Let's see if I can do this...
First of all, sorry for my bad english, I'm Brazilian.
I started trying to do Tagged VLANs on dd-wrt an never understood it.
Then I came to openwrt and... well, now I have one Virtual Machine running Openwrt Attitude Adjustment 12.09-rc1, with multiwan (2 wans), DDNS (one for each wan), one private network, one guest network limited to 1 mbps (wired connections too) and one network for my virtual machines.
Connected to this VM, there is a Netgear WNDR 3700 v1 (same Openwrt version) as Switch/AP (one 2.4 Ghz wifi on the private network, one 2.4 Ghz wifi on the guest network and one 5.0 Ghz wifi on the private network) and a Tp-link WR1043ND v1.8 (same Openwrt version) as Switch/AP (one 2.4 Ghz wifi on the private network, one 2.4 Ghz wifi on the
guest network). The guest network on both routers is the same.
The reason I'm using a VM, is because none of my routers (wndr3700 and wr1043) could handle both wans with perfomance.
So, to configure the guest network across both routers... (In my case, I use more then two routers)
I'm assuming:
-First router is Netgear WNDR 3700 v1, with OpenWrt Attitude Adjustment 12.09-rc1 (this one will be the one on the internet)
-Second router is TP-Link WR1043ND v1.8, with OpenWrt Attitude Adjustment 12.09-rc1
-The routers are on First Boot, with Luci installed on both routers
-The routers are not connected to each other, yet
-IP Range to be used for the private network: 192.168.1.0/24 (192.168.1.1 to 192.168.1.254)
-IP Range to be used for the guest network: 192.168.2.0/24 (192.168.2.1 to 192.168.2.254)
On your computer:
a-) Connect a cable between your computer and the SECOND router, on port 1. (or 2, 3, 4... just remember which of them you're connected to)
b-) Set your IP Address to 192.168.1.10 (for example), with netmask 255.255.255.0 (if you want, you can set gateway and DNS to 192.168.1.1)
On the second router:
1-) Access http://192.168.1.1, login to Luci Web Interface with user root and no password
2-) Go to System, Administration, type in a password, confirm it, click save & apply
3-) Go to Network, Interfaces. Click "Edit" (Under Actions) in the LAN interface.
4-) Set: IPv4 Address to 192.168.1.2, IPv4 netmask: 255.255.255.0, IPv4 gateway: 192.168.1.1. If you want, you can use a custom DNS (like 192.168.1.1 
), without a DNS you cannot install nothing on the router.
5-) Check "Disable DHCP for this interface" under "DHCP Server". Hit Save & Apply.
6-) Wait a moment and access http://192.168.1.2. Log in to the router with root and password (created on item 2)
7-) Go to Network, Interfaces again. If I remember right, the WAN interface is actually VLAN 2 (under "WAN" there is something like "eth0.2"). If you want, you can delete the WAN interface (it will not be used on this router),
so you can use all 5 ports of the router.
8-) Now go to Network, Switch.
- I THINK WR1043ND comes configured like this:
VLAN ID 1, Port 0 off (its the wan port), Ports 1, 2, 3, 4 untagged, CPU port tagged
VLAN ID 2, Port 0 untagged, Ports 1,2,3,4 off, CPU port tagged (this was the VLAN in use by the WAN interface)
- IF you deleted the WAN interface, you can use it to connect this router to the first router. If not, you can use ports 1 to 4 instead. Change both VLANs to (assuming you deleted the WAN interface):
VLAN ID 1, Port 0 tagged, Ports 1 to 4 untagged, CPU port tagged
VLAN ID 2, Port 0 tagged, Ports 1 to 4 off, CPU port tagged
Save & Apply (And just to be sure, reboot your router)
- If this is done right, you should have access to your router again in a few moments.
- This way you're saying to the router that VLAN 1 (Already configured "LAN" interface/network) AND VLAN 2 (the one we will configure as "GUEST" interface/network) will use the (original labeled) WAN port
WARNING: If you TAG the port that you've connected your computer, you will be locked out of the router, unless you tag your computer network interface too.
9-) (if you rebooted, log in again). Got to Network, Interfaces. Click Add new interface.
10-) Give it a name (GUEST), the protocol is "Static Address", on "Cover the following interface" select "VLAN Interface eth0.2", and hit "submit".
11-) On the next page, set: IPv4 Address to 192.168.2.2, IPv4 netmask: 255.255.255.0. You don't need to setup DHCP Server (will be configured on the other router). Hit Save.
12-) On the SAME page click on "Firewall Settings". On "unspecified -or- create" put "guest". Hit Save & Apply
13-) Go to Network, Wifi. Click Add. ESSID "Guest" (example), Mode Access Point, Network "GUEST" (created on item 10). Configure security as(or "if") desired. Save & Apply.
14-) Go to Network, Firewall. Delete the "WAN" zone on firewall or, at least, disable the lan forwarding to it.
15-) Connect the WAN port of this router, to port 4 of the first router (which is Port 0, in Luci Web Interface). At this point, they do not "see" each other... yet.
16-) (Optional) If you want a little more security: Go to Network, Firewall. Under "zones", change "Input" of "guest" to "drop". Save & Apply.
-This way, the guest network could no reach this router, it is only used to "pass" the traffic to the first router
17-) Now, remove the cable connecting your computer and this router, and connect the cable to the first router, on port 1 which is port 3 on Luci (or remember the on you've used).
On the first router (the one connected to the internet):
18-) Access http://192.168.1.1, login to Luci Web Interface with user root and no password
19-) Go to System, Administration, type in a password, confirm it. Click Save & Apply
20-) Configure your WAN (Network, Interfaces, "Edit" on WAN and so on). If you configured your computer with gateway AND dns, you should have internet now.
21-) Go to Network, Switch.
- On "VLANs" you probably have something like VLAN ID 1, Port 0,1,2,3 Untagged, Port 4 off, CPU tagged
- Click Add, it should appear "VLAN ID" "2".
- Configure both VLAN like this:
(if you did item 15 as I told) VLAN ID 1, Port 0 tagged, ports 1,2,3 untagged, Port 4 off, CPU tagged
VLAN ID 2, Port 0 tagged, ports 1,2,3,4 off, CPU tagged.
Save & Apply (And just to be sure, reboot your router)
- If this is done right, you should have access to your router again in a few moments.
22-) (if you rebooted, log in again). Go to Network, Interfaces. Click Add new interface.
23-) Give it a name (GUEST), the protocol is "Static Address", on "Cover the following interface" select "VLAN Interface eth0.2", and hit "submit".
24-) On the next page, click "Setup DHCP Server". The page will reload. Set: IPv4 Address to 192.168.2.1, IPv4 netmask: 255.255.255.0. Configure DHCP as desired. Hit Save.
25-) On the SAME page click on "Firewall Settings". On "unspecified -or- create" put "guest". Hit Save & Apply
26-) Go to Network, Wifi. Click Add. ESSID "Guest" (example), Mode Access Point, Network "GUEST" (created on item 23). Configure security as(or "if") desired. Save & Apply.
27-) Go to Network, Firewall. Under "Zones" click "Edit" on GUEST. Under "Inter-Zone Forwarding" select "wan" on "Allow forward to destination zones". Save & Apply.
Well... If I didn't forgot nothing, I think it's done.
This way you have 2 networks (private and guest) on both routers. The guest wifi accessing internet, but not your private network.
It's possible to change a lot of things like...
- Is it possible to put a wired client on guest network? Yes
- Is it possible to the guest network access my private network? Yes
- Is it possible to assign a different DNS to the guest network? Yes
- Is it possible to limit the download rate of the guest network? Yes
And so on.
Could someone validate all of this? I've done it by myself, with no one validating.
