howtogeek at April 22nd, 2013 11:24 — #1
Originally published at: http://www.howtogeek.com/153827/how-to-enable-a-guest-access-point-on-your-wireless-network/
Sharing your Wi-Fi with guests is just the polite thing to do, but that doesn’t mean you want to give them wide open access to your entire LAN. Read on as we show you how to set up your router for dual SSIDs and create a separate (and secured) access point for your guests.
skylarf at April 22nd, 2013 15:45 — #3
How do you block someone piggybacking on the guest wifi account? Say someone at the local RV park using a network extender
geek at April 22nd, 2013 16:10 — #4
Well, you can make sure to use WPA2 encryption and use a reasonable passphrase (something long but easy to tell people). That will prevent people from using it, except for your friends.
donho at April 23rd, 2013 11:42 — #5
Used in a SOHO setting, is this PCI compliant?
jfitzpatrick at April 23rd, 2013 12:55 — #6
Like the Geek said, you can set any security on the second SSID you can set on the primary. The only reason we didn't immediately set the security in the tutorial was to make it faster to grab lots of Wi-Fi enabled devices around our office and test the secondary SSID. You can lock it down with a guest-only password (which is very convenient because you can then change the guest password whenever you feel like it without having to go through and reset the password on all your own devices).
jfitzpatrick at April 23rd, 2013 12:59 — #7
I'm not a lawyer/PCI compliance enforcer but if it's PCI compliant to run your card information through a regular encrypted SSID/Wi-Fi AP then there should be no reason that it isn't compliant do it this way. The only thing I would suggest is that you ensure two things 1) that you make certain that the firewall rules are in effect and that nothing from the secondary network can access the primary network and 2) that you're using strong security on both the primary and secondary SSIDs.
petedd at April 23rd, 2013 16:41 — #8
Great article! If one has a MAC filter on the primary AP, do those rules also apply to the virtual interface (second AP)? If so, is it somehow possible to have the MAC filter only on the private network and not have it on the guest network? Thanks again for a great article!
fredds65 at April 24th, 2013 04:59 — #9
Just looked into the modem supplied by telstra (the australian telco). It is a technicolor tg587n. Has two guest accounts, they just need a tick in the box to activate. They have 8 digit random passwords already applied, and work on a different network to the home network, ie home 10.x.x.x ; guest net, 192.168.x.x.
Not a big fan of telstra, but was surprised to see this level of helpfulness.
jfitzpatrick at April 24th, 2013 10:32 — #10
@Petedd From what I can tell, reading the DD-WRT documentation and forums, it depends on whether your router is Broadcom or Atheros chip based.
Broadcom chips use one filter list and all virtual SSIDs beneath that inherit the filters. Atheros chips can use multiple filter lists.
This means if you have a Broadcom chip (found in most routers) you'll have to add the guests MAC addresses to the main filter list in order to allow them access to the guest network. That's counter productive to the whole idea of having a guest network. I'd suggest ditching the MAC filter altogether. As long as you're using strong encryption like WPA-2 the MAC filtering adds little security to the whole setup (and in this case, a lot of inconvenience).
petedd at April 24th, 2013 11:29 — #11
I tested and found that on my Buffalo router with DD-WRT that separate mac filters are generated for each BR so I am golden with having the MAC filter on the "inside" AP and just a password on the "guest" AP. Again, great article THANKS!
jfitzpatrick at April 24th, 2013 14:06 — #12
Awesome! You lucked out with just the right hardware/chip configuration for the job at hand. =)
nowlin_home at April 25th, 2013 13:20 — #13
Help I am connected via Ethernet cable and now I can not log onto the router. The firewall is preventing me to connect.
I did make one change from the instructions 192.168.1.3 instead of 192.168.2.1 My primary router is set to 192.168.1.1 and this second router is set to 192.168.1.2 Can you tell me how to access my router now. I was setting up a Linksys WRT54G series Wireless Router just like the one in the article.
clehnert at August 26th, 2013 03:45 — #14
This is an excellent tutorial. Thanks!
One thing I struggled with was getting the guest interface to assign the alternate IP range. Once I assigned the bridge to the VAP (in the "Assign to Bridge" section), it worked like a charm. Did you forget to mention that step?
anthonymclin at September 14th, 2013 02:12 — #15
Actually, this is NOT secure because of the bridging mode.
All a user of the guest network has to do is change their IP address from DHCP to Manual and self-select an IP address that would be valid on the "internal" network.
Bam! Guest now has full access to your internal network.
hpolack at October 18th, 2013 12:13 — #16
The article is awesome. Is the net outcome that I can run a router in my basement and a router on my main floor, but offer both my family AP access (still share among our servers and each other) on both the downstairs AP and the main floor AP while also running a Guest AP on the same routers, but not allow access to my primary network with my servers and each others computers. My issue is that my primary router with my firewall is downstairs in the furthest corner of my house and my guests can't get a good signal. I don't want to hook up a separate additional router on the main floor for just the guests and then have another router on the main floor for my family. This sounds like it will do the job and in fact I could add a third router on my 2nd floor. Of course with the standard firmware on routers, you can only truly enable the guest access only on the primary router to segregate guests to only external internet access and not intranet access. I have at least 5 different routers as constantly playing around. I even have a gigabit enterprise managed switch in the basement, but again I don't want to have to isolate a whole router on a VLAN. Any help and clarity would be appreciated. I recently bought the Netgear R7000 as it says it will support OpenWRT, so I am thinking of buying three of these and connecting them as outlined in this article.
pc_bandaid at December 12th, 2013 21:33 — #17
I've gone through the article twice and I keep having one problem. When I connect to the guest AP I still get an ip that exists on my LAN. So instead of getting an ip of say 192.168.2.2 I still get 192.168.1.2 which is my private LAN. What am I doing wrong? I am using the dd-wrt enabled Buffalo router.
I'm confident I did everything right and didn't miss anything. I even tried enabling the DHCPD option even though I don't use more than one router. Any ideas?
geek at December 13th, 2013 10:52 — #19
This topic is now closed. New replies are no longer allowed.