I have just updated my TP-Link WDR-3600 to V 19.07.2. It has spent it's life as a Dumb AP with a guest network on "that other product". I am now attempting to config this the same, which I have done in the past using doenselmann's directions.
The Dumb AP internal network appears to work fine.
On the Dumb AP Guest Network, I can connect to the AP but Windows tells me I have No Internet. I can see in Windows Status I do not have an IPV4 address, but do appear to have an IPV6 address.
The first tutorial has one disable IPV6 in Step 5, but I'm honestly not clear what I have disabled. I still see a IPv6 address in the Interface=> LAN=> General Settings => Status box.
In the second tutorial, I followed the GUI install as best I could (there are some GUI differences between v18 and V19) and then went and bounced the resulting config files against the tutorial. There are some differences in the firewall on some entries which I am not sure are material. An example being:
option network 'lan' vs list network 'lan'
The GUI in V19's firewall has Source Address " -- add IP --" as opposed to "any" but based on the config file I assume these are the same (but I consider a more confusing label).
Looking at the forum post, it appears that the protocol config suggested by psherman and the documentation written by WRTuser is in conflict. Specifically
psherman
DHCP tcp+udp 67-68
DNS tcp 53
WRTuser
DHCP tcp 67-68
DNS tcp+udp 53
Tried both with no success.
I am also not really clear what I should see on the Dumb AP's Overview when the Guest is connected. I would like to think I would see the Guest under Leases, but see nothing. I do see the SSID under Wireless radio 0 and an entry under Associated Stations with this as "Master".
These 2 guides are not exactly compatible with each other.
DumbAP turns off DHCP and just bridges Wifi with LAN. Firewall is also not interfering. There must be another router and dhcp to work.
The guestwifi_dumbAP terminates the guest wifi on the OpenWrt, so firewall is used, dhcp is used, NS may be used.
So it depends on your solution. Maybe you can explain here what you want to achieve and we can help you with that.
DHCP is UDP 67 on server 68 on client.
DNS is UDP 53, TCP is used to transfer zones, you don't need it for the guests.
My router (PC-Engines ALIX) runs on 192.168.111.1 and does all the normal router things plus VPN and USB. It has no wireless.
I have a TP-Link WDR3600 which I would like to be an AP with 2.4G and 5G "internal" (all access) WLANs (done i think). I also would like to create an additional Guest WLAN on the 2.4G band that only offers internet access.
As I understand the Dumb AP with Guest recipe, it's basically creating a DHCP server (in my case 192.168.31.1) for the guest, isolates it from the primary LAN and sends the traffic through the TP-Link LAN to my primary router and then the internet.
I think I am basically trying to do what the OP of the original post wanted to do, but his primary router was his ISPs if understand his drawing.
I did freshen up the ports as you suggested with no joy. Devices connect but get an IP in the dreaded 169.254 range.
If you have already a good router, then I suggest you leave the AP dumb on both internal and guest. Separate them in 2 different vlans and let the Alix do the DHCP/Routing.
These are for accessing the web interface and ssh of the router. Usually guests don't need such access.
Sorry to report that VLANs (indeed a lot of this) are beyond my skill set.
I used the original Michis Blog, which I think this is based upon, back the the V15 days to set this up on other hardware. Was hoping for a relatively easy redux.
the Basic Dumb AP config has me turn off the Firewall, dnsmasq and odhcp in step 6. Am I corect that to use the "guest WLAN on a dumb AP" I need this turned on?
If I need the firewall to process the additional rules, and it has been disabled all along, then it seems like the lack of IP is the first thing to fix??
Let's better have a look at your configuration. If you don't like VLANs then we'll look at a semi-routed scenario, with the guest network routed and the internal network bridged. uci export network; uci export wireless; uci export dhcp; uci export firewall
Redact any sensitive date, like usernames, passwords, keys etc.
When you're routing guests on the OpenWrt box, firewall and dnsmasq must be running. odhcp is for IPv6-- you can leave it disabled in an IPv4 only situation.
The locally routed guest scenario makes sense in many cases, but with wired links from all your APs to a powerful main router it is better to centrally route. Set up VLANs and have the AP be dumb for both the trusted users and guests.
I have re-enabled dnsmasq and firewall and now get an IP address. Yeah! Thank you!
I have enabled the Traffic Rules for Guest DHCP and Guest DNS, but the others are disabled for now. I expect that I only need those to further restrict traffic after I can get to the internet.
Even a blind squirrel gets a nut every once and a while.
I needed to make some additional changes in order to get connected.
1 - Somewhere along the way I lost the Gateway and DNS for the LAN connection on the AP. This should have been done in the original Dumb AP config, but i'm not sure it was. It did work however.
2 - I removed the DNS on the Guest, but not sure this was relevant to getting it working.
3 - Firewall rules for DHCP and DNS must be enabled. Not clear why, I though these only brought back services after "Block Guest Access to Private Network" rule.
FWIW, I am on Windoze 10 and used the Network Sharing => Adapter Settings and disabled\enabled the wireless while the router rebooted between changes. After making the above changes I saw that the Guest indicated it was connecting to the Internet, but it was unable to actually connect until I rebooted the PC.
With the Firewall Rules for DNS and DHCP enabled I can reach the Web Pages for my NAS, Network Printer and Router but not the Dumb AP, which was unexpected at this point. I can not reach any of the local shares in File Explorer.
After enabling the Rule for "Block Guest Access to Private Network" I was unable to access any of the above pages or Network Shares.
Same results after enabling the rules for "Disable Guest AP HTTP Access" and "Disable Guest AP SSH Access". At this point I also tested accessing the router with WinSCP (I'm a dumb Windows user.. Lot of dumb stuff here) and was unable to connect. a good thing.
As best I can tell this is now all working as desired. Thank you both!
I'm getting a respectable 31 down, 16 up which is in line with my "internal" wireless performance on 2.4G. Good enough for my guests.
1 - FIREWALL and DNSMASQ must be re-enabled. (System => Startup). The Dumb AP Wiki disabled these.
2 - Firewall rule protocol for "Guest DHCP" should be UDP only. (Network => Firewall => Traffic Rules)
3 - Firewall rule protocol for "Guest DNS" should be UDP only. (Network => Firewall => Traffic Rules)
4 - Firewall rule for "Disable Guest AP HTTP Access" is not included in the wiki but is in the original post.
5 - Firewall rule for "Disable Guest AP SSH Access" is not included in the wiki but is in the original post.
All these are kinda expected, as you are trying to combine two different approaches and configurations.
The dumbAP guide doesn't use firewall or dhcp, the guestwifi does.
For 4 and 5 they are not needed as the option input for Guest zone is REJECT.
It is unfortunate that the wiki post I wrote caused you some confusion.
To make it clearer for future users, I want to iterate through your points and update the wiki as necessary:
The firewall rule for guest DHCP is already set up as udp for ports 67 and 68.
The firewall rule for DNS can be udp+tcp, but as @trendy mentioned it's for transfering zones, is not neccessary but can't hurt either (I think?)
& 5. The rule # Disable guests to access devices in the 192.168.1.xxx range should reject all traffic from guest to other devices on all protocols. I am not sure why this is not working for you?
My setup is a little different nowadays, having setup a vlan for the guest AP.
And I am using the WAN port to connect my router to the modem (still a dumb ap, cannot bridge due to ISP modem not allowing it.)
This allows me to have 4 ports left on the routers.
@WRTuser I'm very glad you found this thread. I very much appreciate you authoring this!!
I missed that this was stand alone for a few reasons.
First sentence includes reference to Dumb AP
I pretty much went right to the GUI config
Michis original blog started from the Dumb AP
I now see the reference under Manual configuration "...default configuration". This was substantially my mistake. I will suggest the edit below.
This documentation is written to help you set up a guest WLAN on a dumb AP. The changes below assume an OpenWrt default configuration.
For more information on setting up only a dumb AP see Dumb AP / Access Point Only.
All of the issues related to the firewall rules were related to some form of discrepancy between content in the 2 posts and the wiki.
Items 2 & 3 were clarifications on protocols.
Items 3 & 4 in the post, but missing from the wiki. Per @trendy , not needed, but not clear to the naive like myself.
I had tried to implement Michi's process recently, but ran into too many differences in the V19 menus compared to the probably V15 it was based on, and aborted the config due to time.
Interestingly I found an old post of mine related to this which tells me to turn on the firewall and yours actually says turn on DHCP (post 12).
My dumb AP is not that dumb to be fair.
I disabled DHCP on the modem provided by the ISP and let the openwrt router handle the DHCP.
But if you have an other DHCP server it can handle this also e.g. pihole.
Hi @RangerZ,
As you suggested here, I answer to your comment:
I am not clear on the static route's purpose or how to configure this
The static route is needed for the router to know where to find your gest subnet in your home
let' say, as an example:
192.168.1.0/24 is your lan.
192.168.2.0/24 is your guest subnet.
192.168.1.253 is the lan adress of the dumb AP on your LAN.
192.168.1.254 is your router
Now imagine your guest connect its PC or phone with 192.168.2.10
when he goes on www.openwrt.org, the connexion will follow this way:
192.168.2.10 => 192.168.1.254 => the internet => www.openwrt.org server
ok now the data comes back from openwrt website to your guest machine: www.openwrt.org => the internet => xx.xx.xx.xx (your public internet IP) => 192.168.1.254.....and....well your routeur will desperatly wonder where to find this 192.168.2.10 that is not a member of your LAN
Static route is here for this: it has to be set in the router, not in the dumb AP.
the principe is just to say "if you look for 192.168.2.0/24, please forward to 192.168.1.253 (LAN IP of your dumb AP), because your dumb AP will know where to find 192.168.2.10
Then, how to set a static route may vary depending on your router, but you should easily find a static route section.
setting is not very difficult. basically, you have to set a target network (your guest subnet) and a gateway (here the gateway is the LAN address of the dumb AP).
There may be different way to proceed. Like I told on the other thread, I followed this howto
According to the website, this static route idea is a way to avoid double NAT, that could be an alternate way to proceed (I must admit I didn't checked all the other links).
Placing option masq '1' on the LAN network solves this. Traffic from the 192.168.2.0 network will be NATted to have a return address of 192.168.1.253. Thus the main router does not need to carry a route all the way back to the guest user at 192.168.2.X. The locally routed guests appear to be internal use from the AP as a single device on the main router's LAN.
Though home users on its regular AP are bridged to their own 192.168.1.X address. This is the original function of the dumb AP. Adding local DHCP and NAT for guests makes it not so dumb.
