Two wifi networks, same subnet, different IP address pools

[tectonic]

Good evening,

Possibly a 'stupid question', but...

Support I have two WLANs: my_wifi_1 and my_wifi_2.

Is it possible to have my_wifi_1 have allocated the IP addresses 192.168.1.100 to 192.168.1.149 whilst my_wifi_2 receives the addresses 192.168.1.150 - 192.168.1.255. That is, they're both on the same subnet.

I'd like to do this so that I can write some Policy Based Rules. I'd like route clients attached to my_wifi_1 over the WAN, and route clients attached to my_wifi_2 over a VPN, whilst keeping all of them in the same LAN (e.g. for Chromecast and Airplay discovery).

I suspect the answer is 'no', but I'm hoping I'm wrong...

Thanks.

[luochongjun]

I suggest you divide it into two different subnets, such as 192.168.1.0/25 and 192.168.1.128/25. In between the two subnets, firewall and routing strategy are set to realize mutual visits. When accessing the external network, subnet 1 is accessed through WAN port, while subnet 2 is accessed through VPN

[tectonic]

Thanks, @luochongjun. That makes sense conceptually. I'll see if I can execute it. I think something close to this is what you're suggesting, along with the Policy Based Rules (which I can set in the LuCI UI using vpn-policy-routing & luci-app-vpn-policy-routing)

/etc/config/network

config interface 'my_split_subnet'
    option proto 'static'
    option ipaddr '192.169.1.1'
    option netmask '255.255.255.0'

/etc/config/wireless

config wifi-iface-1
    option device 'radio0
    option mode 'ap'
    option network 'my_split_subnet'
    option ssid 'my_wifi_1'

config wifi-iface-2
    option device 'radio0
    option mode 'ap'
    option network 'my_split_subnet'
    option ssid 'my_wifi_2'

/etc/config/dhcp:

config dhcp 'wifi-iface-1'
    option interface 'wifi-iface-1'
    option start '2'
    option limit '28'
    option leasetime '12h'
    
config dhcp 'wifi-iface-2'
    option interface 'wifi-iface-2'
    option start '128'
    option limit '128'
    option leasetime '12h'

/etc/config/firewall

config zone
    option name my_split_subnet
    option network 'my_split_subnet'
    option forward ACCEPT
    option input ACCEPT
    option output ACCEPT
    
config forwarding
    option src wifi-iface-1
    option dest wan
    
config forwarding
    option src wifi-iface-2
    option dest wan
    
config forwarding
    option src wifi-iface-1
    option dest vpn
    
config forwarding
    option src wifi-iface-2
    option dest vpn

config forwarding
    option src wifi-iface-1
    option dest wifi-iface-2
    
config forwarding
    option src wifi-iface-2
    option dest wifi-iface-1

If this looks approximately correct (i.e., I haven't misunderstood your suggestion), then I'll give it a go and post back here with my results.

Thanks for your assistance; much appreciated.

[luochongjun]

From your configuration, you're still bridging WIFI1 and WIFI2 together, and I'm not sure that would be a problem

[tectonic]

Ah yes. I suspect, however, that if I don't bridge them, then service discovery across the two subnets (Airplay, Chromecast etc) won't work without arguing with avahi. I could be mistaken.

[trendy]

In that case use static dhcp leasings and use policy based routing to forward the traffic from the devices you want to the vpn gateway.

[tectonic]

yeah, I think I'm using a cannon to kill a mosquito here. I've already got a few static DHCP leases set up, and am doing precisely that.

The use case I'm trying to solve is: in-laws come over, they want to cast from their device to the TV. The TV is on my private subnet which forwards over the VPN. They connect to a subnet which forwards over the WAN (so that Netflix doesn't shout at them about proxies / VPNs) and can still cast to the TV. I could reserve a static DHCP lease and use PBR, but I was hoping I could achieve this without knowing their MAC address in advance.

Not the end-of-the-world, and I had a hunch it'd be more hassle than it's worth. Worth asking, though.

[dlakelan]

If two networks are bridged then they are one broadcast zone. When a DHCP packet is broadcast if there are two DHCP servers they will both hear the request, both respond, and which one takes effect is nondeterministic.

One way you could make this work is to set up a filtering bridge. But I'd recommend you just set up static leases by MAC and have one DHCP server.

[dlakelan]

@tectonic

The use case I'm trying to solve is: i

This use case can be solved by static reserving all your stuff and having a dynamic pool for the rest of the stuff, when in-laws come they get a dynamic address and that is a signal to policy route through WAN.

[tectonic]

Yes! That's brilliant: solves the problem. Thanks!

[dlakelan]

If your problem is solved, please click the check mark below the solution post which makes it easier for people to search for solved problems if they have similar issues! Thanks.

[tectonic]

I ended up giving avahi-daemon a bash (just for 'fun'). The Chromecasts are in 192.168.1.1/24 and they appear sporadically in 192.168.3.1/24. But, more-often-than-not, the appear and then disappear, and then I can't cast to them reliably from 192.168.3.1/24. If anybody has any experience of battle with avahi-daemon, then I'd appreciate the guidance. I've managed to get it working in ddwrt before, but so far, haven't succeeded here.