Add Guest Wifi on OpenWRT via Lan Port Connection

I have a VPN that can distribute an IP Address of 192.168.40.2-254 all the 50 pc are connected to it, i added a wireless router (TPLink Archer C7) and the firmware was OpenWRT 23.05.0 the DHCP of router are disabled and let the VPN to assign a IP Address to what ever devices connected to it, the internet connection from VPN are connected to "Lan1 Port" NOT in "Wan Port".

And now i want to add a Guest-Wifi on my router that Guest-Wifi must have a different IP Address and they should not be able to access to my local area network, Only Internet connection.

How can i achieve that?

I try searching any answer on youtube and google but i can't find the answer that fits on what in need.

my top three results when searching for "openwrt guest wifi", at google were relevant,
what was your search string ?

same as yours "openwrt guest wifi" including the title of these topic. i tried creating and not creating vlans also configuring firewalls i always ended the guest can see my local area network or else they don't have access to internet.

you need to block the LAN subnet range, except for the default gw.
but this should be documented in the guides, since that's the definition of guest wifi..

1 Like

Can you show us your configuration? Contents of /etc/config/firewall or at least the screenshot of your settings if you're doing it over the browser in LuCi.

This is my interfaces config...

This is my VLan config...

This is my Firewall config...

That's not how to allow DNS and DHCP in the firewall. Look at the screenshot and explainer on the wiki. It needs two separate rules, not a singular one, you can't define non-contiguous port ranges.

Firewall is the only thing I checked now, fix it and let us know if it worked, I'll look through the other settings meanwhile.

I tried two separate rules before i combined them, it's the same result i don't have internet connection on my guest wifi...

That's very odd. With my limited experience, the only thing that stood out to me was that CPU (eth0) on your switch was untagged for VLAN 22. But I've never used any device with two CPUs like that, so I don't know if that affects your situation.

Let's take a look at your complete configuration in text form...

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

One more thing, in your interfaces why is it eth1.22.22? Shouldn't it be eth1.22?

it's just Device naming, when i choose Base Device and put the the VLan ID it automatically named eth1.22.22 and i didn't change it.

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '###.#.#.#'
        option netmask '###.#.#.#'

config globals 'globals'
        option ula_prefix '--##:#-#-:####::/##'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.40.204'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option gateway '192.168.40.1'
        list dns '192.168.40.1'
        list dns '8.8.8.8'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option type 'bridge'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0t 2 3 4 5'
        option vid '1'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '6t 1'
        option vid '2'

config interface 'guest'
        option proto 'static'
        option ipaddr '192.168.22.1'
        option netmask '255.255.255.0'
        option device 'eth1.22.22'
        list dns '8.8.8.8'

config switch_vlan
        option device 'switch0'
        option vlan '3'
        option ports '0t 6 2t'
        option vid '22'

config device
        option type '8021q'
        option ifname 'eth1.22'
        option vid '22'
        option name 'eth1.22.22'

root@OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0'
        option channel '36'
        option band '5g'
        option htmode 'VHT80'
        option disabled '1'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/ahb/18100000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option country 'PH'
        option cell_density '0'

config wifi-iface 'wifinet0'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Test'
        option encryption 'none'
        option isolate '1'
        option network 'guest'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'
        option ignore '1'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-Guest'
        list proto 'udp'
        option src 'guest'
        option dest_port '67'
        option target 'ACCEPT'
root@OpenWrt:~# ubus call system board
{
        "kernel": "5.15.134",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA9558 ver 1 rev 0",
        "model": "TP-Link Archer C7 v2",
        "board_name": "tplink,archer-c7-v2",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.0",
                "revision": "r23497-6637af95aa",
                "target": "ath79/generic",
                "description": "OpenWrt 23.05.0 r23497-6637af95aa"
        }
}

As stated earlier, the eth1.22.22 is invalid syntax.

In addition, since you are connecting the VLAN with both ethernet and wifi, you need to make a bridge. So...

Delete this:

Add a bridge for vlan22:

config device
        option name 'br-guest'
        option type 'bridge'
        list ports 'eth1.22'

edit the guest network to use the bridge (also, we can delete the DNS -- it doesn't do anything here):

config interface 'guest'
        option proto 'static'
        option ipaddr '192.168.22.1'
        option netmask '255.255.255.0'
        option device 'br-guest'

And you also need to add masquerading to the lan zone (unless your upstream router has the ability to use static routes, but let's start here):

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'
        option masq '1'

And finally, you need to add forwarding from guest > lan like this:

config forwarding
        option src 'guest'
        option dest 'lan'

(optionally, you can remove the guest > wan forwarding).

At this point, your guest network will still be able to reach the upstream network, but we can fix that later.
Restart and test again.

1 Like

Sorry to butt in, but why is guest to WAN forwarding a bad idea? Doesn't guest to LAN mean two layers of forwarding, as in guest to LAN to WAN?

It's not a 'bad idea', it just won't work.
The reason is that this is a dumb AP configuration, so it doesn't use the wan port/interface.

Yes, but the lan > wan is happening on an upstream router.
This can be reduced if the upstream router supports static routes.

1 Like

Ah, right. I was thinking in terms of router instead of the dumb AP situation. Sorry for my nonsensical mix up.

@psherman Thank you for the guide and it works now,
i am new in networking and still do self studying.
I wan't to understand what are my mistakes here.

Great!

I'll try to give a few quick pointers:

the "dotted notation" for VLANs takes the form of ethx.y where x is the ethernet port (at the CPU, not necessarily the physical port on the device) and y is the VLAN ID.

A bridge is the software equivalent of an unmanned ethernet switch. It is required if you intend to connect any given network to more than one physical interface (ethernet + wifi, multiple wifi radios, etc.). So we created a bridge for the guest network that contained the proper VLAN assignment and then used that bridge as the device for the guest network.

This is a good one to read about -- but the super quick idea is that the entire guest network will 'hide'/'masquerade' behind the single IPv4 address that the router occupies on the upstream network. This is the way the every router is able to share a single IPv4 address from the ISP with an entire network behind the router (that's why it is enabled by default on the wan zone).

We needed to enable this on the lan zone since that is your upstream network (not the wan in your case). This can be avoided if your upstream router supports the creation of static routes.

Likewise, your guest network needs upstream connectivity to get internet access. Since you're using the lan interface as the upstream, you needed to add this forwarding rule from guest > lan.

Finally...

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile: