After one of my friends connected to my private LAN with his phone and suddenly could access all my pictures, music and documents I realized I needed some kind of separate network for friends and family.
Our TP-LINK TL-WR1043ND is running DD-WRT so this should be a piece of cake.
What I wanted to archieve:
- Block all access in between the private and public wlan
- Give the public wlan the a lower QOS priority so it won’t slow down my private network
- Only allow http and https on the public wlan
I followed this nice tutorial on youtube which got me started: DD-WRT Tutorial: Create a secure and separate public guest network
Unfortunately I soon discovered that my new separate public guest network was anything but secure and separate. Simon who made the video let some crucial parts out resulting in the private network to be wide open to the public network.
Googling the topic I found lots of information but not really a good guide to simply make it work. So I decided to write this post about it.
Here we go:
- Follow Simon’s youtube instruction
- Open your DD-WRT’s WEBGUI and fix the QOS mistake made in the video. On the “NAT/COS” -> “QOS” we need to change the added networks to 192.168.1.0/24 and 192.168.2.0/24.
- Create some IPTABLES script to make it secure and separate. This can be added on the “Administration” -> “Commands” page. Just copy and paste the text below into the text box and click “Save firewall”.
#Allow br1 to access DHCP on the router
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
#Allow br1 to access DNS on the router
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
#Restrict br1 from accessing br0
iptables -I FORWARD 1 -i br1 -o br0 -m state --state NEW -j DROP
#Restrict br0 from accessing br1
iptables -I FORWARD 2 -i br0 -o br1 -m state --state NEW -j DROP
#Allow br1 to access http/https to internet
iptables -I FORWARD 3 -i br1 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -I FORWARD 4 -i br1 -m state --state ESTABLISHED,RELATED -j ACCEPT
#Drop everything else on br1
iptables -I FORWARD 5 -i br1 -j DROP
That’s everything. Don’t forget to test your new setup:
-
Test that your primary and private network is still giving you the same access to your resources and the internet
-
Try to browse a random website on your public network; this should work
-
Try to download a torrent on your public network; this should not work
-
Try to “telnet <some random mailserver> 25″ on your public network; this should not work