For wireless, I am using Linksys MX8503 Atlas 6E, and it’s set to bridge mode and it’s connected to my network in which I can see the LAN IPs just fine. The AP also features enabling a Guest network. I turned it on, set a SSID and password and it’s broadcasting and working fine.
My LAN uses a 192.168.88.x
The AP for guest, it sets guest users to be on 192.168.3.x (It made up the address scheme itself when the Guest wireless was enabled)
At this point, here’s my question. With the traffic separated like that, how can I see the 192.168.3.x guest network leases. I am guessing it’s a Firewall rule that needs to be added to recognize the guest network, but that’s about as far as I got. I am hoping somebody can help steer me in the right direction as I didn’t want to mess anything up.
Anyway, here’s a copy of the firewall rules that I set following the first time configuration help I was following when I set this router up.
/ip firewall filter
add action=accept chain=input comment=“accept established,related”
connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment=“allow ICMP” in-interface=
“ether1 (Internet)” protocol=icmp
add action=accept chain=input comment=“allow Winbox” in-interface=
“ether1 (Internet)” port= protocol=tcp
add action=accept chain=input comment=“allow SSH” in-interface=
“ether1 (Internet)” port= protocol=tcp
add action=drop chain=input comment=“block everything else” in-interface=
“ether1 (Internet)”
add action=fasttrack-connection chain=forward comment=
“fast-track for established,related” connection-state=established,related
hw-offload=yes
add action=accept chain=forward comment=“accept established,related”
connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment=
“drop access to clients behind NAT from WAN” connection-nat-state=!dstnat
connection-state=new in-interface=“ether1 (Internet)”
/ip firewall nat
add action=masquerade chain=srcnat comment=
“Allows Local addresses to be routable over the Internet” out-interface=
“ether1 (Internet)”
Nope, the mikrotik has nothing to do with the internal shenanigans of the AP.
What it sounds like its doing is within the AP taking your 192.168.88.0 traffic and sort of splitting into both subnets.
What I dont know is if its taking an .88 address for each lease and then converting/giving it to .3 address and doing the translation.
OR
More likely it has some sort of internal own internal DHCP lease and thus no other leases from the MT are used.
I suppose you could watch the lease table on the MT, add a new user to the guest AP, and watch if any new leases are propogated on the MT.
I have my doubts.
The guest AP will only have access to the internet ( using the same access to the internet of the .88) but the wifi guests will not be able to view any of the wifi users on .88 or any LANs on the MT.
Usually one can invoke another setting on the guest AP so that the wifi users on .3, cannot see each other either.
You say you have bridged the linksys and have also implemented a working guest network. I have not looked up your specific device, but according to linksys here: https://www.linksys.com/gb/support-article/?articleNum=140727 your cannot do both. It looks like the Linksys is happily routing, and the RB5009 will see nothing of what happens there. I suggest you look up actual leases for wLAN devices and for guests on the Linksys itself. See what is really happening
Thanks for the replies. I guess it was worth asking. I joined my computer to the guest wireless and it gave me a 1 hour lease, so yeah it’s totally doing it’s own thing when I enabled the guest network. When I go back to my private network, it goes back to the IP scheme and lease I have configured in the Mikrotik.
My last question to all of this, is there a proposed setup that allows for managing both private and guest wireless using my RB5009? Is it just my Linksys APs or all proposed APs in this way of setting it up that prohibits this? Just curious as I am still learning, and helps me down the road for when I do future purchases/upgrades at home.
Thank you for your reply.
It most definitely has to be it’s own internal DHCP lease, and it’s own network it’s going off of internally in the unit that I have no way of seeing, changing or configuring in any way. It’s rather a simple button to turn guest wireless on or off, naming it and giving it a password.
I had already gone into my MT and looked at my leases to see if I saw any kind of new leases when I join the guest wireless, but nothing. Just only shows the 192.168.88.x only. Oh well, it was worth asking you all. Thanks again!
Concur its hard to find a home AP, mesh or not that handles vlans.
All brands be it tp link etc, have a business class AP that can handle vlan tags, but they dont come in a mesh variety.