When will the Guest Network in the EAP225 be fixed ?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
12

When will the Guest Network in the EAP225 be fixed ?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
When will the Guest Network in the EAP225 be fixed ?
When will the Guest Network in the EAP225 be fixed ?
2020-02-09 16:33:12 - last edited 2020-02-26 11:43:36
Model: EAP225  
Hardware Version: V3
Firmware Version: 2.6.1

@forrest 

 

Based on a simple setup without the Omada Controller with a couple of 2.4 Mhz and 5 Mhz SSIDs and one guest SSID

 

I want to segment the local network for IOT devices not having acces to the local network.

 

The Guest Network in the EAP225 V3 2.6.1 is broken as there is no local IP isolation.

 

1) There is still ping access to other devices within the local networks when connected to the guest SSID

2) Having a guest SSID defined causes the isolation to function after some time on all other SSIDs necessitating a reboot of the EAP225 e.g. when wanting to using chromecast from an Android phone

 

This has been discussed before in this community, but no action has been taken to fix these bugs.

 

 

  1      
  1      
#1
Options
1 Accepted Solution
Re:When will the Guest Network in the EAP225 be fixed ?-Solution
2020-02-26 11:43:29 - last edited 2020-02-26 11:50:35

Hi all, 


We have realized this issue and we will fix this bug on the next firmware. You can keep an eye on the official website for more updates.

Because it needs some time to release this firmware, we have made a beta to solve this issue. If any of you meet such an issue, please feel free to contact us. 

 

Recommended Solution
  0  
  0  
#11
Options
19 Reply
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-10 00:01:54

@joergent, works for me. But my network is IPv4 only. What setup do you use?

༺ 0100 1101 0010 10ཏ1 0010 0110 1010 1110 ༻
  0  
  0  
#2
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-10 00:43:14

@joergent 

The Guest Network in the EAP225 V3 2.6.1 is broken as there is no local IP isolation.

This feature also takes effect on my network topology, when you create the SSID, please check the guest network. After the client devices connect to this SSID, these devices cannot communicate with each other and they cannot access the private subnet. 

 

  0  
  0  
#3
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-10 16:36:16 - last edited 2020-02-10 16:36:41

I am enclosing some screendumps of the setup of the EAP225. I have reduced the configuration to as simple as possible.

My Samsung Galaxy S8 on the iot_nomap SSID can ping my PC on the wired local network (same 10.30.3.0/24 subnet) as well as the TP-link HS100 on another SSID, which I don't think it should be able to.

 

 

  0  
  0  
#4
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-10 17:39:22

@joergent, I'm sorry, but this works for me, too.

 

Tested with MacBook & Android tablet on EAP225v3 with firmware 2.6.1:

 

 

 

Ping from MacBook (.205) to router(.1), server (.10), Android tablet (.204):

 

dhcp-205 $ ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
^C
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss


dhcp-205 $ ping 192.168.1.10
PING 192.168.1.10 (192.168.1.10): 56 data bytes
Request timeout for icmp_seq 0
^C
--- 192.168.1.10 ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss


dhcp-205 $ ping 192.168.1.204
PING 192.168.1.204 (192.168.1.204): 56 data bytes
Request timeout for icmp_seq 0
^C
--- 192.168.1.204 ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss
dhcp-205 $ 

 

 

༺ 0100 1101 0010 10ཏ1 0010 0110 1010 1110 ༻
  0  
  0  
#5
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-10 18:51:58 - last edited 2020-02-11 02:09:42

@joergent, the 10.0.0.0/8 IP range indeed reveals an issue:

 

Router: 10.30.3.1/24

Android: 10.30.3.66/24

MacBook: 10.30.3.216/24

 

Wireless settings as in last post, »guest_nomap« is the Guest network:

 

 

 

Ping to the router (.1) and Android tablet (.66):

 

$ ping 10.30.3.1
PING 10.30.3.1 (10.30.3.1): 56 data bytes
64 bytes from 10.30.3.1: icmp_seq=0 ttl=64 time=1.218 ms
^C
--- 10.30.3.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 1.218/1.218/1.218/0.000 ms

 

$ ping 10.30.3.66
PING 10.30.3.66 (10.30.3.66): 56 data bytes
64 bytes from 10.30.3.66: icmp_seq=0 ttl=64 time=8.239 ms
^C
--- 10.30.3.66 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 8.239/8.239/8.239/0.000 ms

 

 

Only client isolation inside the same virtual wireless interface works, but not blocking private IPs:

 

 

$ ping 10.30.3.66
PING 10.30.3.66 (10.30.3.66): 56 data bytes
Request timeout for icmp_seq 0
^C
--- 10.30.3.66 ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss
$

 

 

@forrest, please can you validate this? I can't execute ebtables on my EAP to proof it.

༺ 0100 1101 0010 10ཏ1 0010 0110 1010 1110 ༻
  1  
  1  
#6
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-11 07:09:12

@joergent 

My Samsung Galaxy S8 on the iot_nomap SSID can ping my PC on the wired local network (same 10.30.3.0/24 subnet) as well as the TP-link HS100 on another SSID, which I don't think it should be able to.

You are right, when we connect the client devices to the SSID, they shouldn't be able to communicate with other client devices. We want to have a test in our lab, can you tell us the network topology? We will try to reproduce the issue in our lab. If it is truly a bug of the firmware, we will fix it as soon as possible. If possible, please upload some screenshots of your SSID settings.

  0  
  0  
#7
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-11 09:49:44

@forrest 

Wouldn't it be better to send you the configuration file from the unit ?

Please, send an email to bugs(a)jth.net and I'll respond with the config.bin file

  0  
  0  
#8
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-15 15:25:16 - last edited 2020-02-15 15:34:17

(deleted)

  0  
  0  
#9
Options
Re:When will the Guest Network in the EAP225 be fixed ?
2020-02-15 15:33:09 - last edited 2020-02-15 15:35:15

Sorry, I just found out that my email server rejected your email due to your email specifying the charset of gb2312. Due to a lot of spam in Chinese characters this filter was introduced. The filter has been removed. Anyway I am sending the config.bin file to your email address now

  0  
  0  
#10
Options
Re:When will the Guest Network in the EAP225 be fixed ?-Solution
2020-02-26 11:43:29 - last edited 2020-02-26 11:50:35

Hi all, 


We have realized this issue and we will fix this bug on the next firmware. You can keep an eye on the official website for more updates.

Because it needs some time to release this firmware, we have made a beta to solve this issue. If any of you meet such an issue, please feel free to contact us. 

 

Recommended Solution
  0  
  0  
#11
Options