Guest Wifi Help

[richbrowncardiff]

Hi All,

 

Installing new wifi and need some help with routing.. I am trying to setup a public internet only SSID and need some input.

 

currently I have Smoothwall interface allowing vlan 20 (Public) which then goes to a switch (accepts all vlans) then our router has a few subnets 1 (Lan) 10.x.x.x/22 No vlan, public range 192,168,16.1/21 with vlan 20 gets dhcp from our dc on the flat network and all works fine but clients on the wireless can see and ping the 10.x.x.x range which is a no go. I'm sure its something simple but how do I fully separate clients on 192.168.16.1/21 range from 10.x.x.x/22 whilst still getting dhcp from the DC ?

 

many thanks in advance!

[FN-GM]

1. Setup a separate smoothwall interface, either virtual or physical for vlan 20.

2. Remove VLAN 20 from your router.

3. Setup DHCP on smoothwall and use the interface IP you made in step 1 as the default gateway.

 

Doing this will completely separate your main network and the guest system. Your router is currently making the traffic route between the networks. You don't actually need it. Smoothwall can handle everything.

[richbrowncardiff]

Thanks @FN-GM is there another way I can do this ? I don't have access to smoothwall as I receive a "Managed" internet connection and may have to pay for the change to be made

[FN-GM]

What router do you have? Do you have control of this?

 

Is it just 1 interface you have on the Smoothwall?

[richbrowncardiff]

I have a ubiquiti Edgerouter pro 8 and yes I have full control. I was going to add another interface say eth5 and add vlan20 to this but need to get dhcp to that interface don't know if that would work?

 

I assume I would leave the smoothwall connected to the lan tagged with 20 so when requests come in with that vlan it will just forward to traffic to the smoothwall appliance?

 

Sorry forgot to say I have 6 interfaces on smoothwall 1 is LAN 2 is public vlan20 and 3 is vlan30 staff (for radius clients)

Edited May 31, 2017 by richbrowncardiff

[FN-GM]

Right, there is a chance that changes to the Smoothwall are not needed.

 

 

If you plug a laptop directly into your smoothwall box into the public port, does it work as expected? Or can you ping?

[ADMaster]

I'm not familiar with that router, but bottom line is you need an ACL. Go ahead and keep the route the way it is so guests get dhcp from the DC, if you don't want to have smoothwall handle it. I have an ACL on the guest vlan interface that looks something like this from memory so may be forgetting something.

allow dhcp to dc
allow dhcp from dc
allow dns to dc
allow dns from dc
allow http/https to internal hosted sites
deny to 10.x.x.x
allow http/https and a few other ports to any
allow established
deny all

 

This has two effects

guest is ACLed from your main network

guest cannot access $service that uses random ports. I've added several port exceptions over the years for apple / android updates etc.

 

I use FWBuilder to keep a good visual on the ACL, not sure if your router is supported though.

Some wireless controllers support ACLs on the SSID as well. I was just reading about improvements to that in the ruckus release notes today.

[richbrowncardiff]

No i dont get anything when connected direct to the port on smoothwall.

 

- - - Updated - - -

 

thanks @ADMaster i will look into firewall rules didnt think of that

[richbrowncardiff]

Have setup a FW rule to accept DNS and DHCP on the firewall to the Public VLAN interface and it seems to work so real test will be when i have 1000+ people connected to it on monday!

 

thanks all.

 

just 1 final question... I have currently set the vlan on the main lan uplink (eth7)but would like to move it to its own physical interface how would l go about this ? Move lead, move vlan from Eth7.20 to Eth5.20 and set the ip range on the physical interface ? then setup a static route from eth5 to eth7 ?