Creating 2 VLANS, 1 with internet, 1 without

I have a wireless network with 2 ssid's. How can I give internet to one of them and not to the other?

The network has a local web server which both ssid's need to get to.

Is there a straight forward way of doing it??

Network currently looks like this:
INTERNET      --      ROUTER P0-ROUTER P1      --      Switch      --      Wifi

- The router is giving out the DHCP
- The router does have another port which I'm not using at the moment.

I suppose I could create a VLAN like this:
                                                       -- ROUTER P1 (vlan1) -- Switch -- Wifi
                                                       -- ROUTER P2 (vlan2) -- Switch -- Wifi/Hardwire

Im not 100% sure on vlans so the above may not work but its a start…

Router - UBIQUITI Edge Router
Switch - UBIQUITI Toughswitch
Wifi - UBIQUITI Unifi UAP Pro

Any pointers??

Steve TinsleyAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Daniel HelgenbergerCommented:
This is the most transparent way, as you already said you could do so:

You would also create the VLANs in your router and assign the router IPs in both vlan's. These are the gateway IPs for your WLAN subnets.
Then, just create a reject rule for all traffic in the VLAN you do not want to have internet connection, denying everything but local subnets. This should be possible with your router. (in your router, this would be "Firewall Policies" - but using the internal interface).

Is this what you wanted to know or do you need more assistance?
Steve TinsleyAuthor Commented:
I havent used vlans before...
I assume I add VLAN 1 to one ssid and VLAN 2 to the other.

Can you choose any numbers for the vlan?

Do I need to set any vlan number in my switch?
Daniel HelgenbergerCommented:
VLAN IDs can range from 1 to 65k something (16bit word). But ofthen there are limitations on how many VLANs a device can support at the same time; but I think you will not hit this limit.

As for your switch settings - these must match the routers.
Basically there are two VLAN modes, tagged and untagged. Tagged would let the endpoint device decide what to to with the VLANs while untagged the switch decides which VLAN a device would get. This is imported for not so smart devices (most propbly your WLAN access points) which cannot handle tagged VLANs.
Keep in mind, a switch port can only have one VLAN untagged and many vlans tagged, obviously.

For your setup, lets assume your WLAN with internet is VLAN 2 while your WLAN without internet connection is VLAN1. You already have this VLAN 1 (Default VLAN) configured as untagged on your switch by default. To not disrupt traffic, leave it this way.

First, create a new VLAN 2 on your switch. Assign the router's switch port these VLANs:
V1 - untagged
V2 - tagged

To the switch ports of your WLAN access points, assign this:
Accesspoint A (No internet): V1 untagged
Accesspoint B (internet): V2 unrtagged (and deny access to VLAN1 optionally)

Now, create the VLAN 2 on your router. This is handeled as a new interface. I used this guide, hope this will fit your router:
p 11 ff.

Be sure to enable also the DHCP server for the new VLAN, since it will be completely isolated from the rest of the network. Set it to a different subnet than your VLAN 1.

Allow Internet with pass everything to any destination firewall rule on that interface for testing.
You should be able to access the internet via Accesspoint B now.

On your internal interface (which Accesspoint A is using) create the mentioned reject rule.
rom this point on, your default VLAN with all connected wireless and wired devices will not be able to access the internet any more.

You can fine tune this by allowing IP ranges with more firewall rules.
Also, you might want to block traffic from the internet Accesspoint B altogether to the internal subnet, allowing only internet (for guests).
If you want internet only blocked on the WLAN interface but not on the wired equipment, you can create a VLAN 3 end repeat the steps above for VLAN2, but reversing the Firewall rules.

PS: Since you can potentially disrupt traffic, it would be a good measure to do all this on a weekend or when you are not under pressure, since you have not done this before. It is a long read, but the task is rather easy once you master the basics.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.