Separating Guest Wi-Fi with OpenWrt VLAN and Firewall

A different SSID is not a security boundary. This procedure separates the guest network at the network/VLAN layer, gives it its own DHCP scope, attaches the SSID to the correct interface, and permits only Internet forwarding.

1. Model and prerequisites

Example: management/LAN VLAN 10 with 192.168.1.0/24, guest VLAN 20 with 192.168.20.0/24, and a trunk between router, switch, and AP. Confirm VLAN tagging support and the target’s DSA/switch layout. Names such as br-guest and eth0.20 are not universal.

2. Back up and inspect

sysupgrade -b /tmp/guest-vlan-backup.tar.gzcp /etc/config/network /tmp/network.beforecp /etc/config/wireless /tmp/wireless.beforecp /etc/config/dhcp /tmp/dhcp.beforecp /etc/config/firewall /tmp/firewall.beforeuci show networkuci show wirelessuci show dhcpuci show firewall

Use wired LAN or console while changing VLANs.

3. Create the guest interface

After confirming the real VLAN/bridge device, a logical interface can look like:

config interface 'guest'        option device 'br-guest'        option proto 'static'        option ipaddr '192.168.20.1'        option netmask '255.255.255.0'

On DSA targets the bridge-VLAN section may also be required. Follow the target’s actual topology; do not invent br-guest.

uci show networkuci changes networkuci commit network/etc/init.d/network reload

4. Add the DHCP scope

config dhcp 'guest'        option interface 'guest'        option start '100'        option limit '150'        option leasetime '12h'

Then verify and reload:

uci show dhcp.guestuci commit dhcp/etc/init.d/dnsmasq reload

5. Attach a guest SSID

In LuCI Network > Wireless, create a separate SSID and attach it to guest, or use a matching wifi-iface section:

config wifi-iface        option device 'radio0'        option mode 'ap'        option ssid 'Guest-WiFi'        option encryption 'sae-mixed'        option key '[WIFI_PASSWORD]'        option network 'guest'

Replace the placeholder only on the router. Never publish the real key.

uci show wirelessuci commit wirelesswifi reload

6. Apply guest firewall policy

Create a guest zone with input/forward rejected and output accepted, plus the only forwarding path to wan:

config zone        option name 'guest'        list network 'guest'        option input 'REJECT'        option output 'ACCEPT'        option forward 'REJECT'config forwarding        option src 'guest'        option dest 'wan'

Permit DHCP/DNS with narrow rules and block management LAN forwarding. Do not leave a temporary guest -> lan ACCEPT rule.

uci show firewalluci changes firewalluci commit firewall/etc/init.d/firewall reload

7. End-to-end test

Join the SSID and confirm 192.168.20.x, gateway, DNS, and Internet:

ping -c 3 1.1.1.1nslookup openwrt.org 192.168.20.1ip addrip routelogread -e dnsmasqfw4 print 2>/dev/null || iptables-save

Confirm that 192.168.1.1, NAS, switch management, and LAN SSH are blocked. Test both Wi-Fi and the trunk: a native/untagged mismatch can strand LAN or put guests in the wrong network.

8. Recover

cp /tmp/network.before /etc/config/networkcp /tmp/wireless.before /etc/config/wirelesscp /tmp/dhcp.before /etc/config/dhcpcp /tmp/firewall.before /etc/config/firewall/etc/init.d/network restart/etc/init.d/dnsmasq restart/etc/init.d/firewall restartwifi reload

{{< ads >}}

Source

Source: OpenWrt Guest Wi-Fi extras.