Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Brasse]

Hello.

I have a DFL800 firewall, and a  DAP-2553 access point and i am trying to set up 2 WLAN-networks.
WLAN_Private   <-- only for company computers, with access to normal LAN & internet
WLAN_Guest   <--- For guests, with NO access to company LAN, but normal access to internet.

How should i set this up?

[danilovav]

Can you AP tag WLANs as VLANs? Maybe, untag private and tag guest?

[Brasse]

Hm yes i can add VLANs and tag them in different ways. How ever i dont understand the logic behind all this, and i have not found any information about it at all.

I dont know if i need to involve the DFL-800 firewall at all to achive what i want, or if i can find all needed settings in the AP.

in other words, i have no idea where to start. i dont even know what tagging means.

[danilovav]

Unfortunately, i have no experience with your APs. Try to find VLAN (VID and tagging) params for each SSID.

On DFL, add VLAN interfaces (Interfaces > VLAN) and make required Allow/NAT rules (Rules > IP rules). For example
# private net
Allow vlan_private/vlan_private_net lan/lannet all_services
Allow lan/lannet vlan_private/vlan_private_net all_services
NAT vlan_private/vlan_private_net wan1/all-nets all_services
# guest net
NAT vlan_guest/vlan_guest_net wan1/all-nets all_services

-- edit

Check Advanced settings > Multi-SSID and VLAN on your AP

[Brasse]

ok. lets start with the DFL.

I allready have a normal network up and running for my company, on LAN1 (& WAN1). This is the network i want to be the "Private" one.
This is on 192.168.1.0/24 net.


So i guess i only need to create on VLAN, for the guest network?
Do i need to create another net (ie 192.168.2.0/24) for the guest network, or should i create the VLAN under the same net (192.168.1.0/24)?
What settings should i use for this VLAN?

Would something like this be OK ?
Name: vlan_guest
Interface: lan
VLAN ID: 2
IP Address: 192.168.1.253
Network: 192.168.1.0/24
Default gateway: (None)

------

In the AP i cannot change any IP settings for the VLAN, so i guess "VLAN ID" needs to be the same in both the DFL and in the AP?

[danilovav]

Yes, VID should be the same on AP and DFL, right.
Change "guest" network different from lannet, ex. 192.168.2.0/24

[Brasse]

Ok now i have set it up like below. I can connect to the default network as i should and so on, but when i try to connect to the guest WLAN it times out. Ive tried with manual IP as well(to see i
f its a DHCP problem), then i can connect but no traffic goes through.

Settings on DFL

####### Interfaces -> VLAN
# Name        Interface   VLAN ID    IP address    Network
1 vlan_guest  lan            4             192.168.2.1  192.168.2.0/24
 

####### Rules -> IP Rules -> guest_net
#Name                   Action    Source interface   Source network    Destination interface   Destination network   Service
1 nat_vlan_private    NAT       vlan_guest           all-nets               wan1                       all-nets                    all_services


####### System -> DHCP -> DHCP Servers -> DHCP_guest
Name: DHCP_guest
Interface Filter: vlan_guest
Relay Filter: 0.0.0.0/0
IP Address Pool: 192.168.2.100-192.168.2.150
Netmask: 255.255.255.0



######
###### AP settings

[danilovav]

Does your AP connected to DFL's LAN?
If you can connect guest WLAN, but can't get IP thru DHCP, it means DFL doesn't recognize VLAN from AP. Check guest SSID's VLAN settings on AP.

[Brasse]

Yes.
Its connected with 192.168.1.3 on the LAN-port.

The only settings for the VLAN is what is visible on the picture in my earlier post. "Multi-SSID Settings".

There is no settings at all for IP-addresses, netmasks, whatever, for the VLAN's in the AP. That is what is i dont really understand.

The only LAN-settings i have on my AP is theese: