i am working with OpenWRT since a few years without any problems, but because of this situation i need some help.
I was wondering if it is possible to setup 3 dump APs (wired/wirelessly) with a seperated guest network. The ISP should be the DNS for the complete setup and AP1 should be the DHCP for the private and guest network, forwarding every request to the other APs clients are trying to connect to. I attached a picture of the setup how it should work in theory.
i tried both (disabling and also forwarding).. but like you said that its not needed i might failed with the complete configuration.
do you have some instructions on how to setup the interfaces correctly for this kind of setup?
like i said, the seperation of guest/private afterwards via the firewall of all ap's shouldnt be a problem..
yes i created a new firewall zone for the guest interface. right now the guest interface is a complete duplicate of the lan interface. the seperation via firewall rules can be done if both, guest and private network are hooked up and the clients connected to AP2 and especially AP3 are able to get an ip from AP1.
just followed those guides, but this just made it possible to setup a guest interface at the AP1, but didnt helped out for this constellation with different subnets (ISP - AP1) while cascading dhcp over multiple APs
There are different ways to do this but here is what I would do:
The LAN is 192.168.10.0/24, controlled by the ISP router (which is what the OP wants, I would instead set up an OpenWrt main router and use the ISP box as a dumb modem, but that is a choice).
The backhaul links are all bridges on the LAN. Thus for LAN users, the APs are dumb APs and all routing, DHCP, etc is controlled by the main router / ISP box.
Guests are locally NATted into the LAN at each AP. Each AP has a guest network (any subnet other than 192.168.10.0) and a local DHCP server for it. The rest of the network sees their traffic as LAN usage (see below). This means that the rest of the network does not need to be aware that there is a guest AP at all.
Each guest network has firewall rules blocking any destination IPs in 192.168.10.0. It may seem that that would not work because the gateway is 192.168.10.1, but it does work because the rule is based on the final destination address.
Each guest network has firewall rules blocking all ports on the AP except for DHCP and DNS.
Each AP independently DHCP's its guests. If they move to another AP they get a new IP from that AP. That seems like it would limit operation but it really doesn't.
The LAN users get their DHCP from the main router through the bridged backhaul links, and if they move to a different AP they will keep the same IP.
Your ISP box is not "just a modem" if it is running private IPs. A true just a modem has a public IP on the Ethernet which passes everything in or out directly on the Internet.
Yes and this is why I suggest locally routing the guests rather than trying to preserve them as separate entities on the backbone. The backhaul links can even be standard AP-STA links if you don't mind the implications of that for the LAN.
got you.. so there isnt a way to get all clients an ip from the AP1's DHCP? (which isnt a problem for me.. i was just wondering if this is possible -> right sided solution at the first post picture )
i just want all the clients of the private network to reach AP1's DHCP cause i dont want them to reconnect if they move around. (if the guests have to reconnect cause there isnt a way to use also AP1's DHCP.. well bad luck )
i have to use WDS because there isnt a way to wire AP3 to one of the other APs.
Just using AP3 as a repeater kinda bothers because clients will keep the connection to AP2 as long as possible which causes a reconnect to AP3 (10-20 sec without any connection).. because of this i want everything to be captured at AP1 to avoid any reconnection if moving around. ->
What you want is doable but you should run batman-adv on the ap3 and ap2. That will carry vlan tags across the radio link. Then you set up vlans and have ap1 hand out the different subnets on different vlans.