Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Isolated, guest WiFi network with one AP?

    Scheduled Pinned Locked Moved Wireless
    4 Posts 3 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      JC Denton
      last edited by

      My LAN feeds into my pfSense router/firewall.  To provide WiFi for my laptops and devices, I have a DD-WRT AP plugged into the LAN that just bridges the clients over into the LAN subnet.  The physical path is AP to Cisco switch to pfSense to the cable modem (dumb bridge) and finally out to the internet.

      On pfSense, I have a separated ethernet port set aside for an isolated VM test network that I eventually want to use Captive Portal on.  I'm curious, can I make a guest AP on the DD-WRT AP that doesn't see or touch the LAN? I'm thinking maybe with VLANs, but I'm not sure how to start.

      Any tips or pointers in the right direction would be appreciated!

      Thanks!

      1 Reply Last reply Reply Quote 0
      • P
        podilarius
        last edited by

        This is setup just like adding a network on a separate NOC or vLAN. I have 2 AP in my location. One on my LAN and one on a dedicated NIC such that it is isolated guest network. Everything is on a separate subnet to allow routing without bridges.

        1 Reply Last reply Reply Quote 0
        • J
          JC Denton
          last edited by

          @podilarius:

          This is setup just like adding a network on a separate NOC or vLAN. I have 2 AP in my location. One on my LAN and one on a dedicated NIC such that it is isolated guest network. Everything is on a separate subnet to allow routing without bridges.

          Except the AP only has one upstream port.  So I'm not sure if this is even possible?

          1 Reply Last reply Reply Quote 0
          • G
            gjaltemba
            last edited by

            I do this with DD-WRT by creating a wireless  virtual interface and a bridge on another subnet. DNSMasq service starts dhcpd for bridge via commands (gui dhcpd will not work). Use iptables to nat new bridge over to lan. Basically the guest wifi is using the router lan ip as a wan port.

            You may need some block rules to restrict access to internet only.

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.