Guest WLAN on DD-WRT AP via VLAN
-
Are you using the DD-WRT as a router with the clients on the LAN side and pfSense on the WAN? If so, the DHCP requests will not reach pfSense and the ones you see must be coming from somewhere else. Are you certain they're coming from the client?
-
The requests definitely come from the clients, MAC and hostname match…
I followed this guide to make it an access point after reseting to factory defaults:
https://www.dd-wrt.com/wiki/index.php/Wireless_Access_Pointand this guide for the guest network (unfortunately in german, but there are pictures with the configuration):
https://www.flashsystems.de/articles/ddwrtguestlan-index/I loose my access while setting up VLAN's ("Kapitel 3"), because the DHCP requests do not reach my clients... By the way, the router itself seems to have no IP after this - Pfsense only tells me about one client at DHCP Leases - pfsense itself, no DD-WRT router...
-
You still haven't answered my question, is the DD-WRT being used as a router? When you see those DHCP requests, do they contain the MAC address of the originating device?
-
The requests definitely come from the clients, MAC and hostname match…
Yes, MAC addresss matches the address of the originating device, so they obviously also contain the address.
The long guide tells me to change the mode from gateway to router, so yes somehow it's still a router - but with wan connection type: disabled and without a dhcp server.
-
"unmanaged switches just pass on the frame as is."
That is the PROBLEM!!! Dude I just plugged in a dumb netgear gs108 between my trunk on pfsense to my smart switch…
Then I plugged in a laptop to another port - seeing every broadcast packet for EVERY vlan... What your suggesting is just BORKED!! Please do not suggest people do such things - especially those new to what vlans even are!!
And I didn't leave it long enough to figure out exactly why - but the laptop was not getting IP via dhcp either.. Running vlan tags over a dumb switch is pretty much the worst advice you could ever give.. Its just plain WRONG!! Please stop suggesting people can do it.. If you want to do it on your own network - have at it.. But please do not pass along such nonsense here.. Please!!!
-
Here is the packet capture file :)
Please tell me when you downloaded it so I can remove the attachment -
I do not see any vlan tags in that sniff.. But seeing 192.168.1 and dhcp for 192.168.2..
-
Then I plugged in a laptop to another port - seeing every broadcast packet for EVERY vlan… What your suggesting is just BORKED!! Please do not suggest people do such things - especially those new to what vlans even are!!
Yes, every frame, including VLAN will appear on the wire, no doubt about that. Now, how many devices will actually receive the VLAN frames? Only the ones that have been configured to receive it. If it's not been configured for the VLAN, the VLAN frame will be discarded.
-
The capture has been made by Diagnostics->Package capture from the VLAN-Interface "HOME", so pfsense seems to strip the vlan tags, but the package seemingly arrives at the correct interface (VLAN1) When I capture directly from a cable to the wan port of my router, the VLAN tags are there. If it helps I can post a cap file of that later, too.
-
The capture has been made by Diagnostics->Package capture from the VLAN-Interface "HOME", so pfsense seems to strip the vlan tags
That's why I like to use a managed switch, configured for port mirroring, and a computer running Wireshark to analyze network issues. If you used packet capture on the real interface, then you should see VLAN frames, as well as the native LAN traffic.
-
Well, buying a managed switch is no problem, I just cannot add a second wire to the APs… So I thought it would be unnecessary..
-
Well, buying a managed switch is no problem, I just cannot add a second wire to the APs… So I thought it would be unnecessary..
A VLAN to an access point is the usual method for multiple SSIDs. A common configuration is to have the native LAN used for normal users and the VLAN for guests, who are only allowed to access the Internet.
