View source for Set to Bridged AP with NAT'd Guest WiFi

A guide to turning your DD-WRT flashed router into a simple access point using bridged networking with an additional separate virtual wireless interface for handling isolated guest traffic.

==Assumptions==
*You have a routing device at 192.168.1.1
*You have a DHCP server setup at 192.168.1.1
*You have a DNS server at 192.168.1.1
*Your access point will be handling none of these functions on your primary network
*Your subnet is going to be 192.168.1.0/24, and the DHCP server is configured to handle this
*Your AP's guest subnet is going to be 192.168.11.0/24

If your setup is different, swap the appropriate values where needed.

----



==Recommended==
*'''Update DD-WRT''' - The latest for the R7000 as of this writing (06/18/2018) is 36070
*Reset your router to the default settings beforehand

----



<table width="100%">
   <tr>
      <td width="100%">
==Disable the WAN connection==
{| align=right
|-
|
[[File:Dd-ap basic.png|thumb|Basic Settings]]
|}

Go into <code>Setup -> Basic Setup</code>. Under <code>WAN Setup</code> select <code>WAN Connection Type</code> <code>Disabled</code>.


Set a <code>Router Name</code> (shows up when logging in via the web client), a <code>Hostname</code> (shows up when logging in via SSH client), and a <code>Domain Name</code> (handed out to clients who connect via the guest network).


Under <code>Network Setup</code> set a <code>Local IP Address</code> to a unique IP on your network. If you already have a router at 192.168.1.1 you'll need to change the IP of the access point. Set <code>Subnet Mask</code> to 255.255.255.0 (unless you know what you're doing). Set the <code>Gateway</code> to 192.168.1.1, and <code>Local DNS</code> to 192.168.1.1.


At the bottom of the page, select <code>Save</code>. This will refresh the page and give us some new options. If you cannot reconnect, change your browser's address to http://192.168.1.2.


Under <code>WAN Port</code> select <code>Assign WAN Port to Switch</code>. Under <code>Network Address Server Settings (DHCP)</code> select a <code>DHCP Type</code> of <code>DHCP Server</code> then set <code>DHCP Server</code> to disabled. Untick the boxes for <code>Use DNSMasq for DHCP</code> and <code>Use DNSMasq for DNS</code>.


'''Optional but recommended:''' enable <code>NTP Client</code> under <code>Time Settings</code> and set it to a local time server on your network.


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>. If you cannot reconnect, change your browser's address to http://192.168.1.2.

----




==Set to router==
{| align=left
|-
|
[[File:Dd-ap router.png|thumb|Advanced Routing]]
|}

Go into <code>Setup -> Advanced Routing</code>. Under <code>Operating Mode</code> select <code>Router</code>. 


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>.

----
      </td>
   </tr>
</table>



<table width="100%">
   <tr>
      <td width="100%">
==Set up Wireless==
{| align=right
|-
|
[[File:Dd-ap wireless-basic.png|thumb|Wireless Basic Settings]]
|}

Go into <code>Wireless -> Basic Setup</code>. Configure these settings as you please, but try to set your AP to wireless channels that are less congested in your area for best performance.


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>.


Go into <code>Wireless -> Wireless Security</code> and setup some obnoxious <code>WPA2 Personal</code> <code>AES</code> keys in for your bridged wireless connections. These connections will be bridged directly to your network so you don't want any untrusted devices on it. [https://www.grc.com/passwords.htm GRC's password generator] is a step in the right direction. Guests '''should not want''' to type this password in.


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>.

----




==Create a guest WiFi network==
{| align=left
|-
|
[[File:Dd-ap wireless-guest.png|thumb|Adding a guest network]]
|}

Go into <code>Wireless -> Basic Setup</code>. If your router supports 2.4GHz and 5GHz radios you probably have two sections called <code>Virtual Interfaces</code>. Devices that only cover 2.4GHz will have a single one. Choose the device you'd like to create the network under (I prefer 2.4GHz to keep my 5GHz bandwidth free) and click <code>Add</code>. Choose a <code>Wireless Network Name (SSID)</code> for this network that's different from your others, set the <code>Wireless SSID Broadcast</code> to <code>Enable</code>, and disable the other options. We'll isolate this network manually later.


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>.


Go into <code>Wireless -> Wireless Security</code> and setup an easy to remember password for your new guest network. You'll still want to set it to <code>WPA2 Personal</code> and <code>AES</code> unless you have some ancient wireless devices. Clients will only be able to see other devices connected to the guest network, so we aren't worried about anything here touching our primary network. Make a note of the device name of the guest network as you will need this in the next step. On rhe R7000 it's <code>wl0.1</code>.


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>.

----
      </td>
   </tr>
</table>



<table width="100%">
   <tr>
      <td width="100%">
==Isolate the guests via networking==
{| align=left
|-
|
[[File:Dd-ap networking.png|thumb|Networking settings]]
|}

Go into <code>Setup -> Networking</code>. Under <code>Create Bridge</code> click <code>Add</code>. This creates a new bridge connection that we can isolate our guest network to. <code>Name</code> the bridge br1, set <code>STP</code> to <code>Off</code>, then click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>. This creates br1 and sets it online.


Under <code>Assign to Bridge</code> click <code>Add</code>. For <code>Assignment</code> select <code>br1</code>. For <code>Interface</code>, select the device name you noted earlier for the guest network. In my case it was <code>wl0.1</code>.


Under <code>Port Setup</code> - <code>Network Configuration br1</code> set the <code>MAC Address</code> to a unique value (optional). Set <code>Multicast forwarding</code>, <code>Net Isolation</code>, and <code>Forced DNS Redirection</code> to <code>Disable</code>. Set <code>IP Address</code> to 192.168.11.2 and <code>Subnet Mask</code> to 255.255.255.0.


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>. At this point we have a guest WiFi network that cannot communicate with our primary network at all.

----




==DHCP for guests==
{| align=right
|-
|
[[File:Dd-ap dnsmasq.png|thumb|DNSMasq settings]]
|}

One problem the guests have is that they are never offered a DHCP address on this new network. We're going to enable DNSMasq to hand out DHCP requests only for the new guest network (192.168.11.0/24) in the range of 192.168.11.25-192.168.11.50.


Go into <code>Services -> Services</code> (I didn't name it) and find the <code>DNSMasq</code> table. <code>Enable</code> <code>DNSMasq</code> and <code>Disable</code> all the other options. Under <code>Additional DNSMasq Options</code>, put:
 interface=br1 
  dhcp-option=br1,3,192.168.11.2 
  dhcp-range=br1,192.168.11.25,192.168.11.50,255.255.255.0,24h


Click <code>Save</code> at the bottom of the page. Wait for the page to refresh, then click <code>Apply Settings</code>. Now our guests can talk to each other and receive an IP address upon connection.

----
      </td>
   </tr>
</table>



==Setting up NAT==
Our guests still can't reach the Internet from this isolated network though. For this we'll setup an iptables NAT table so guest connections can be forwarded through the primary network. We'll block any traffic the guest network attempts to send to the primary network. We'll also want to drop access to any services running on the access point that the guests do not need.


Go into <code>Administration -> Commands</code>. In the <code>Commands</code> textbox, input the following:
 # DROP guest access to ap's services - just dummy their internet traffic
 iptables -I INPUT -i br1 -p tcp -m multiport --dports 21,22,23,80,443 -j DROP
 iptables -I INPUT -s 192.168.11.0/24 -p tcp -m multiport --dports 21,22,23,80,443 -j DROP
 
 # Block guests from talking to the primary network
 iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP 
 
 # Setup guest subnet's NAT translation
 iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`


Click <code>Save Startup</code> at the bottom of the page. Go into <code>Administration -> Management</code>. At the bottom of the page, click <code>Reboot Router</code>.


Congratulations! You've bridged your access point to your primary network, setup WiFi access to privileged clients on this primary network, and setup an isolated guest network for untrusted devices!