Posted: Mon Jan 08, 2007 11:35 pm Post subject: WRT54GL How to setup a VLAN for FON on port 4?
Hi, I have been trying to create a separate VLAN for an access point that is on the roof of my house hooked up to an 8dbi omni-directional antenna. The access point is connected to port 4 of the linksys router.
I want to provide internet through the FON movement but I need to have my private network isolated from the wireless clients coming from that vlan2.
Here's the problem:
1) My routers' ports are reversed so port 4 is actually port 0 for me. When I execute:
Code:
nvram set vlan0ports "1 2 3 5*"
nvram set vlan2ports "0 5"
nvram commit
reboot
The variable vlan2ports will no longer be defined and vlan1ports will go back to "0 1 2 3 5*"!!!
I was also to able set up chillispot and it seemed to work because I could get an IP in the 192.168.182.x range, but it does not send me to the FON login page. The internet is completely accessible and so are the other computers in my network.
Everything seems to work fine (chillispot works beautifully) except that I can STILL communicate with the computers in vlan0. I need the vlan2 to be completely isolated from vlan0
What IP address do you have for vlan2? What does ifconfig show? Setting connection type in nvram doesn't work (at least it didn't for me), try to set it up using ifconfig.
OK!!! Everything works now! Here is a little howto:
These are instructions on how to set up a separate *completely isolated* vlan and running chillispot configured for Fon on that vlan. The new vlan will assign IPs in the 192.168.2.x range.
First create a vlan2:
(Note: in WRT54GL the ports are switched, so port 4 is actually port 0... change accordingly!)
Code:
nvram set vlan0ports="1 2 3 5*"
nvram set vlan2ports="4 5"
nvram commit
Don't forget to change the radiusnasid and press Save Startup. Then paste this:
Code:
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o vlan2 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j DROP
iptables -A INPUT -i tun0 -d 192.168.2.1 -j DROP
iptables -t nat -I PREROUTING -i tun0 -d 192.168.1.1/255.255.255.0 -j DROP
DEV="tun0"
DOWNLINK="256"
UPLINK="128"
tc qdisc del dev $DEV root
tc qdisc del dev $DEV ingress
# limit download
tc qdisc add dev $DEV root handle 1: htb
tc class add dev $DEV parent 1: classid 1:1 htb rate ${DOWNLINK}kbit burst 6k
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 192.168.2.1/24 flowid 1:1
# limit upload
tc qdisc add dev $DEV ingress handle ffff:
tc filter add dev $DEV parent ffff: protocol ip u32 match ip src 0.0.0.0/0 police rate ${UPLINK}kbit burst 10k
Now press Save Firewall. What those iptables rules do is allow the vlan2 to receive internet aswell as block access to 192.168.2.1 (which will be the router's IP). The rest of the script limits the bandwidth available to the Fon users.
Joined: 24 Oct 2006 Posts: 1447 Location: Vaasa, Finland
Posted: Fri Jan 19, 2007 8:52 am Post subject:
Question: Do you use FON access point in your roof or is it "generic" one? I'm asking this because I'm planning to make similar thing here too.
I mean because all that setup for vlan2, does one still need fon device / fon firmware in that second AP?
to developers: have FON readyness in DD-WRT, especially in v24 as it has virtual SSID's, that way one can have single AP if location is good _________________ Site 1:
P3 1GHz Coppermine with DD-WRT v24 as main router
2x Buffalo WHR-HP-G54 with DD-WRT v24 as AP
Site 2:
AMD64 4200+ Dualcore AM2 with DD-WRT v24 as main router
Buffalo WHR-HP-G54 with DD-WRT v24 as AP
No, I use a *generic* conceptronic access point. That's why I like this setup.
I didn't want to put a La Fonera in the roof because it forces you to create a private SSID and I don't want my private wireless network to be broadcasted all over my city
Joined: 24 Oct 2006 Posts: 1447 Location: Vaasa, Finland
Posted: Fri Jan 19, 2007 2:41 pm Post subject:
nunofgs wrote:
No, I use a *generic* conceptronic access point. That's why I like this setup.
Yeah, I've studiedsome more and even found instructions how to make FON work on v24 and Virtual SSID's. Slowly but steadily I will get there ^^ _________________ Site 1:
P3 1GHz Coppermine with DD-WRT v24 as main router
2x Buffalo WHR-HP-G54 with DD-WRT v24 as AP
Site 2:
AMD64 4200+ Dualcore AM2 with DD-WRT v24 as main router
Buffalo WHR-HP-G54 with DD-WRT v24 as AP
