Creating 2 VLANS, 1 with internet, 1 without

I have a wireless network with 2 ssid's. How can I give internet to one of them and not to the other?

The network has a local web server which both ssid's need to get to.

Is there a straight forward way of doing it??

Network currently looks like this:
INTERNET      --      ROUTER P0-ROUTER P1      --      Switch      --      Wifi


- The router is giving out the DHCP
- The router does have another port which I'm not using at the moment.



I suppose I could create a VLAN like this:
                                                       -- ROUTER P1 (vlan1) -- Switch -- Wifi
INTERNET -- ROUTER P0 <
                                                       -- ROUTER P2 (vlan2) -- Switch -- Wifi/Hardwire


Im not 100% sure on vlans so the above may not work but its a start…


Hardware
Router - UBIQUITI Edge Router
Switch - UBIQUITI Toughswitch
Wifi - UBIQUITI Unifi UAP Pro


Any pointers??

Steve
Steve TinsleyAsked:
Who is Participating?
 
Daniel HelgenbergerConnect With a Mentor Commented:
VLAN IDs can range from 1 to 65k something (16bit word). But ofthen there are limitations on how many VLANs a device can support at the same time; but I think you will not hit this limit.

As for your switch settings - these must match the routers.
Basically there are two VLAN modes, tagged and untagged. Tagged would let the endpoint device decide what to to with the VLANs while untagged the switch decides which VLAN a device would get. This is imported for not so smart devices (most propbly your WLAN access points) which cannot handle tagged VLANs.
Keep in mind, a switch port can only have one VLAN untagged and many vlans tagged, obviously.

For your setup, lets assume your WLAN with internet is VLAN 2 while your WLAN without internet connection is VLAN1. You already have this VLAN 1 (Default VLAN) configured as untagged on your switch by default. To not disrupt traffic, leave it this way.

First, create a new VLAN 2 on your switch. Assign the router's switch port these VLANs:
V1 - untagged
V2 - tagged

To the switch ports of your WLAN access points, assign this:
Accesspoint A (No internet): V1 untagged
Accesspoint B (internet): V2 unrtagged (and deny access to VLAN1 optionally)

Now, create the VLAN 2 on your router. This is handeled as a new interface. I used this guide, hope this will fit your router: http://dl.ubnt.com/guides/edgemax/EdgeRouter_Lite_UG.pdf
p 11 ff.

Be sure to enable also the DHCP server for the new VLAN, since it will be completely isolated from the rest of the network. Set it to a different subnet than your VLAN 1.

Allow Internet with pass everything to any destination firewall rule on that interface for testing.
You should be able to access the internet via Accesspoint B now.

On your internal interface (which Accesspoint A is using) create the mentioned reject rule.
rom this point on, your default VLAN with all connected wireless and wired devices will not be able to access the internet any more.

You can fine tune this by allowing IP ranges with more firewall rules.
Also, you might want to block traffic from the internet Accesspoint B altogether to the internal subnet, allowing only internet (for guests).
If you want internet only blocked on the WLAN interface but not on the wired equipment, you can create a VLAN 3 end repeat the steps above for VLAN2, but reversing the Firewall rules.

PS: Since you can potentially disrupt traffic, it would be a good measure to do all this on a weekend or when you are not under pressure, since you have not done this before. It is a long read, but the task is rather easy once you master the basics.
0
 
Daniel HelgenbergerCommented:
This is the most transparent way, as you already said you could do so:

You would also create the VLANs in your router and assign the router IPs in both vlan's. These are the gateway IPs for your WLAN subnets.
Then, just create a reject rule for all traffic in the VLAN you do not want to have internet connection, denying everything but local subnets. This should be possible with your router. (in your router, this would be "Firewall Policies" - but using the internal interface).

Is this what you wanted to know or do you need more assistance?
0
 
Steve TinsleyAuthor Commented:
I havent used vlans before...
I assume I add VLAN 1 to one ssid and VLAN 2 to the other.

Can you choose any numbers for the vlan?

Do I need to set any vlan number in my switch?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.