How to seperate guest wifi access from our LAN?

Hiya

I have a DrayTek Vigour 2820n wifi router, which is a nice bit of gear, and comes with the ability to have 4 seperate wifi SSIDs.

I'm running into a bit of a problem actually using them, probably because of my limited knowledge.

SSID 1 is our guest wifi, secured by WPA, password available to any of our clients and visitors.

SSID 2 is our work wifi channel, again with WPA. Only staff have this.

The problem is users on SSID 1 can also see our LAN, which is not good. I want guest users on SSID 1 to only have access to the internet, nothing else. How?

There's a setting on the Draytek to isolate LAN from any wifi SSID, but when I activate that, I can't access internet through the wifi. I think it's because DNS and DHCP is being handled by the server, not the Draytek.

That means when a user connects to the wifi, the draytek won't give out an IP address, and it won't let the user connect to the server to get an IP address either. But I don't want to let guest wifi clients connect to the server

Any ideas?

Spinnerlys - I'd rather have the LAN completely invisible to wifi guests, with not even computer names visible.

Thanks Acurafan - will try playing with the ports next time I'm in. Do you mean forward ports 80 (for http) and 53 (for dns) to the server IP address?

Another suggestion I read elsewhere was to find or buy a cheap wireless router, and connect it via the WAN port to the primary router. The firewall in the new, cheap router will cut off the LAN from the wifi.

ramases said:

Does this help, from the Draytek faq?

http://www.draytek.co.uk/support/kb_vigor_multiplessid.html

Click to expand...

Hi that's exactly what I refered to in my first post. The 'Isolate LAN' setting becomes worthless if the Draytek doesn't also handle the DNS and DHCP.

Hello Chris,

Sorry it took me a while to reply.

To be honest, I don't have enough experience with the Draytek to be able to answer your questions. I don't work there full time, and this is low on my list of priorities.

> Can you assign a DHCP pool to that particular WLAN?

Don't know. Not on mine (I think), however, Draytek have come out with new firmware that enables better pool handling. I haven't yet installed it.

>With Wirelss Isolation Mode enabled, can you add a physical port to that configuration?

Don't know, sorry. See above.

>An an unrelated note, have you got the Wireless N model?

Yes.

> Have you got this Draytek configured to use 'N'?

No.

> Does it work OK with your Mac on 'N'?

No idea. It works fine with my Macbook, but I have to leave the draytek on mixed mode so that it works with the various old PC laptops. I don't really have time to kick people off and then set the router on N and test it with my Macbook. Sorry.

We had an issue with the router rebooting itself every 24 hours on the dot. At first I thought it was a firmware fault, however it seems to have been due to a clash between two DHCP servers on the same network. When I turned off the rogue DHCP server, the rebooting stopped.

Apart from that, it's been rock solid. I do have to say, it is not very user friendly. There is no help guide at all in the web interface, and you are generally expected to know what you're doing before you set anything.

I've skimmed through the 269 page manual that came on CD with it, and it wasn't amazingly helpful. You really do have to know your networking stuff when setting this up for anything technical. I guess if you're asking questions like what you were asking me, you'll be fine with it.

strikerforce777 said:

I was able to resolve this issue by setting a secondary DNS server entry (8.8.8.8 is google's DNS) in DHCP options. When a device connects it gets an IP from the DHCP server and then is isolated from the network. If it only has the internal DNS server it can not resolve any addresses. It needs an external DNS server set. Hence, DHCP -> scope options -> DNS -> add entry.

Click to expand...

Thanks. Obvious now that you put it like that However I stopped working at the company I mentioned at the top of the thread nearly two years ago ...