Separating Guest Wi-Fi with OpenWrt VLAN and Firewall

A different SSID is not a security boundary. This procedure separates the guest network at the network/VLAN layer, gives it its own DHCP scope, attaches the SSID to the correct interface, and permits only Internet forwarding.

1. Model and prerequisites

Example: management/LAN VLAN 10 with 192.168.1.0/24, guest VLAN 20 with 192.168.20.0/24, and a trunk between router, switch, and AP. Confirm VLAN tagging support and the target’s DSA/switch layout. Names such as br-guest and eth0.20 are not universal.

2. Back up and inspect

sysupgrade -b /tmp/guest-vlan-backup.tar.gz
cp /etc/config/network /tmp/network.before
cp /etc/config/wireless /tmp/wireless.before
cp /etc/config/dhcp /tmp/dhcp.before
cp /etc/config/firewall /tmp/firewall.before
uci show network
uci show wireless
uci show dhcp
uci show firewall

Use wired LAN or console while changing VLANs.

3. Create the guest interface

After confirming the real VLAN/bridge device, a logical interface can look like:

config interface 'guest'
        option device 'br-guest'
        option proto 'static'
        option ipaddr '192.168.20.1'
        option netmask '255.255.255.0'

On DSA targets the bridge-VLAN section may also be required. Follow the target’s actual topology; do not invent br-guest.

uci show network
uci changes network
uci commit network
/etc/init.d/network reload

4. Add the DHCP scope

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'

Then verify and reload:

uci show dhcp.guest
uci commit dhcp
/etc/init.d/dnsmasq reload

5. Attach a guest SSID

In LuCI Network > Wireless, create a separate SSID and attach it to guest, or use a matching wifi-iface section:

config wifi-iface
        option device 'radio0'
        option mode 'ap'
        option ssid 'Guest-WiFi'
        option encryption 'sae-mixed'
        option key '[WIFI_PASSWORD]'
        option network 'guest'

Replace the placeholder only on the router. Never publish the real key.

uci show wireless
uci commit wireless
wifi reload

6. Apply guest firewall policy

Create a guest zone with input/forward rejected and output accepted, plus the only forwarding path to wan:

config zone
        option name 'guest'
        list network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding
        option src 'guest'
        option dest 'wan'

Permit DHCP/DNS with narrow rules and block management LAN forwarding. Do not leave a temporary guest -> lan ACCEPT rule.

uci show firewall
uci changes firewall
uci commit firewall
/etc/init.d/firewall reload

7. End-to-end test

Join the SSID and confirm 192.168.20.x, gateway, DNS, and Internet:

ping -c 3 1.1.1.1
nslookup openwrt.org 192.168.20.1
ip addr
ip route
logread -e dnsmasq
fw4 print 2>/dev/null || iptables-save

Confirm that 192.168.1.1, NAS, switch management, and LAN SSH are blocked. Test both Wi-Fi and the trunk: a native/untagged mismatch can strand LAN or put guests in the wrong network.

8. Recover

cp /tmp/network.before /etc/config/network
cp /tmp/wireless.before /etc/config/wireless
cp /tmp/dhcp.before /etc/config/dhcp
cp /tmp/firewall.before /etc/config/firewall
/etc/init.d/network restart
/etc/init.d/dnsmasq restart
/etc/init.d/firewall restart
wifi reload

Source

Source: OpenWrt Guest Wi-Fi extras .