I recently purchased a Ubiquiti Networks EdgeRouter Lite
to act as the router to my home network. As this box is only a router and not a WiFi access point, I'm using my Apple Time Capsule as an access point. By doing this and not using the Time Capsule, I lost the ability to have a separate guest network that wouldn't interact with my main network and wouldn't have access to my internal resources. After a bit of searching, I found out that the Time Capsule (and Airport Extreme)'s guest network uses a VLAN tag of 1003. A VLAN is a virtual LAN designed to separate traffic without physically separating it. I knew that the EdgeRouter Lite was extremely powerful and could do all kinds of wacky things with a VLAN; the question was just how could I do it.
I've been dabbling with Linux networking for almost 20 years, so firewall, DNS, DHCP, etc. don't scare me. It was just a matter of putting the right pieces in the right places without having to resort to the command line.
Here's what I did:
- From the Dashboard, click Add Interface and select VLAN.
-
Set up the VLAN as 1003 and attach it to the physical interface of your LAN. Give it an IP address in the range of a private IP block, but make sure you end it in a /24 to specify the proper subnet (I originally did /32 as I though it was supposed to be the exact IP address).
-
Click on the Services tab. Click Add DHCP Server. Set it up similar to the image below.
-
Click on the DNS tab under services. Click Add Listen interface and select the VLAN interface. Make sure you hit save.
At this point, you should be able to connect to your Guest Network and connect to the Internet. However, you'll be able to access the EdgeRouter as well as other devices on your LAN. Next thing you have to do is secure the VLAN.
- Click on Firewall/NAT and then click on Add Ruleset. This is for packets coming into the router destined for somewhere else (not the router). Set up the default policy for Accept. Click Save.
-
From the Actions menu next to the Ruleset, click Interfaces.
-
Select your VLAN interface and the in direction.
-
Click Rules and then Add New Rule. Click on Basic and name it LAN. Select Drop as the Action.
-
Click Destination and enter 10.0.1.0/24 or whatever your LAN IP range is. Then click Save. This will drop all packets from the VLAN destined for your LAN. Save.
-
Repeat 1 and 2 above (name it GUEST_LOCAL). From the Interface, select the VLAN interface and the local direction. However, set up the default policy as Drop.
-
Add a new rule. Set it to Accept on UDP port 53.
-
Save.
Now you can test this by connecting to the guest network and accessing the Internet. Then try connecting to a device on your LAN or connecting to the EdgeRouter Lite. Both actions should fail.
I've tested this and it is working well on my network; if I've missed anything, please let me know!
Comments
July 31st, 2015
Jared
Did you find a way to limit the bandwidth on only the guest portion of your network?
July 31st, 2015
Scott Gruby
I haven't tried, but I suspect Smart Queue Management could let you do this.
January 6th, 2016
Ezra
Thanks for this guide! I just got an Edgerouter X (so I'm new to the EdgeOS platform) and it worked perfectly.
January 8th, 2016
Ben Wong
"Have you seen this? \r\n\r\nI also have an airport extreme + edgerouter lite. \r\n\r\nUsing my iphone/macbook when I join the guest network (192.168.200.0/24) I get an ip address from my privileged network (10.0.1.0/24). It seems as though osx tries to get a new IP via DHCP but fails and reverts to its old one. Not sure what to do to force it to get an IP on the correct subnet. \r\n\r\nMy windows machine doesn't seem to have this problem."
January 8th, 2016
Scott Gruby
I haven't seen that except when my Mac is plugged into Ethernet and joining WiFi on my guest network. You can have your device forget the privileged network and then join the guest network to see what happens. All of my iOS devices and Macs work properly on either network.
February 9th, 2016
Jeff
"Thanks Scott, it was great to find you old post on this topic... I have a new v1.7 ERL and am attempting to isolate a VLAN for guests (eth0-WAN, eth1-192.168.1.1/24; eth2 -192.168.2.1/24; eth2.30 - 192.168.3.1/24)\r\n\r\nMy GUI interface is a bit different than you described above... but close enough... Question: I am a bit confused as to the IP (destination) specification. (I can't attache a screen shot to show my case...)\r\nI have Rules # 1 and 2; 1: Description \"UniFI Portal, Destination: address 192.168.1.100, port-group, UniFi_Guest Portal, Protocol tcp, action accept. 2: Description \"Drop Route to Private Network 192.168.1.0, Destination 192.168.1.0/24, Protocol all, action drop.\r\n\r\nI have loaded this from an example I found in a forum... but am unsure if it is established correctly for my case. \ \r\nCan you verify/recommend changes?\r\nI appreciate your time/insight.\r\nJeff"
February 9th, 2016
Jeff
Should my rule destination be the VLAN I want to isolate?? (eth2.30)??
February 9th, 2016
Scott Gruby
In step 5, the destination is your LAN, not your Guest Network. You're basically saying that you want all traffic that comes from the guest network (Step 3) to be dropped when it hits the LAN (destination). I believe you'll have to make sure that the Guest Portal rule is before the drop rule otherwise traffic will get dropped and won't reach the portal.
March 5th, 2016
Aaron
"Great Article! I was just about to give up & I found your blog. I have the exact same setup & followed your instructions exactly. That being said, it looks like it almost works for me. Unfortunately, from an android phone I get an IP, but mobile chrome states the the webpage is not available, with a sub note stating: DNS_PROBE_FINISHED_BAD_CONFIG (DNS Lookup Failed). I need to test a few other devices, but it seems to be repeatable as the behavior is the same on an iPhone as well. This tells me I did something wrong with the last few steps or have a different setup for DNS. Help!\r\n\r\nEdgeRouter lite (OS v1.8) + Airport Extreme (AC v7.7.3)\r\n\r\nThoughts?"
March 5th, 2016
Scott Gruby