Use case
I use Policy Mode to run two NordVPN tunnels simultaneously with different countries, bound to different networks… main network exits in the US, guest network exits in Japan. This works well and was noticeably easier to set up than the equivalent on my ASUS travel router.
The limit I’ve run into is that there are only three fixed network slots: Main, Guest, and IoT. Two are now committed to VPN exits, which leaves one. I’d like a third exit country, plus a no-VPN passthrough network for sites that reject VPN address ranges (common with Japanese payment and government sites).
Request
Allow users to create additional networks beyond the three fixed slots, each selectable as a source in Policy Mode.
Why this seems achievable
The VPN side already supports this — Policy Mode matches on connection type, and v4.8 rebuilt the VPN subsystem for multiple simultaneous tunnels. The constraint is on the wireless/network side, where the three slots are fixed. Generalising those into N user-defined networks would let the existing Policy Mode capability be used fully.
I’m aware this is possible via LuCI, but networks created there aren’t visible to the GL.iNet UI, so they can’t be used as Policy Mode sources — which is the part that matters.
Related
This overlaps with the existing request for per-network ACL policies across Primary/Guest/IoT — both point at the same underlying limitation of a fixed three-network model.
Thanks for the work on v4.8/v4.9 — the NordVPN access token integration in particular is a big improvement over manual config handling.
Thanks for the pointer — that Subnet page is exactly the direction I was hoping for. Custom VLAN networks with their own gateway, DHCP, AP isolation and WAN access control per subnet would solve the three-slot ceiling entirely.
One thing I noticed: the page documents creating the subnets but doesn't mention the VPN side at all. My use case depends on being able to select a new subnet as a source in VPN Policy Mode, the way Guest Network can be selected today. If that plumbing isn't there, extra subnets don't help me. Does anyone know whether VLAN networks created on the Subnet page appear as selectable sources in Policy Mode?
On your Blink issue — I think the same feature helps you, for a slightly different reason. Your problem is that AP Isolation has to be OFF so the camera can reach its sync module, but you presumably still want the cameras separated from your main network. Those are two different isolation mechanisms that currently get conflated: AP Isolation controls whether devices on the same network can see each other, while subnet separation controls whether they can see the other networks. Right now you're forced to choose.
With custom subnets you could put a dedicated camera subnet in place, leave AP Isolation off inside it so the camera and sync module talk normally, and rely on it being its own subnet to keep it away from your main LAN. Best of both, rather than trading one against the other.
Good to know 4.10 is where this lands. Not before my trip, but worth waiting for.
A custom network can be used as a separate source in VPN Policy Mode and assigned to a different VPN tunnel.
For the current v4.9.x firmware on Slate 7 (GL-BE3600), you can also create an additional Wi-Fi network manually.
The following example creates a new independent network named customvpn , with both a 2.4 GHz and 5 GHz SSID, and makes this network available as a source in VPN Policy Mode.
Before applying the configuration, please first make sure wifi2g2 , wifi5g2 , wlan05 , and wlan15 are not already being used:
uci show wireless | grep -E "wifi2g2|wifi5g2|wlan05|wlan15"
If there is no output, you can use the following configuration. Please replace YOUR_WIFI_PASSWORD with your preferred Wi-Fi password.
# Create the custom network
uci set network.br_customvpn='device'
uci set network.br_customvpn.type='bridge'
uci set network.br_customvpn.name='br-customvpn'
uci set network.customvpn='interface'
uci set network.customvpn.proto='static'
uci set network.customvpn.device='br-customvpn'
uci set network.customvpn.ipaddr='192.168.20.1'
uci set network.customvpn.netmask='255.255.255.0'
# DHCP server
uci set dhcp.customvpn='dhcp'
uci set dhcp.customvpn.interface='customvpn'
uci set dhcp.customvpn.start='100'
uci set dhcp.customvpn.limit='150'
uci set dhcp.customvpn.leasetime='12h'
# Firewall zone
uci set firewall.customvpn='zone'
uci set firewall.customvpn.name='customvpn'
uci set firewall.customvpn.input='REJECT'
uci set firewall.customvpn.output='ACCEPT'
uci set firewall.customvpn.forward='REJECT'
uci add_list firewall.customvpn.network='customvpn'
# Allow the custom network to access WAN
uci set firewall.customvpn_wan='forwarding'
uci set firewall.customvpn_wan.src='customvpn'
uci set firewall.customvpn_wan.dest='wan'
# Allow DHCP
uci set firewall.customvpn_dhcp='rule'
uci set firewall.customvpn_dhcp.name='Allow-CustomVPN-DHCP'
uci set firewall.customvpn_dhcp.src='customvpn'
uci set firewall.customvpn_dhcp.proto='udp'
uci set firewall.customvpn_dhcp.dest_port='67-68'
uci set firewall.customvpn_dhcp.target='ACCEPT'
# Allow DNS
uci set firewall.customvpn_dns='rule'
uci set firewall.customvpn_dns.name='Allow-CustomVPN-DNS'
uci set firewall.customvpn_dns.src='customvpn'
uci add_list firewall.customvpn_dns.proto='tcp'
uci add_list firewall.customvpn_dns.proto='udp'
uci set firewall.customvpn_dns.dest_port='53'
uci set firewall.customvpn_dns.target='ACCEPT'
# Create an additional 5 GHz SSID
uci set wireless.wifi5g2='wifi-iface'
uci set wireless.wifi5g2.device='wifi1'
uci set wireless.wifi5g2.network='customvpn'
uci set wireless.wifi5g2.mode='ap'
uci set wireless.wifi5g2.ssid='Custom-VPN-5G'
uci set wireless.wifi5g2.encryption='psk2+ccmp'
uci set wireless.wifi5g2.key='YOUR_WIFI_PASSWORD'
uci set wireless.wifi5g2.wds='1'
uci set wireless.wifi5g2.isolate='0'
uci set wireless.wifi5g2.hidden='0'
uci set wireless.wifi5g2.ifname='wlan15'
uci set wireless.wifi5g2.ieee80211k='1'
uci set wireless.wifi5g2.bss_transition='1'
uci set wireless.wifi5g2.sae='0'
uci set wireless.wifi5g2.disabled='0'
# Create an additional 2.4 GHz SSID
uci set wireless.wifi2g2='wifi-iface'
uci set wireless.wifi2g2.device='wifi0'
uci set wireless.wifi2g2.network='customvpn'
uci set wireless.wifi2g2.mode='ap'
uci set wireless.wifi2g2.ssid='Custom-VPN-2.4G'
uci set wireless.wifi2g2.encryption='psk2+ccmp'
uci set wireless.wifi2g2.key='YOUR_WIFI_PASSWORD'
uci set wireless.wifi2g2.wds='1'
uci set wireless.wifi2g2.isolate='0'
uci set wireless.wifi2g2.hidden='0'
uci set wireless.wifi2g2.ifname='wlan05'
uci set wireless.wifi2g2.ieee80211k='1'
uci set wireless.wifi2g2.bss_transition='1'
uci set wireless.wifi2g2.sae='0'
uci set wireless.wifi2g2.disabled='0'
# Add the custom network as a VPN Policy source
uci add_list route_policy.global.append_source_if='customvpn'
# Save the configuration
uci commit network
uci commit dhcp
uci commit firewall
uci commit wireless
uci commit route_policy
reboot
This configuration creates an independent 192.168.20.0/24 network, with the router using 192.168.20.1 as its gateway and DHCP server. Both Custom-VPN-2.4G and Custom-VPN-5G are attached to the same customvpn network, so devices connected to either SSID will receive a 192.168.20.x address.
After the router reboots, go to: VPN Dashboard → Add/Edit Tunnel → From → Specified Connection Types
Hi Charles, thank you, this is a genuinely thorough answer.
I’m taking a trip next week to Japan for about 3 weeks with a working config, so I’ll hold off on running this until I’m back rather than rebuilding my networks now. But it’s exactly what I needed.
One follow-up: when the Subnet page arrives on the Slate 7 in v4.10, will networks created there appear as Policy Mode sources automatically, without the CLI step?
Based on the current implementation of the Subnet feature, a custom network created from the Subnet page will automatically appear under VPN Dashboard → Policy Mode → Specified Connection Types .
One thing to note is that if you want to create an additional custom Wi-Fi SSID for that subnet, some extra configuration may still be required to create the Wi-Fi interface and bind it to the newly created subnet.
Thank you for your feedback and support. Have a great holiday!
Thanks, Charles — that fully answers it, and it’s great to hear the Subnet-to-Policy-Mode connection is automatic.
No rush at all, but since you mentioned the Wi-Fi SSID binding may need extra configuration: is exposing that in the GUI as well on the roadmap, or is manual binding likely to remain the way to do it? Just trying to understand the state of it for when I build this out after my trip.
subnet kinda feels half misleading as navigation, it is half true, yes subnetting is used to create another network as a part, but I think nobody uses subnetting the netmask directly to create different parts of a single existing network (with heavily cisco terminologies), most people just go with 255.255.255.0, the software might not even work well with it taken literal (danger of network ip conflicts, software routing problems)
But... It sounds logically more sensible if they name it interfaces or networks, network management to name a few, in luci it is also named interfaces.
If subnetting is taken literal, you can divide the subnet mask, and share a network in isolated portions, although I know nobody who does that, on the OpenWrt forums ive been asking this aswell when I first time joined them and basically people told me to be easy.
Theres quite some videos on youtube which explain subnetting but that is not what this features core is about
At this stage, creating and binding an additional custom Wi-Fi SSID is not available in the GL.iNet Admin Panel. You will need to use LuCI to create the new Wi-Fi SSID and bind it to the newly created subnet.
When it is bound, devices connected to that SSID will join the corresponding subnet and use its network settings and policies.
You can think of a subnet as a separate network created within your router. It can have its own IP address range, DHCP settings, and access rules, allowing you to separate certain devices from your main network.
In v4.10, the Subnet feature is intended to make it easier to create and manage additional networks beyond the default Main, Guest, and IoT networks.
You can refer to our documentation to learn more about how this feature works:
At present, the GL.iNet Admin Panel does not provide an option to create and bind additional custom Wi-Fi SSIDs.
Since VAP support and implementation can vary between different device models and wireless platforms, this type of configuration is currently handled through the underlying OpenWrt interface instead.
For now, additional custom Wi-Fi SSIDs can be created and configured through LuCI or the command line.
Regarding the Guest and IoT networks, they are separate networks/subnets from the main LAN and have their own network and firewall configuration.
