A little while ago I finally bit the bullet and reflashed my aging first-generation WRT-54G with the shiny new Kamikaze release of OpenWRT. I’ve been a little indifferent about the upgrade from the older Whiterussian series, and fairly annoyed by the fact that my router no longer seems to want to redial the PPPoE connection when it gets dropped for whatever reason (this only seems to happen once or twice a month, but always at the most inopportune times).
It turns out the Broadcom wireless chipset in the WRT-54G is able to drive multiple wireless networks. And even better, once you’ve figured out the somewhat idiosyncratic networking configuration in Kamikaze, OpenWRT exposes this functionality fairly well. So tonight I rejigged my wireless network with two SSIDs; A WPA2-encrypted network that’s bridged on to my local LAN, and a second open network on an isolated subnet and filtered by nodogsplash.
A little bit of googling around shows that Windows clients have a little bit of trouble with different networks originating from the same access point. I don’t have a Windows machine handy to test it. But my Wii was able to detect and connect to both networks without any problems. NetworkManager on my Eee (with an Atheros chipset) only finds one of the networks when it scans, but I’m able to manually connect to both networks.
Network setup
The VLAN configuration remains unchanged, which is lucky because I don’t really understand how it works. :-) We’re going to have a LAN interface that will still have a wireless interface bridged to it, and a separate wireless interface with its own subnet. The appropriate bits in my /etc/config/network look like this:
#### LAN configuration
config interface lan
option type bridge
option ifname "eth0.0"
option proto static
option ipaddr 10.17.17.1
option netmask 255.255.255.0
#### WIFI configuration
config interface wifi
option ifname "eth1.0"
option proto static
option ipaddr 10.17.18.1
option netmask 255.255.255.0
The lan interface defines the switch interface that wired clients see (and the wireless interface that will end up being bridged to it). The wifi interface defines an interface on the wireless VLAN that unsecured clients will talk to.
Wireless setup
Setting up the wireless interfaces is a lot simpler. All configuration is in a wifi-iface stanza in /etc/config/wireless . For multiple wireless networks, all you need to do is include multiple wifi-iface stanzas. My entire wireless file looks like this:
config wifi-device wl0
option type broadcom
option channel 5
# REMOVE THIS LINE TO ENABLE WIFI:
#option disabled 1
config wifi-iface
option device wl0
option network lan
option mode ap
option ssid "stibbons AP - encrypted"
option encryption psk2
option key "I can haz sekrit keys?"
config wifi-iface
option device wl0
option network wifi
option mode ap
option ssid "stibbons AP - shared"
option encryption none
The device option relates to the interface defined in the wifi-device stanza. The different network options relate back to interfaces defined in /etc/config/network . OpenWRT will automatically bridge each network to the appropriate device.
After a little bit of experimentation, it seems that my Eee only finds the second interface defined in a network scan. It seems to me that the public network is the one most people would be interested in, so that one’s done second.
Firewall setup
All user-defined firewalling should happen in /etc/firewall.user . By default this is locked down pretty tight, so I’ve had to add a rule allowing wireless traffic on our new interface out, as well as rules to let LAN traffic out to the unsecured wireless interface, without letting clients there back in.
## -- Allow wireless traffic out.
iptables -A forwarding_rule -i wl0.1 -d ! 10.17.17.0/24 -j ACCEPT
## -- Allow the LAN to talk to unsecured wireless clients, but not vice-versa
iptables -A forwarding_rule -o wl0.1 -s 10.17.17.0/24 -j ACCEPT
iptables -A forwarding_rule -i wl0.1 -m state --state RELATED,ESTABLISHED -j ACCEPT
DHCP setup
Kamikaze uses dnsmasq still. But rather than editing /etc/dnsmasq.conf , they expect you to do the configuration in /etc/config/dhcp . This lets you specify different parameters for each interface, which the OpenWRT startup scripts translate into commandline arguments to dnsmasq. So here’s what mine looks like:
config dhcp
option interface lan
option start 100
option limit 150
option leasetime 1h
config dhcp
option interface wan
option ignore 1
config dhcp
option interface wifi
option start 100
option limit 150
option leasetime 1h
After restarting dnsmasq, it’ll now start offering addresses in the appropriate range on the appropriate subnets.
And that’s about it. I’m not entirely sure at this point if the VLANs are actually set up properly. But everything seems to work the way it should. I now have to wireless interfaces, wl0 is bridged to the LAN interface, and wl0.1 has the wifi address assigned to it.