[marcodt]

Hi everyone.
I have two networks br0 (main) and an isolated guest network with limited bandwidth speeds (br1). I just setup an NAS with a HDD using Samba. I can see the drive on my network but I only want to limit it to my br0 network.
Any ideas?[/url]

[mac913]

Since br1 is for Guests they only need Internet Access. Give this Firewall Script a try.

# Give br1 Internet Access Only
# Block all router services on br1 Network
iptables -I INPUT -i br1 -m state --state NEW -j DROP
# Only allow br1 Network access to DHCP & DNS
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

[mrjcd]

A bit hard to give a real good answer since don't know what router you are using or what dd-wrt build.
Any special reason for the br1??? You could throw some more firewall rules at it but it is really not nessasary.
I know cause I did it for long time
For a simple guest network that is well isolated from all - get rid of the br1, delete your firewall rules.
set the VAP as unbridged, Masquerade / NAT and put in its IP & subnetmask. Check button for net isolation.
In networking add Multiple DHCP Server selecting wl0.1 (or whatever wireless interface it is) and that should do it.
some routers / some builds you may need a reboot for all to take affect.
Should work on k3.x 27858 or later ... probably some before that too ---

sometimes a mess when you start trying to delete existing networks and DHCP servers -- I would recommend
to reset and use a recent known working build for your router.

--
huh dang .. I just type too slow

[marcodt]

[marcodt]

[mac913]

Yes add to it like this...

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
# Allow Guest only DHCP & DNS Access
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

[marcodt]

[mac913]

What it means, here's a link...

Controlling Access - Separate LAN And WLAN

I came on board to help with Guest Access not to review your whole configuration, just don't have the time.

[TonyK1321]

Sorry if this is a dumb question, but why do any of that? Why not just click Net Isolation for the guest WiFi network and call it good? Or, if this is also for a wired connection, wouldn't you need to limit bandwidth based on a specific port of the router?
Tony

[marcodt]

[HalfBit]

Eliminate your NAT rule by doing the following. I was trying to do something similar with one 2.4ghz vap and one 5ghz vap on the same bridge (br1).

The NAT rules are missing when you enable NAT and try to isolate the new bridge.

[marcodt]

Hi everyone. I am having problems with the guest network. It keeps saying 'Incorrect Password' when trying to have anyone connect to br1. Any ideas?