Gl-BE9300 : Guest isolated + main network AP

Router
1

How can the following setup be implemented together:

  • Guest wifi standard WiFi with router providing DHCP, DNS, IP subnet, and optionally choose if guests can see each other or are isolated
  • Main, not guest, wifi networks see router as an AP so they are on the same network as the LAN ports and they all get their DHCP and DNS directly from my network 10.1.1.1/16
  • Main wifi connected devices, and those on LAN ports, can get to the router’s admin console.

Thank you,

2

Hello all. May I request a response from the product support team?

Thank you.

3

Hi

In theory, this configuration should be possible through LuCI.

However, because traffic from the Guest network must pass through the Main LAN, devices on the Guest network would also be able to access the Main LAN. Is that the behavior you expect, or would you also like to prevent Guest devices from accessing the Main LAN?

4

I would like the guests to be on a subnet and DHCP/DNS serviced by the router and routed directly to my other router that goes out to the internet and get their DNS from my upstream DNS that is servicing the 9300.
I would like non-guests on the 9300 to “be on” my network same as if I plugged them into my router’s ethernet ports.

Thank you,

5

Hi

In this case, you can use the following network topology and configuration:

image
image798×264 4.84 KB

  1. Keep the BE9300 in Router Mode, assign its LAN interface a different IP address within the same subnet as your main router, and disable the DHCP server.

image
image1054×857 39.9 KB

  1. Connect the main router and the BE9300 using their LAN ports (LAN-to-LAN, not WAN-to-LAN).

  2. Access the BE9300 using its new LAN IP address, then go to Admin Panel → Network → DNS and configure a manual DNS server so that the router itself can resolve domain names correctly.

image
image1064×876 41.8 KB

  1. Go to LuCI → Network → Interfaces, edit the LAN interface, and set the main router's LAN IP address as the default gateway.

image
image1020×442 38 KB

image
image931×685 28 KB

  1. Go to LuCI → Network → Firewall, edit the LAN firewall zone, allow forwarding from the Guest network, and enable IP Masquerading for the Guest zone.

image
image1171×850 51.8 KB

image
image941×776 41.2 KB

image
image939×658 37.5 KB

After that, the setup should work as expected:

  • Devices connected to the Main LAN on the BE9300 will be on the same subnet as the main router, similar to Access Point (AP) mode.
  • Devices connected to the Guest network on the BE9300 will have normal Internet access.