I've set up my wireless network to be a guest one on a different subnet which can only retrieve DNS and DHCP and I also enabled the option "Isolate clients" in Advanced settings but I can't print with my Epson printer (WorkForce R8590; I initially did all of this because I noticed this printer was doing something strange...) whilst this option is checked.
Now, how can I make my computer (192.168.55.198) communicate with the printer (192.168.55.106) with the option "Isolate clients" activated?
alright, I thought it'd be possible by adding a firewall rule. I don't know that much about networking so I was thinking about this:
what if I go to the wireless tab and add a network with the same SSID as the other one, set the channel to auto but allow different MAC addresses on them so I put them on different networks where one has the Isolate option on and the other doesn't?
lol finally got something working at first try... I have another question: I want to have LAN ports to act the same way as a wireless guest network (devices are only able to obtain DNS and IP via DHCP but not connect to the routers gateway) unless one uses a static ip, how would one do so?
I went to the interface page and pressed add, now I need to select which network to cover and I have eth or eth0.1 (lan), which one do I select?
Then I just need to disable the dhcp server for lan and add it to the new vlan network on a different subnet, right?
Also is there a way to make only certain mac addresses access the lan subnet where the gateway is located?
I would create INPUT ALLOW rules for the DNS and DHCP, then immediately under, a DROP or REJECT rule (or make the zone default to DROP or REJECT).
Ummm...I'm not sure what you're trying to further accomplish since you can print now.
If you wish for LAN to be statically addressed, then yes, disable it on LAN.
To be honest...I'm not sure, as I'm confused about how you rigged the SSID and have no clue why you're creating an interface now. In my suggestion, this would already exist and be configured for the LAN and Guest networks/SSIDs, respectively.
Which network/vlan did you create? That's the one you should cover.
Perhaps, you should post your /etc/config/network and /etc/config/wireless
I'm unable to assist further on the non-standard setup without seeing configs. Be sure to obscure your keys.
yes it's a bit messy.
I can print so the wireless part is done.
Now when I plug an ethernet cable into the router it gets IP from DHCP server of the LAN1 subnet which can't access LAN subnet where the router gateway is.
What I want to do is limit the devices which can access the LAN subnet. I disabled DHCP for this interface so one has to manually use the correct IP to access it but do you know if there is a way to add a MAC filter or ipfilter so only my computer can access the router's gateway?
Alright so to allow my computer to access the router I have to go into the firewall tab and select reject in the input voice of the LAN interface and then add two firewall rules to allow my computer's MAC to access the router's IP via port 443, 80, 22 over TCP right?
Can you describe more detail about what you want overall? Something like "I want LAN1 and LAN2 with mostly X computers in LAN1 and Y computers and printers etc in LAN2 and exactly a certain set of MAC addresses can access from LAN1 into LAN2 but no one can access from LAN2 back into LAN1 and LAN2 can't access the router itself, and a cherry on top." or whatever. Just give us more details what you want.
I would like to have:
a computer and a printer in guest1 (192.168.55.1) whith the option "isolate clients" unchecked
All other wireless clients in guest (192.168.54.1) with option "isolate clients" checked
only my computer can access the LAN network with manual ip
all other LAN clients connect via DHCP to LAN1 which doesn't have access to LAN subnet
am I correct in thinking you want 4 separate networks
Can I suggest better naming for less confusion? Maybe
Guest (isolated wifi only?)
Printers (unisolated wifi only?)
Special (static LAN)
LAN (regular DHCP LAN)
Now, basic outline of steps:
Create VLANs on your switch for Special and LAN (there's already one for LAN probably).
create 4 interfaces in Luci with these names, put the physical settings to be the VLANS for Special and LAN
create 4 firewall zones in Luci with these names
put each interface into its associated firewall zone
set up forwarding rules between firewall zones, for example:
allow forwarding from LAN to Printers and WAN
allow forwarding from Special to LAN, Printers, and WAN
allow forwarding from Guest to Printers and WAN
allow forwarding from Printers to WAN only, or maybe nowhere
allow input to router from Special (this is where you config your router I assume)
Now create associated SSIDs for Guest and Printers, with isolated checked for Guest and unchecked for Printers
this should be the regular LAN (which is created by default settings) but with no DHCP. I would like to have only my computer (MAC address) with static IP able to access this interface and the router's gateway. The other interfaces can only get IP via DHCP and DNS and surf the internet
I did create a new VLAN with the name LAN 1 but it says this (the phsyical settings are also shown):