OpenWrt Firewall Zone: Create a Guest Network with Internet-Only Access

Creating a Guest SSID alone does not protect the internal network. To prevent Guest clients from reaching NAS devices, cameras, or management interfaces, create a separate network and control forwarding with a firewall zone.¹

Suggested model

A simple model contains:

• lan: the home network, allowed to access the router and internal services.
• guest: the Guest network with its own DHCP service.
• wan: the path to the Internet.

The Guest zone should:

• Allow DHCP and DNS access to the router.
• Allow forwarding from Guest to WAN.
• Reject forwarding from Guest to LAN.
• Block management services unless they are explicitly needed.

Create the Guest network

In LuCI:

1. Open Network → Interfaces.
2. Click Add new interface.
3. Name it guest.
4. Select the appropriate bridge or VLAN interface.
5. Set a separate IPv4 address, for example 192.168.50.1/24.
6. Enable the DHCP server for this network.
7. Attach the Guest SSID to guest.

Do not reuse the lan subnet. Separate address ranges allow the router to distinguish sources and destinations.

Create the firewall zone

Open Network → Firewall → General Settings and create a guest zone:

• Input: REJECT or DROP, depending on the desired behavior.
• Output: ACCEPT.
• Forward: REJECT.
• Covered networks: guest.
• Allowed destination zone: only wan.

If Input is REJECT, allow DHCP and DNS so clients can receive addresses and resolve names. LuCI may add the required rules when the zone is created.

Check inter-zone forwarding

Under Inter-Zone Forwarding, allow only:

1

guest → wan

Do not create:

1
2

guest → lan
lan → guest

unless there is a specific need and separate rules restrict the access.

Equivalent UCI configuration

Example Guest zone:

1
2
3
4
5
6
7
8
9

uci add firewall zone
uci set firewall.@zone[-1].name='guest'
uci set firewall.@zone[-1].network='guest'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci add_list firewall.@zone[-1].forward='wan'
uci commit firewall
/etc/init.d/firewall restart

The @zone[-1] index can change with the actual configuration. Read /etc/config/firewall and back up the configuration before running commands.

Test from a Guest client

From a Guest client, verify that it:

• Receives an address from the Guest subnet.
• Can access the Internet.
• Cannot access LAN IPs such as the router, NAS, or internal servers.
• Can resolve DNS names.

On the router, inspect the firewall log if needed:

1

logread -f

Do not leave verbose firewall logging enabled on a weak router for long periods, because it can create significant I/O.

Conclusion

Proper Guest isolation requires the network, DHCP, Wi-Fi, and firewall zone to work together. Changing only the SSID name or password does not create a real security boundary.

Official source