HOWTO: Setting up a 2 router network with "Secure Guest Network"?

[scarleton]

I am looking to improve the network in my small church. Our space is setup such that we need 2 access points to get complete coverage. (Have to love think walls.) There is already one network cable running from one end to the other.

My goal is to setup two dd-wrt (WWW dd-wrt.com) routers. I am considering the Buffalo WZR-HP-G450H. The main unit will be located in the office with the cable modem and configured as the main access point. The other as just an access point and switch.

The catch is that I want both access points to implement the whole "Secure Guest Network". How do I go about doing that exactly?

Sam

P.S. My background: I am a software developer and have been an amateur network admin for over 15 years.

[petereit]

Have you considered a single Apple Airport Extreme? It has dual security zones built in -- one for secure office access and one you can open to the public. We have found that its dual-band implementation (2.4GHz and 5GHz bands) does a great job of blowing through thick walls.

And it doesn't matter if you're all-Mac, all-PC or any combination. It just works. We upgraded to the Airport Extreme when Apple first introduced it. I don't think anyone has had to touch it since it was installed.

[theeggman]

Check out the "Multiple_WLANs" page on the DD-WRT wiki, I found it to be helpful when doing this myself. I had to do a few things differently due to not running DHCP on the main SSID, the "Separate LAN and WLAN" page on the wiki has the neccesary commands (with a little modification) to seperate the two virtual access points and provide DHCP on the guest network. I'm just running the guest network through to the internet and using OpenDNS for a filter.

[Gracetech]

You are either going to have to setup VLans or separate Physical Lans. Either way you will need to invest in new gear. That is unless you have a layer 2 switch lying around or enough extra hardware to make a completely separate network.

If your not really concerned about security you could always run your private network on Static IPs in a different range and DHCP for everyone else.

The real fun comes when you need everything to hit a gateway. I use an Untangle Server to be the gateways for all of our networks. I have 5 nics in that server and they are all used. One external and 3 internal and 1 DMZ.

BTW using a AP with VLan tagging is the only true way to secure your networks from one another

crt

[avtechie247]

Something simple you might be able to do without buying much extra equipment is add a second router to an existing switchport (assuming you have a router/4port switch combo).
make sure you go in and change your management IP's and set up your guest access how you'd like it on one router. then do the same on the other router making sure the IP's don't conflict.
then all you would need to do is trim down the DHCP Pool associated with each router (where one router would DHCP .2 - .25 and the other use .26 - .50 for DHCP)
its not ideal, but if you have a small church and small network its easy to impliment, inexpensive and easy to troubleshoot.

[EricE]

Skip the consumer gear and track down a three pack of the Ubiquiti Networks Unifi access points. My review: Looking for a great wifi solution that won't cost a fortune?

You'll be seriously happy you did! And yes, I know it will seem WAY too good to be true. It's not! The software and hardware works as advertised - very well!

This is the best thing for Church's that need wifi that I have seen - and i have been looking on and off for over three years!