[Solved] Help for creating Guest access with LUCI on Meraki MR18

Dear All,

I'm looking for help to creating a guest wifi access with LUCI/LEDE with my Meraki MR18. This is my system :
Internet box :
Cisco Router : and
Meraki MR18 :

I have created an acces wifi on my MR18 and all is perfect. But, when I want to created a guest access, i have a lot of difficulties (Maybe because the MR18 is just an access point). I read lot of tutorials to do that but it still not working.

Can someone help me on this problem ?


I'm not sure how this would be configured on an access point, but it would likely require creating a separate vLAN for the Guest network, creating firewall rules to allow it access to the WAN Gateway, and creating firewall rules to block all other traffic from the Guest Network.

Normally when a Guest network is created on the WAN facing router, forwarding would be blocked from Guest -> LAN, but allowed for Guest -> WAN, however this isn't possible on an access point since it isn't configured with a WAN network.

Dear JW0914,

I have some capture about my configuration. I think is more simply with image :
This is my Wireless configuration on MR18 (with 3 radios)
Wireless Overview

My Guest WIFI is MerakiInvit. I created an interface :

I set the static IP to with DHCP enable :
Interface configuration

And, I modify the firewall setting to transfert Guest directly to WAN :
Firewall Zone Setting

With this setting, I can connect to MerakiInvit and I have a good IP :, but I can't access to internet.

Thanks for your help

I don't know how you would configure this when you don't have a WAN interface, however I suspect it would involve what I suggested in my prior post.

Dear JW0914

You're right, the MR18 don't have WAN port. It's just an acces point with one ethernet port.
I read this post : TpLink TL-WA801ND v3 - LEDE 17.01.4 - Vlan Configuration
I think this is the same problem but i don't understand all.

Is there any person that have the same problem ?

Instead of a wan port you will need a wan Vlan... This is nontrivial the first time you set it up because you have to read up on what a Vlan is and how to configure them. It is very situation specific how you would want it set up... There isn't really a shortcut

I can say that each port can have only one untagged Vlan, so you probably need a tagged Vlan, in which each packet on the wire carries a Vlan ID with it.

Might be a good starting point. Once you understand the concept, how to configure it is much easier

If you go this way the router your AP talks to will also need to have that Vlan set up as well


The highest usable number is 254.

I hope others were able to assist with the VLAN, etc...I am somewhat lost, though:

It's not "just an AP..." it's an LEDE device now, you just have to properly configure it.

  • I'm wondering why you have 2 upstream routers,
  • why you're not masquerading on the LAN, and
  • why you configured forwarding from your Guest WiFi to WAN, when your upstream connection is actually on LAN,
  • are you trying to NAT, ROUTE OR BRIDGE the upstream device,
  • etc.

NO, from your own picture, there's a WAN. YOU HAVE TO CONFIGURE THE MR18 PROPERLY. THIS WILL LIKELY REQUIRE VLANs, SINCE YOU HAVE LESS PHYSICAL PORTS FOR USE. Per @dlakelan, you may wish to learn more about VLANs, trunked ports (possessing a VLAN frame tag) and access ports (not possessing a VLAN frame tag).

@polarrys The question you have to ask yourself in order to figure out how to configure your system is:

When a packet comes in via your guest wifi, and needs to go to the internet via a router, how does it get to the router? How does the router know that it's a guest packet vs a "regular" packet? If you read up on VLANS and then can answer that fundamental question, then you'll be pretty good to go.

1 Like

I am a noob about configuring network but I will read information about Vlan. Maybe a person has done this on a MR18

It's really not just about the MR18, you will need to make your router communicate with your MR18 in such a way that the reverse routing: from the internet, to your router, to your MR18 and out of the "guest" SSID also works. The problem is not solvable strictly by configuration of the MR18 alone.

1 Like


i have corrected my mystake. Right is of course.

I'm sure that one people have realized this on MR18. I will check. I will search a tuto about that.

Yes, my MR18 has LEDE now but it's more complicated that Cisco Meraki software :wink:

Why you say I have 2 routers ? I have only one router : a Cisco RV 180W.

I don't know what is masquereading on the LAN :frowning:

I thinked that it was possible to link Guest acces with WAN directly

I just one to creat 2 SSID : a main with all access and a guest with limted access

On my picture I see the WAN (linked to LAN). I will read informations about VLAN.
Maybe it exist a more simple system to created a guest access (I hope) :slight_smile:

As @dlakelan said. You will have to configure the Cisco device properly, as well. You will likely have to enable VLAN trunk ports between the Cisco and LEDE device.

OK, I understand that I must create a VLAN on my Cisco router RV 180W

Correct, but your guest WiFi is called "MerakiInvit," not WAN

Yes, make it a tagged vlan on the Cisco RV 180W (which is your actual router), and then make a tagged vlan on your Meraki with the same tag number. then bridge the second SSID on the meraki with the tagged vlan interface on the Meraki, making a single "Guest" interface. Then, provided that your cisco has correct firewall rules etc, your packets will flow from Guest interface to the wire tagged with the vlan, and then out to the RV180W, which routes it out to the internet via NAT (for IPv4) and then takes the return packet, and routes it down the vlan interface to the Meraki... which sees the vlan tag and knows to bridge it to the WLAN guest SSID.... If you understand that flow... you can get what you want.

Yes, my guest wifi is MerakiInvit

I think you're missing my point:

  • You have LAN and MerakiInvit
  • WAN has no connection
  • You have forwarding from MerakiInvit to WAN, THIS IS INCORRECT

The Meraki should act as a bridge, between a tagged vlan on the wire, and the extra SSID... there is no IP routing that should happen in the Meraki.

You probably want the Guest Vlan to be on a separate ip subnet, for example, and the Cisco RV180W to have an IP on this subnet say associated with the VLAN interface on the 180W. Then clients on the guest vlan will get their ip addresses via DHCP either handed out by the Meraki, or handed out by the Cisco RV180W but not both choose which one you want to be in charge.

Also, consider if you want ipv6 here... depends on your situation. But again, should be a separate network number.

1 Like