Guest WLAN on DD-WRT AP via VLAN

dvs23

Hey :)

My current setup looks like this:

ISP -> Modem/Router, 192.168.0.1 -> pfsense firewall+("main-")router 192.168.1.1, DHCP server for APs -> two DD-WRT WLAN APs and various normal clients over ethernet.

Both APs are connected to the pfsense router by only one cable. My pfsense router only has two physical NICs and the whole network is connected over (unmanaged) switches.

The thing I want to add is a guest network on each AP which is isolated from the rest of the network, so wireless guest clients should neither be able to access any device in my private LAN nor the pfsense web interface, but the wireless clients of the private network should be able to do it. I think I can do this somehow via VLAN and virtual network interfaces in DD-WRT but it's quite confusing…
Is this possible?

pfsense router as DHCP server (for private and guest network) and main router with only one NIC
WLAN APs connected to pfsense via one cable, getting DHCP IPs from pfsense, serving one private WLAN and one guest WLAN on each AP, adding a second cable is no option.

Thanks in advance
dvs23

Gertjan

VLAN's combined with this :
@dvs23:

…. and the whole network is connected over (unmanaged) switches.

will give you a 99,99 % no-go situation.

This is what makes your llive harder :
@dvs23:

…..
and virtual network interfaces in DD-WRT but it's quite confusing...
....
adding a second cable is no option.

So : make your live easier - give yourself more options ;)

Basically, the solutions is :
Add another interface and your done. The setup will be SO easy (to administer afterwards).
Or
Learn what VLAN is all about - and then (the nice part) : know how all these different devices implement VLAN settings.

JKnott

Can you configure the AP for VLANs and multiple SSIDs? However, I don't know why your're using a DD-WRT router here. All you need is a plain AP that supports VLANs & multiple SSIDs. Adding the router in the mix makes things more complex.

will give you a 99,99 % no-go situation.

Actually, VLANs generally pass through unmanaged switches just fine. You just can't create access ports for VLANs. However, if pfSense and the AP are configured for VLANs, it should work.

johnpoz

" However, if pfSense and the AP are configured for VLANs, it should work."

Why do you keep suggesting borked configurations.. Sending vlan tags over a dumb switch is not good practice…

I really need to grab a dumb switch off my shelf.. How does the dumb switch open the 802.1Q frame and look at the dest mac? if doesn't know the dest mac - would it not just flood every port.. So you basically turned your switch into a hub? So while the switch might pass the tagged traffic, won't it be passing the tagged traffic out every port since it doesn't know what its dest mac is?

JKnott

@johnpoz:

" However, if pfSense and the AP are configured for VLANs, it should work."

Why do you keep suggesting borked configurations.. Sending vlan tags over a dumb switch is not good practice…

I really need to grab a dumb switch off my shelf.. How does the dumb switch open the 802.1Q frame and look at the dest mac? if doesn't know the dest mac - would it not just flood every port.. So you basically turned your switch into a hub? So while the switch might pass the tagged traffic, won't it be passing the tagged traffic out every port since it doesn't know what its dest mac is?

It does work. If you have no need to manage a VLAN on a switch, an unmanaged switch works fine. As for the MAC address, it's in the same place as with any other Ethernet frame.

Here's a link to some VLAN info:
https://en.wikipedia.org/wiki/IEEE_802.1Q

Notice there is absolutely no difference in where the MAC addresses are. That's all the switch worries about, when forwarding frames. The 802.1Q VLAN tag is inserted between the source MAC and Ethertype/Length fields. Since Ethernet is designed to have any value, either type or length, in those 2 bytes, this is not a problem. Switches that can manage VLANs recognize the contents of the tag and handle the frame appropriately and unmanaged switches just pass on the frame as is. The only issue might be with older equipment that expect the frame to be no longer than 1518 byes. These days, with VLANs, MPLS and jumbo frames, switches are expected to pass any valid Ethernet frames without issue. Also, if you think the VLAN somehow obscures the MAC, you really don't understand Ethernet. Incidentally, gigabit equipment is expected to be able to handle jumbo frames, which can be 9KB or more. Those switches are not going to worry about the extra 4 bytes a VLAN tag adds to the frame.

You may be interested in a good Ethernet book. It's "Ethernet The Definitive Guide" from O'Reilly. It covers all this and more.
http://shop.oreilly.com/product/0636920028987.do

dvs23

Hey!

I simply tried today - and partly it seems to work. The part that's wirking is that the DHCP DISCOVERs and REQUESTs reach my pfsense-router at the right vlan-interface (capturable via diagnostics, also visible in DHCP system logs) and sends a nice OFFER back, but somehow it does not reach the client… SPI firewall is already disabled at DD-WRT...

What data do you need?

Again thanks in advance
dvs23

JKnott

Are you using the DD-WRT as a router with the clients on the LAN side and pfSense on the WAN? If so, the DHCP requests will not reach pfSense and the ones you see must be coming from somewhere else. Are you certain they're coming from the client?

dvs23

The requests definitely come from the clients, MAC and hostname match…
I followed this guide to make it an access point after reseting to factory defaults:
https://www.dd-wrt.com/wiki/index.php/Wireless_Access_Point

and this guide for the guest network (unfortunately in german, but there are pictures with the configuration):
https://www.flashsystems.de/articles/ddwrtguestlan-index/

I loose my access while setting up VLAN's ("Kapitel 3"), because the DHCP requests do not reach my clients... By the way, the router itself seems to have no IP after this - Pfsense only tells me about one client at DHCP Leases - pfsense itself, no DD-WRT router...

JKnott

You still haven't answered my question, is the DD-WRT being used as a router? When you see those DHCP requests, do they contain the MAC address of the originating device?

dvs23

@dvs23:

The requests definitely come from the clients, MAC and hostname match…

Yes, MAC addresss matches the address of the originating device, so they obviously also contain the address.

The long guide tells me to change the mode from gateway to router, so yes somehow it's still a router - but with wan connection type: disabled and without a dhcp server.

johnpoz

"unmanaged switches just pass on the frame as is."

That is the PROBLEM!!! Dude I just plugged in a dumb netgear gs108 between my trunk on pfsense to my smart switch…

Then I plugged in a laptop to another port - seeing every broadcast packet for EVERY vlan... What your suggesting is just BORKED!! Please do not suggest people do such things - especially those new to what vlans even are!!

And I didn't leave it long enough to figure out exactly why - but the laptop was not getting IP via dhcp either.. Running vlan tags over a dumb switch is pretty much the worst advice you could ever give.. Its just plain WRONG!! Please stop suggesting people can do it.. If you want to do it on your own network - have at it.. But please do not pass along such nonsense here.. Please!!!

problem.png_thumb

dvs23

Here is the packet capture file :)
Please tell me when you downloaded it so I can remove the attachment

johnpoz

I do not see any vlan tags in that sniff.. But seeing 192.168.1 and dhcp for 192.168.2..

JKnott

Then I plugged in a laptop to another port - seeing every broadcast packet for EVERY vlan… What your suggesting is just BORKED!! Please do not suggest people do such things - especially those new to what vlans even are!!

Yes, every frame, including VLAN will appear on the wire, no doubt about that. Now, how many devices will actually receive the VLAN frames? Only the ones that have been configured to receive it. If it's not been configured for the VLAN, the VLAN frame will be discarded.

dvs23

The capture has been made by Diagnostics->Package capture from the VLAN-Interface "HOME", so pfsense seems to strip the vlan tags, but the package seemingly arrives at the correct interface (VLAN1) When I capture directly from a cable to the wan port of my router, the VLAN tags are there. If it helps I can post a cap file of that later, too.

JKnott

The capture has been made by Diagnostics->Package capture from the VLAN-Interface "HOME", so pfsense seems to strip the vlan tags

That's why I like to use a managed switch, configured for port mirroring, and a computer running Wireshark to analyze network issues. If you used packet capture on the real interface, then you should see VLAN frames, as well as the native LAN traffic.

dvs23

Well, buying a managed switch is no problem, I just cannot add a second wire to the APs… So I thought it would be unnecessary..

JKnott

@dvs23:

Well, buying a managed switch is no problem, I just cannot add a second wire to the APs… So I thought it would be unnecessary..

A VLAN to an access point is the usual method for multiple SSIDs. A common configuration is to have the native LAN used for normal users and the VLAN for guests, who are only allowed to access the Internet.