpful.
  • Would getting a splitter and splitting the incoming cable to the external AP and the RT-N66U separately be a better option? I'm not sure how much a splitter affects the quality of the signal, besides my RT-N66U has four ports which I can use - I am just unsure how well I can shield them from each other.

Any general advice would be welcome, any advice particular to making this work with Tomato

Sorry for the long post, I hope I made it clear what I aim to achieve. Feel free to ask clarifications or edit out irrelevant information.


Yes, this is possible. Just add one of the LAN ports to the WAN bridge.

  • Is it that simple? :) I will try and let you know if it worked through the accept button. Thanks! – CompuChip Jun 25 '14 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.