Configure a guest WLAN

Guest WLAN provides internet access to your network members. It also provides firewall security rules to isolate your guest network from the rest. This recipe contains information provided by our forums members and one blogger as showed below:

Configuration

The changes below assume an OpenWrt default configuration, the relevant files are:

Step 1: Define a new network

Edit /etc/config/network and define a new interface section:

[..] config 'interface' 'guest' option 'proto' 'static' option 'ipaddr' '10.0.0.1' option 'netmask' '255.255.255.0' [..]

The new network interface will have to be configured as a bridge if your wireless network has multiple radios and access points, and you wish to connect more than one to the guest network.

Step 2: Copy the existing wireless network

In /etc/config/wireless, define a new, second wifi-iface section by copying the existing one and change its network option to point to the newly created interface section.

[..] config 'wifi-iface' option 'device' '???' option 'mode' 'ap' option 'network' 'openwireless.org' option 'ssid' 'guest' option 'encryption' 'none' [..]

For option 'device' '???' you should put the device listed in your 'wifi-device' section. For example, if your 'wifi-device' says config 'wifi-device' 'wifi0' then the wifi-iface section should be option 'device' 'wifi0'

Note: Your hardware may not be capable of this. For example, open source b43 driver for Broadcom hardware cannot have multiple SSIDs. You need to use the proprietary wl driver by Broadcom (with 2.6 kernel) - currently, you need to build the images yourself. — sup 2012/05/12 20:22. Worked with AR71xx + AR9280, Barrier Breaker r41336 (Kernel 3.10.36)

Note: Open Wireless Movement Wireless networks labeled with the SSID "openwireless.org" are shared resources volunteered by a neighbor who is a member of the Open Wireless Movement. This person has generously offered you a portion of their bandwidth. Please be considerate when you use it.

Step 3: Define a new DHCP pool

In order to support DHCP on 'guest' wireless, a new dhcp pool must be defined in /etc/config/dhcp:

[..] config 'dhcp' 'guest' option 'interface' 'guest' option 'start' '50' option 'limit' '200' option 'leasetime' '1h' [..]

Step 4a: Adjust firewall settings

Edit /etc/config/firewall and add new zone section covering the 'guest' interface, allow internet, DNS and DHCP to guests:

[..] config 'zone' option 'name' 'guest' option 'network' 'guest' option 'input' 'REJECT' option 'forward' 'REJECT' option 'output' 'ACCEPT' # Allow Guest -> Internet config 'forwarding' option 'src' 'guest' option 'dest' 'wan' # Allow DNS Guest -> Router # Client DNS queries ordinate from dynamic UDP ports (>1023) config 'rule' option 'name' 'Allow DNS Queries' option 'src' 'guest' option 'dest_port' '53' option 'proto' 'tcpudp' option 'target' 'ACCEPT' # Allow DHCP Guest -> Router # DHCP communication uses UDP ports 67-68 config 'rule' option 'name' 'Allow DHCP request' option 'src' 'guest' option 'src_port' '67-68' option 'dest_port' '67-68' option 'proto' 'udp' option 'target' 'ACCEPT' [..]

sartan 2011/03/17 05:45

Step 4b: Different modifications to firewall settings

I created this small set of firewall rules to completely isolate guests on the guest SSID. I had some devices that only worked with WEP or no authentication at all. WEP doesn't like to run on .11n devices in HT mode, so the only option was a wide-open SSID. I also didn't want my neighbors to quickly steal my internet… This firewall config will only allow specific, known source MACs to connect to the internet, with zero access to the rest of the network.

Edit /etc/config/firewall and add new zone section covering the 'guest' interface, allow SSH, DNS and DHCP to guests, allow only specific source MAC addresses out to the WAN, drop broadcast traffic and deny the rest of orders:

[..] # Enable logging config 'zone' option 'name' 'guest' option 'network' 'guest' option 'input' 'REJECT' option 'forward' 'REJECT' option 'output' 'ACCEPT' # Quick rule to allow SSH in config 'rule' option 'name' 'Allow SSH in' option 'src' 'guest' option 'dest_port' '22' option 'proto' 'tcp' option 'target' 'ACCEPT' # Allow DNS Guest -> Router config 'rule' option 'name' 'Allow DNS Queries' option 'src' 'guest' option 'dest_port' '53' option 'proto' 'tcpudp' option 'target' 'ACCEPT' # Allow DHCP Guest -> Router config 'rule' option 'name' 'Allow DHCP request' option 'src' 'guest' option 'src_port' '67-68' option 'dest_port' '67-68' option 'proto' 'udp' option 'target' 'ACCEPT' # Allow only specific source MAC addresses out to the WAN config 'rule' option 'name' 'Allow my Nintendo DS' option 'src' 'guest' option 'dest' 'wan' option 'proto' 'all' option 'src_mac' '00:ab:00:32:00:00' option 'target' 'ACCEPT' # Drop broadcast traffic, it just fills the logs :) config 'rule' option 'name' 'Drop guest broadcast' option 'src' 'guest' option 'dest_ip' '172.16.62.255' option 'target' 'DROP' # Another explicit deny at the end. config 'rule' option 'name' 'Deny guest -> WAN' option 'src' 'guest' option 'dest' 'wan' option 'proto' 'all' option 'target' 'REJECT' [..]

Step 4c: Block everything, but http and https

In this configuration I shared my guest SSID, but only provide http and https connections, and isolate GUEST network from LAN network.

Edit /etc/config/firewall, remove any 'guest' configurations and add new zone section covering the 'guest' interface, allow SSH, DNS and DHCP to guests, and http and https to the outside world, then block the rest.

[..] config zone option name 'guest' option network 'guest' option forward 'REJECT' option output 'ACCEPT' option input 'REJECT' config forwarding option src 'guest' option dest 'wan' config rule option src 'guest' option src_port '67-68' option dest_port '67-68' option proto 'udp' option target 'ACCEPT' option name 'Allow DHCP request' config rule option src 'guest' option dest_port '53' option proto 'tcpudp' option target 'ACCEPT' option name 'Allow DNS Queries' config rule option src 'guest' option target 'DROP' option name 'Deny Access to router' config rule option src 'guest' option dest 'lan' option name 'Deny Guest -> LAN' option proto 'all' option target 'DROP' config rule option target 'ACCEPT' option src 'guest' option dest 'wan' option name 'Allow Guest -> WAN http' option proto 'tcp' option dest_port '80' config rule option target 'ACCEPT' option src 'guest' option dest 'wan' option name 'Allow Guest -> WAN https' option proto 'tcp' option dest_port '443' config rule option src 'guest' option dest 'wan' option name 'Deny Guest -> WAN' option proto 'all' option target 'DROP' [..]

senomoto 2014/06/26 22:01

Step 5: Limit bandwidth of the connection

This is completely optional, but advised. Install package wshaper: opkg install wshaper

Edit /etc/config/wshaper:

config wshaper 'settings' option network 'guest' option downlink '64' option uplink '512'

Note: downlink and uplink options are maximal limits, but in practice the speed will be slightly lower as wshaper also tries to prioritize traffic (so that the network stays responsive even when someone downloads a huge file - there are also wshaper options that can control this). The units are kbits.

Also note: The downlink and uplink limits are reversed from what one might expect, as the data is flowing in the opposite direction from wshaper's usual (wan) interface.

Apply changes

  1. Enable the new wireless network
    /etc/init.d/network restart
  2. Restart the firewall
    /etc/init.d/firewall restart
  3. Restart the DHCP service
    /etc/init.d/dnsmasq restart
  4. Start traffic shaping
    /etc/init.d/wshaper start
  5. Make traffic shaping permanent
    /etc/init.d/wshaper enable

HotSpot (Captive Portal)

If you want to setup a simple Hotspot for your guest WLAN, take a look at Nodogsplash or WiFiDog.

Troubleshooting

If you don't get an IP from DHCP check if you listen to the interface.

[..] config 'dnsmasq' [..] list 'interface' 'lan' list 'interface' 'guest' [..]

Back to top

doc/recipes/guest-wlan.txt · Last modified: 2014/06/27 06:01 by senomoto