Setting up secure internal network on OpenWrt router and iot Wi-Fi network on separate router

Installing and Using OpenWrt Network and Wireless Configuration
1

I’m trying to set up a secure internal network on openwrt router and iot Wi-Fi network on separate router

Internal network router, all lan based for now, might setup wpa3 later for tighter Wi-Fi for about 3 mobile devices I have that support it - asus RT-n16 running openwrt 21.02.0 kernel 5.4.143
192.168.1.1

Iot Wi-Fi network off of one of lan port of internal router(port 1) - asus ac68ru running asus-merlin 3.0.0.4.386_2 (no lan ports used on iot router/ bought it used, they intermittently work, but Wi-Fi and wan port works fine) only using Wi-Fi 2.4 and 5ghz Wi-Fi networks off of second router/wpa2
192.168.7.1

May setup wpa3 on internal router later for some devices that support wpa3 using wpad-ssl add-on in openwrt (already have used this successfully, so don’t think I need help with this, at least for now)

I want to make internal network be able to access iot Wi-Fi devices, but not allow Wi-Fi devices (especially hackers) to browse internal network.

Im green to setting up something like this, I’ve been experimenting, even locked myself out at one point, where openwrt was smart enough to change settings back after 90 seconds of no response.
I may only need vlan or firewall setup , or little of both.

I know how to use ssh to access router in case I need to enter info in CLI instead of GUI

Thanks for any help/assistance from users in group.

2

If your main router is tuning OpenWrt, you will be best served by setting up VLANs on that device.

1 Like
3

Agreed. Create your iot lan in the upstream router (rt-n16) and use the downstream unit (ac68ru) as an access point only. Separate the iot network with vlan, make a separate firewall zone for it as well and you can allow lan zone to access iot zone but not the other way around.

4

Thanks for replies so far. Hoping for some ssh terminal coding to make those features happen on the openwrt router, where iot can’t access primary lan. Thanks.

5

For most users, IoT and Guest networks are essentially the same. This should help...

2 Likes