DD-WRT as a WAP.
Setup:
-Dlink DIR-615C1 flashed to v24-sp2 (03/25/13) - build 21061
-wireless router set to router only
-connected to LAN via Ethernet cable
-DHCP off
-1 "main" wireless network
-2 guest wireless networks
-no filtering on physical ports
This was a bit of PITA to figure out for me so I've put it here for my recollection when I need it. It will likely be obvious to network gurus (which I am obviously not). Most of the guides out there assume you use DD-WRT as your main router and not as a WAP. If you use pf as your main router/gateway, the guides do not work.
Setup
->Basic Setup
1. Turn DHCP off.
2. Leave all dnsMasq options on (I have 3 in my setup--Use DNSMasq for DHCP, Use DNSMasq for DNS, DHCP-Authoritative).
3. I disable the "WAN" and I "Assign WAN Port to Switch" to gain another port.
4. Assign ip info to router.
5. Assign DNS and Gateway info.
->Advanced Routing
1. Set "Operating Mode" to Router.
2. "Dynamic" Routing disabled.
Wireless
->Basic Settings
1. Set up your "Main" network as you like.
2. I assign channel to the ip I gave the router to keep management easy.
3. Under "Virtual Interfaces," add your 2 virtual wireless networks. Assign SSID, etc. Make sure "Network Configuration = Bridged" under "Advanced."
4. I disable "AP Isolation." This is controversial. It opens you up to others seeing what's on your virtual network (ie. less secure). However, with it enabled then 2 kids with their Nintendo DS's can't play each other over wifi or you can't use Chromecast. A bummer for guests. Your call.
->Wireless Security
1. Secure as you see fit.
Services
->Services
1. Enable all 3 dnsMasq options (DNSMasq, Local DNS, No DNS Rebind).
2. Add something similar to this to "additional dnsMasq options"
Code: Select all
interface=br1
dhcp-option=br1,3,192.168.xxx.1
dhcp-range=br1,192.168.xxx.100,192.168.xxx.115,255.255.255.0,24h
interface=br2
dhcp-option=br2,3,192.168.xxx.1
dhcp-range=br2,192.168.xxx.100,192.168.xxx.110,255.255.255.0,24h
Choose whatever octets you like. The 1rst ip in ranges sets your first ip, the 2nd your last. 24h is the lease time.
Security
->Firewall
1. "Filter Multicast" should be checked.
2. You can then disable or leave the SP1 Firewall enabled. I left it enabled, but many suggest to disable it.
Administration
->Commands
1.
Code: Select all
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br2 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o br2 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -I FORWARD -i br2 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br2 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport https -j REJECT --reject-with tcp-reset
They MUST be done in that order.
2. Do NOT use this code:
Code: Select all
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
Every guide seems to have it. It does not work if your DD-WRT is a WAP.
3. Do NOT use this code if you want your virtual wireless networks to access the internet:
Code: Select all
iptables -I FORWARD -i br1 -o `get_wanface` -j DROP
4. Do NOT use this code as it does not jive with WAP's.
Code: Select all
iptables -I FORWARD -i br1 -d `nvram get wan_ipaddr`/`nvram get wan_netmask` -m state --state NEW -j DROP
This setup allows br1 and br2 to access the internet, but does not allow them to access the router or your main network. Subtract all the br2 stuff if you only want 1 virtual guest wireless network.
Shibby Tomato to follow once I figure it out.