We help IT Professionals succeed at work.

How to use DD-WRT to setup a private and a public wireless in company?

KANEWONG
KANEWONG used Ask the Experts™
on
Hello;

I want to setup a private and a public wireless access point for my company, the private wlan should bridge to the existing LAN, in which the user connect to private WLAN who can access to the LAN resources such as server but the user connect to private WLAN such as guest who can access to internet only.  I have a Linksys wireless router and has DD-WRT firmware installed.  Here is my LAN infrastructure, I have two IPS, I want my private WLAN go to internet via T1 and the public WLAN go to internet via Cable.

LAN Info

A firewall connect to T1
IP address : 192.168.0.x

The private WLAN should use the same address space as LAN

The public WLAN should use another address space 192.168.1.x

The 192.168.1.x should be restricted to 192.168.0.x

I read many DD-WRT tutorial but none is success, I want to know how should I connect the network cable from my Linksys LAN ports at the back as well.

thanks!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
SouljaSr.Net.Eng
Top Expert 2011

Commented:
Which Linksys model to you have? You may be able to set up DD-WRT for vlan tagging and set up a trunk port to you AP. Then have on vlan for your company, and the other vlan for Guest. What type of switch is the AP connecting too?
You can configure a Virtual Interface to do it, but you have to configure something on the swith where the AP is connect, at least some routing to "guide" the packets :)

Linksys has an IP like 192.168.0.254, but is still missing the routing for 192.168.1.X/24 on a switch so you can forward traffic to Cable WAN

Author

Commented:
I am using Linksys WRT54GL router, I have DD-WRT firmware installed.  this is what I thought, using two VLANs, one for private and one for public.  However the downside is that I am going to install this router in a meeting room where has only 1 RJ45 port for LAN which connect to my main LAN.
Sr.Net.Eng
Top Expert 2011
Commented:
Well good news man. You DD-WRT happens to support 802.1q tagging for your Linksys:

http://www.dd-wrt.com/wiki/index.php/VLAN_Support

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=482560#482560

http://www.dd-wrt.com/wiki/index.php/Multiple_WLANs   For multiple  SSID configuration and assigning to vlan.

Read these links to configure the DD-WRT. It may seem daunting but it is doable.


As for the port in the meeting room, change that into a 802.1q trunk port that allows the two vlan across it. Then once you have your DD-WRT configured correctly, you can connect it to that port. The switch that will provide routing for the guest vlan will needs to have ACl to prevent the Guest vlan from accessing the company vlan.

Author

Commented:
By using 802.1q trunk port, I have to configure a trunk port on another switch which linked to the internet router, right?
SouljaSr.Net.Eng
Top Expert 2011

Commented:
Correct. The switch that lead to the meeting room.

Author

Commented:
I do not have a manageable switch now but if my second Virtual access point ip address can go out to internet if I configure a secondary subnet routing and rules in my firewall?

In this case, the VAP will be a second subnet, I will create the same subnet ip address space in firewall let says 192.168.1.254, this will be used as a default gateway of my public WLAN.

Can I do that?
SouljaSr.Net.Eng
Top Expert 2011

Commented:
If you can't get that port in the meeting room to become a trunk port for 802.1q tagging, you won't be able to get this to work.  L3 won't work if L2 isn't set up right.

Author

Commented:
thx!