Multiple WLANS with different gateways (IPtables problem)

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
View previous topic :: View next topic  
Author Message
tmc81sc
DD-WRT Novice


Joined: 19 Mar 2015
Posts: 4
PostPosted: Thu Mar 19, 2015 20:44    Post subject: Multiple WLANS with different gateways (IPtables problem) Reply with quote
I have a TP-Link TL-WDR4300 with DD-WRT Firmware v24-sp2 (03/25/13) and the following scenario:

One Cisco ISA500 router, with different vlans: vlan1 for office use, vlan2 for VoIP, vlan3 for DMZ, vlan4 for guest access. WDR4300 as AP with WAN port disabled and port 1 is connected to ISA500.

So, currently on the AP, I have two wlans, Office WLAN on br0 (ath0) and Guest WLAN on br1 (ath0.1).

br0 has no DHCP, it works with no problems with our office lan using ISA500 as gateway with lan subnet 192.168.100.x/24

br1 has dhcp on 192.168.101.x/24, gateway 192.168.101.1 and dns configured via dnsmasq, AP is 192.168.101.250. It assigns guest clients IP and GW, but no internet access since I dont know what IPTABLES rules I have to use.

There are rules that allows dhcp and dns on br1, but I wasnt able to allow traffic from br1 to eth0 so my ISA500 can handle the internet traffic and security.

These are the rules that currently are on the firewall script:

iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

And this rule I tried with no luck to allow traffic from br1 to eth0

iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j ACCEPT

Any suggestions?
Back to top View user's profile Send private message
Sponsor
Gonzo_WRTer
DD-WRT Novice


Joined: 20 Feb 2014
Posts: 29
PostPosted: Thu Mar 19, 2015 21:35    Post subject: Reply with quote
edit: NVM... previous poster already got this
Back to top View user's profile Send private message
tmc81sc
DD-WRT Novice


Joined: 19 Mar 2015
Posts: 4
PostPosted: Thu Mar 19, 2015 21:37    Post subject: Reply with quote
I already tried that, still no luck Sad

I'm trying to ping via telnet my ISA500 and another host on the 192.168.101.x/24 subnet and I have no reply.

Just in case is not clear, both ISA500 interfaces (192.168.100.1 and 192.168.101.1) are in the same L2 switch. I have a test host via lan with 192.168.101.22 and it can reach 192.168.101.1. AP (192.168.100.250 & 192.168.101.250) is on that switch and can reach 192.168.100.x but still nothing to 192.168.101.x

Anything else I can try?
Back to top View user's profile Send private message
tmc81sc
DD-WRT Novice


Joined: 19 Mar 2015
Posts: 4
PostPosted: Fri Mar 20, 2015 15:49    Post subject: Made it! Reply with quote
Finally I was able to reach my goal Smile

I was thinking that if eth0 is the interface that connects at L2 both networks 192.168.100.x/24 and 192.168.101.x/24 the only way was to assign another IP to eth0

So, i added a line to my startup script


Code:

ifconfig br0:2 192.168.101.250



Then I changed the br1 IP address to 192.168.102.250

And used this firewall script:

Code:

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -I POSTROUTING -s 192.168.102.0/24 -j SNAT --to 192.168.101.250
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT



And voilá... Now my traffic is routed the way I wanted.

ath0 works in my office lan
ath0.1 works in my guest lan with no access to lan or other office resources Wink

Thanks everybody for your suggestions, they helped me a lot.

DD-WRT rocks Very Happy
Back to top View user's profile Send private message
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway
PostPosted: Sat Mar 21, 2015 17:07    Post subject: Reply with quote
You have to create a tagged vlan trunk on your dd-wrt router to the switch.

http://www.vspecialist.co.uk/creating-vlans-in-dd-wrt-part-1/
Back to top View user's profile Send private message
tmc81sc
DD-WRT Novice


Joined: 19 Mar 2015
Posts: 4
PostPosted: Wed Mar 25, 2015 15:51    Post subject: Reply with quote
Per, thanks for your suggestion, but unfortunately Atheros based routers using DD-WRT are not able to create vlans.

Thats why I assigned another IP address to the router lan interface.

As for today my router works as expected Wink

Greetings Smile
Back to top View user's profile Send private message
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum