cayvman wrote

I have another router the lynksys wrt54GS that i have the dd-wrt firmware on. With this router am able to set up a vlan (192.168.2.x) and then use the cpt210 as a repeater(extender) using the wifi ssid that i've set up on the vlan (192.168.2.x).

You need to find out the VLAN ID. On DD-WRT it is the second digit of the name of the Ethernet interface (e.g. eth0.3 means VLAN ID 3). The IP address is of no meaning here.

Also, you did not tell us wether you want the guest network exclusively on the CPE210 or wether you want the guest network as an additional WiFi network on the CPE210 (I assumed the latter).

So, if you are using the CPE210 only for the guest network and nothing else, the setup will be easier: just add a dedicated port of the WRT54's Ethernet switch to the guest network and connect the CPE to it. In this case you don't need to expand the VLAN to the CPE, i.e. you don't need Multi-SSID setup. To add a port to the guest VLAN, see the web UI of DD-WRT (settings for the built-in Ethernet switch of the WRT54).

If you want two networks on the CPE - your home and a guest network -, enable Multi-SSID, assign one SSID the VLAN ID of the home network (most often VLAN ID 1, but see your router's config to be sure) and the other SSID the VLAN ID of the guest network (most often VLAN ID 3 on OpenWRT-based systems, but again, see your router's config). Only in this case the switch's port must be tagged, that means it must be assigned to both networks and will carry the VLAN ID to/from the CPE where it will be separated again to the corresponding SSIDs. There should be a HowTo on the DD-WRT's website how to set up a guest network for the built-in WiFi of the WRT54. Only difference when using a CPE is that you need to expand the VLAN setup "over the wire" to the CPE.

Hope this helps.

I can think of the KISS principle ( https://en.wikipedia.org/wiki/KISS_principle).

Why don't you just hook it up via an ethernet cable in AP router mode, enable the DHCP server and create a separate subnetwork of .2.100 - .2.199, set the gateway to the IP of the router (EWAN), leave VLANs completely out of the game and in the wireless settings choose a WPA2-AES pass and enable AP isolation...wouldn't that lead to such a result as the one you' re after?

But then again R1D2 seems to suggest that there's a danger there, as " Beware of AP router mode: it will expose your personal network to the guest network if connected to the same router/modem.". However in enabling AP isolation via the router (CPE) how is this still possible?

@RTouris, the EWAN concept is nothing other than a VLAN.

@cayvman, the WRT54 always uses VLANs, wether you set up a second (guest) network or not:





The WRT54 SoC implements two Ethernet interfaces eth0 and eth1. eth1 is used for the WiFi, while eth0 is used for the 5-port Ethernet switch.

In order to separate WAN from LAN, VLANs are used. LAN (4 ports) are usually eth0.1 (VLAN 1), the WAN port (Internet) is usually eth0.2 (VLAN 2). Note that in the picture above there is a different setup with VLAN 0 and VLAN 1, but this has been changed long time ago in favor for a more general VLAN layout. So the principle is still the same, although with other VLAN IDs nowadays.

Actually the switch is 6-port switch if you count the internal port leading to the CPU (internal port 5, not visible outside). This port 5 is a tagged port, meaning data packets from other ports to the CPU carry the VLAN ID in it, so the CPU can decide what is traffic from/to WAN and what is traffic from/to LAN.

Now your guest network comes into play. If you add a guest network on the WRT54, it will be done by creating another virtual Ethernet interface (say, eth0.3, VLAN 3). Let's call this GLAN for guest LAN. So far VLAN 3 aka GLAN is unused, but as soon as you assign it to a virtual WiFi interface (a second SSID to simplify), it can be used wirelessly on the WiFi adapter of the WRT54. As soon as you assign a port, for example one of 0 to 3 (corresponding to port numbers 1 to 4 on the box), to VLAN 3 aka GLAN, devices connected to this port let's you send/receive traffic from/to the guest network.

So you have nothing more to do as assigning a port (say, port 3, labeled 1 on the box) to eth0.3 (VLAN 3 / GLAN) to be able to connect the CPE through this port to the guest network. Either you use the web UI to do so or you use config files directly through the command line. I could tell you the content of the config file to have a port assigned to a VLAN, but I don't know the web UI's menu structure of DD-WRT (I don't use DD-WRT). If you are familiar with command line, please post the content of file /etc/config/network. Alternatively, post a screenshot of the Network->Switch web page of the web UI. There must be a page where you can assign ports to networks/VLANs.

There are also several HowTo articles for VLANs on the OpenWRT and DD-WRT web site, maybe these are of further help. This is actually no big deal.

cayvman wrote

Question is if I telnet the router and send the following command nvram set vlan3ports="3" how should I complete the following command: nvram set vlan3hwname=?. Should it be br1 or ath1.1?

Glad it works for you. If you are using a bridge, you should set the hwname to br1. But what do you want to achieve with a bridge with only one interface assigned? It should also work with ath1.1 if you don't assign it to a bridge interface. To be honest, I didn't use DD-WRT at all and with OpenWRT NVRAM is gone even on WRT54 since long time (it uses config files instead). So, if in doubt, please ask in the DD-WRT forum to be sure. The DD-WRT wiki talks about et0 for the WRT54's switch ports, but it might be outdated already or a typo, since you have eth1 instead.

cayvman wrote

Agreed only one interface, but how or where would I assign that interface with a ssid?

In wireless setting you should be able to assign the SSID with a network ( GLAN or whatever you named it), this will create the link between ath1.1 and the WiFi interface (SSID). In network settings the network then is assigned an interface such as br1 or ath1.1. If DD-WRT differs in this respect from OpenWRT, just find the place where you would assign br1 to the SSID and use ath1.1 instead.

While we're still at it and looking for a moment back to the KISS principle as I outlined in page 1 of the current thread, could someone explain to me why following a much simpler approach would potentially "expose the personal network to the guest network when using the same router" (which btw is how things are done most of the time in that all are conected to a same modem/router) given that the CPE supports AP isolation for the Guest WiFi network SSID?

Thanks!