How do I setup Guest networks?

Routers
1

Hello,

I'm trying to setup multiple Guest networks. This is a Flint GL-AX1800.

OpenWrt 21.02-SNAPSHOT r16399+165-c67509efd7

Kernel 4.4.60

I have tried to set one up, but it wont connect to the internet. I tried to get help on the OpenWRT forums, but they said they couldn't help because GL.INET modifies the firmware.

Is there a how-to guide you can refer me to, or some other direction you can provide?

Any help is appreciated!

2

The router comes with Guest WiFi.

If you want extra guest wifi, you need to copy the current config. You need some manual work in these three files.

/etc/config/network

Configure network zone of guest network.

/etc/config/wireless

Configure guest wifi ssid etc and bind to network zone

/etc/config/firewall

configure firewall and forward data from new guest zone to wan.

It should be quite straight forward if you check these files directly.

3

So I tried to create a guest WIFI network called "Guest1". It broadcasts, serves an IP, and I can connect to it, but it still doesn't connect to the internet. I have included the config files here, redacted of any personal data. Could someone please look them over, and tell me what I'm doing wrong?

 **ubus call system board**********************************************************************************************************************************************
{
        "kernel": "4.4.60",
        "hostname": "GL-AX1800",
        "system": "ARMv7 Processor rev 4 (v7l)",
        "model": "GL Technologies, Inc. AX1800",
        "board_name": "glinet,ax1800",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02-SNAPSHOT",
                "revision": "r16399+165-c67509efd7",
                "target": "ipq807x/ipq60xx",
                "description": "OpenWrt 21.02-SNAPSHOT r16399+165-c67509efd7",
                "tip-revision": "OpenWrt 21.02-SNAPSHOT r16399+165-c67509efd7 / TIP-devel-12b3c198",
                "tip-version": "devel"
        }
}


*cat /etc/config/network***********************************************************************************************************************************************

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd2f:7380:b714::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'eth2'
        list ports 'eth3'
        list ports 'eth4'

config device
        option name 'eth1'
        option macaddr '00:00:00:00:00:00'

config device
        option name 'eth2'
        option macaddr '00:00:00:00:00:00'

config device
        option name 'eth3'
        option macaddr '00:00:00:00:00:00'

config device
        option name 'eth4'
        option macaddr '00:00:00:00:00:00'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.8.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option isolate '0'
        list dns '192.168.8.1'

config device
        option name 'eth0'
        option macaddr '00:00:00:00:00:00'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option force_link '0'
        option ipv6 '0'
        option metric '10'

config interface 'wan6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@wan'

config switch
        option name 'switch0'
        option reset '0'
        option enable_vlan '0'

config interface 'tethering6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@tethering'

config interface 'wwan6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@wwan'

config interface 'guest'
        option force_link '1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.9.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option multicast_querier '1'
        option igmp_snooping '0'
        option isolate '0'
        option bridge_empty '1'
        option disabled '0'

config interface 'wwan'
        option proto 'dhcp'
        option metric '20'

config interface 'modem_1_1_2_6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@modem_1_1_2'

config rule 'policy_direct_rt'
        option lookup 'main'
        option suppress_prefixlength '0'
        option priority '1100'

config rule 'policy_default_rt_vpn'
        option mark '0x8000/0xc000'
        option lookup '8000'
        option priority '1101'
        option invert '1'

config rule6 'policy_direct_rt6'
        option lookup 'main'
        option suppress_prefixlength '0'
        option priority '1100'

config rule6 'policy_default_rt_vpn6'
        option mark '0x8000/0xc000'
        option lookup '8000'
        option priority '1101'
        option invert '1'

config rule 'policy_default_rt_vpn_ts'
        option lookup 'main'
        option priority '1099'
        option mark '0x80000/0xc0000'
        option invert '0'

config device
        option bridge_empty '1'
        option type 'bridge'
        option name 'Guest1'

config interface 'Guest1'
        option device 'Guest1'
        option proto 'static'
        option netmask '255.255.255.0'
        option broadcast '192.168.5.255'
        option ipaddr '192.168.5.1'
        option gateway '192.168.8.1'


**cat /etc/config/wireless*******************************************************************************************************************************************

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/c000000.wifi'
        option band '5g'
        option htmode 'HE80'
        option country 'US'
        option channel 'auto'
        option hwmode '11a'
        option cell_density '0'
        option channels '36,40,44,48'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option hidden '0'
        option ssid 'GL-AX1800-5.0Ghz'
        option key '<REDACTED>'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/c000000.wifi+1'
        option band '2g'
        option country 'US'
        option disabled '0'
        option channel 'auto'
        option htmode 'HE40'
        option legacy_rates '0'
        option hwmode '11g'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option ssid 'GL-AX1800-2.4'
        option hidden '0'
        option key '<REDACTED>'
        option disabled '1'

config wifi-iface 'guest2g'
        option device 'radio1'
        option network 'guest'
        option mode 'ap'
        option encryption 'psk2'
        option guest '1'
        option wds '1'
        option isolate '1'
        option hidden '0'
        option key '<REDACTED>'
        option ssid 'GL-AX1800-2.4Ghz-Guest'
        option disabled '0'

config wifi-iface 'wifinet3'
        option ssid 'Guest1'
        option encryption 'psk2'
        option device 'radio0'
        option mode 'ap'
        option network 'Guest1'
        option key '<REDACTED>'


**cat /etc/config/dhcp************************************************************************************************************************************************

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option rebind_protection '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option force '1'
        list ra_flags 'none'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config domain
        option name 'console.gl-inet.com'
        option ip '192.168.8.1'

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv6 'disabled'
        option ra 'disabled'

config domain
        option name 'console.gl-inet.com'
        option ip '::ffff:192.168.8.1'

config dhcp 'Guest1'
        option start '100'
        option leasetime '12h'
        option limit '150'
        option interface 'Guest1'
        list ra_flags 'none'

**cat /etc/config/firewall*******************************************************************************************************************************************

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        option input 'DROP'
        option masq '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config include 'nat6'
        option path '/etc/firewall.nat6'
        option reload '1'

config rule 'process_mark'
        option name 'process_mark'
        option dest '*'
        option proto 'all'
        option extra '-m owner --gid-owner 65533'
        option target 'MARK'
        option set_xmark '0x8000/0xc000'

config rule 'wan_in_conn_mark'
        option name 'wan_in_conn_mark'
        option src 'wan'
        option dest '*'
        option target 'MARK'
        option enabled '0'
        option set_xmark '0x8000/0xc000'
        option extra '-j CONNMARK --set-xmark 0x8000/0xc000'

config rule 'lan_in_conn_mark_restore'
        option name 'lan_in_conn_mark_restore'
        option src 'lan'
        option dest '*'
        option target 'MARK'
        option enabled '0'
        option set_xmark '0x8000/0xc000'
        option extra '-m connmark --mark 0x8000/0xc000 -j CONNMARK --restore-mark'

config rule 'out_conn_mark_restore'
        option name 'out_conn_mark_restore'
        option dest '*'
        option target 'MARK'
        option enabled '0'
        option set_xmark '0x8000/0xc000'
        option extra '-m connmark --mark 0x8000/0xc000 -j CONNMARK --restore-mark'

config include 'swap_wan_in_conn_mark'
        option type 'script'
        option reload '1'
        option enabled '0'
        option path '/etc/firewall.swap_wan_in_conn_mark.sh'

config rule 'block_dns'
        option name 'block_dns'
        option src '*'
        option device 'br-+'
        option dest_port '53'
        option target 'REJECT'
        option enabled '0'

config zone
        option name 'guest'
        option forward 'REJECT'
        option output 'ACCEPT'
        option input 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option name 'Allow-DHCP'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '67-68'

config rule
        option name 'Allow-DNS'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53'

config include 'vpn_server_policy'
        option type 'script'
        option path '/etc/firewall.vpn_server_policy.sh'
        option reload '1'
        option enabled '1'

config rule 'sambasharewan'
        option src 'wan'
        option dest_port '137 138 139 445'
        option dest_proto 'tcpudp'
        option target 'DROP'

config rule 'sambasharelan'
        option src 'lan'
        option dest_port '137 138 139 445'
        option dest_proto 'tcpudp'
        option target 'ACCEPT'

config rule 'glnas_ser'
        option src 'wan'
        option dest_port '6000-6002'
        option dest_proto 'tcp'
        option target 'DROP'

config rule 'webdav_wan'
        option src 'wan'
        option dest_port '6008'
        option dest_proto 'tcp'
        option target 'DROP'

config include 'gls2s'
        option type 'script'
        option path '/var/etc/gls2s.include'
        option reload '1'

config include 'glblock'
        option type 'script'
        option path '/usr/bin/gl_block.sh'
        option reload '1'

config zone
        option name 'Guest1'
        option forward 'REJECT'
        list network 'Guest1'
        option output 'ACCEPT'
        option input 'REJECT'

config forwarding
        option dest 'lan'
        option src 'Guest1'

config rule
        option dest_port '67-68'
        option src 'Guest1'
        option name 'Guest1_DHCP'
        option target 'ACCEPT'
        list proto 'udp'

config rule
        option dest_port '53'
        option src 'Guest1'
        option name 'Guest1_DNS'
        option target 'ACCEPT'

config rule
        option src 'Guest1'
        option name 'Block_Guest1_from_LAN'
        option dest 'lan'
        list dest_ip '192.168.8.1/24'
        option target 'REJECT'
        list proto 'all'
4

Really, is there no one that can help?

5

Need to have firewall rules like this.

Also in network files you should just clone the settings of the guest network. Don’t manipulate the settings.

6

alzhao,

Thank you for the reply.

After saving the changes to the config files, which one of these should I run:?

uci commit network
/etc/init.d/network reload

7

Run uci commit, should be enough and will set all configs.

8

It is firewall. If you modify in luci, it will restart automatically.

To manually restart

/etc/init.d/firewall restart
9

Ok, so I tried to setup a new WIFI guest network called "Guest1" by copying the existing guest network into the config files. For some reason it disables the existing WIFI network. Not sure why.
The only thing I changed was the SSID and the network IP/Range, because I want it to be a separate network.
Can someone please have a look at my config files. I would really appreciate it.

cat /etc/config/network***************************************************************************************************

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd2f:7380:b714::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'eth2'
        list ports 'eth3'
        list ports 'eth4'

config device
        option name 'eth1'
        option macaddr '<REDACTED>

config device
        option name 'eth2'
        option macaddr '<REDACTED>

config device
        option name 'eth3'
        option macaddr '<REDACTED>

config device
        option name 'eth4'
        option macaddr '<REDACTED>

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.8.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option isolate '0'
        list dns '192.168.8.1'

config interface 'Guest1'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option isolate '0'
        list dns '192.168.5.1'

config device
        option name 'eth0'
        option macaddr '94:83:c4:3e:68:6c'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option force_link '0'
        option ipv6 '0'
        option metric '10'

config interface 'wan6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@wan'

config switch
        option name 'switch0'
        option reset '0'
        option enable_vlan '0'

config interface 'tethering6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@tethering'

config interface 'wwan6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@wwan'

config interface 'guest'
        option force_link '1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.9.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option multicast_querier '1'
        option igmp_snooping '0'
        option isolate '0'
        option bridge_empty '1'
        option disabled '0'

config interface 'wwan'
        option proto 'dhcp'
        option metric '20'

config interface 'modem_1_1_2_6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@modem_1_1_2'

config rule 'policy_direct_rt'
        option lookup 'main'
        option suppress_prefixlength '0'
        option priority '1100'

config rule 'policy_default_rt_vpn'
        option mark '0x8000/0xc000'
        option lookup '8000'
        option priority '1101'
        option invert '1'

config rule6 'policy_direct_rt6'
        option lookup 'main'
        option suppress_prefixlength '0'
        option priority '1100'

config rule6 'policy_default_rt_vpn6'
        option mark '0x8000/0xc000'
        option lookup '8000'
        option priority '1101'
        option invert '1'

config rule 'policy_default_rt_vpn_ts'
        option lookup 'main'
        option priority '1099'
        option mark '0x80000/0xc0000'
        option invert '0'

cat /etc/config/wireless***************************************************************************************************

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/c000000.wifi'
        option band '5g'
        option htmode 'HE80'
        option country 'US'
        option channel 'auto'
        option hwmode '11a'
        option cell_density '0'
        option channels '36,40,44,48'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option hidden '0'
        option ssid 'GL-AX1800-5.0Ghz'
        option key '<REDACTED>'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/c000000.wifi+1'
        option band '2g'
        option country 'US'
        option disabled '0'
        option channel 'auto'
        option htmode 'HE40'
        option legacy_rates '0'
        option hwmode '11g'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option ssid 'GL-AX1800-2.4'
        option hidden '0'
        option key '<REDACTED>'
        option disabled '1'

config wifi-iface 'guest2g'
        option device 'radio1'
        option network 'guest'
        option mode 'ap'
        option encryption 'psk2'
        option guest '1'
        option wds '1'
        option isolate '1'
        option hidden '0'
        option key '<REDACTED>'
        option ssid 'GL-AX1800-2.4Ghz-Guest'
        option disabled '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'Guest1'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option hidden '0'
        option ssid 'Guest1'
        option key '<REDACTED>'
10

You should copy the EXACT config (just modify the subnet) of "guest" config of these files

/etc/config/network
/etc/config/wireless
/etc/config/firewall

At least the "network" file config is not copied exactly and I don't see "firewall" config.

11

So I copied the exact config of network, wireless, and firewall. All I changed was the IP.

The new wireless guest network is visible and I can connect to it. It also connects to the internet. But the old one is now gone.

Could this be because the name wasn't changed? I did an exact copy, only changing the IP. They are both named "GL-AX1800-2.4Ghz-Guest".

The "network" & "firewall" are also exact copies with no name change.

Please have a look at my config files and advise.

cat /etc/config/network***********************************************************************************


config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd2f:7380:b714::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'
        list ports 'eth2'
        list ports 'eth3'
        list ports 'eth4'

config device
        option name 'eth1'
        option macaddr '<REDACTED>'

config device
        option name 'eth2'
        option macaddr '<REDACTED>'

config device
        option name 'eth3'
        option macaddr '<REDACTED>'

config device
        option name 'eth4'
        option macaddr '<REDACTED>'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.8.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option isolate '0'
        list dns '192.168.8.1'

config device
        option name 'eth0'
        option macaddr '<REDACTED>'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option force_link '0'
        option ipv6 '0'
        option metric '10'

config interface 'wan6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@wan'

config switch
        option name 'switch0'
        option reset '0'
        option enable_vlan '0'

config interface 'tethering6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@tethering'

config interface 'wwan6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@wwan'

config interface 'guest'
        option force_link '1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.9.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option multicast_querier '1'
        option igmp_snooping '0'
        option isolate '0'
        option bridge_empty '1'
        option disabled '0'

config interface 'guest'
        option force_link '1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.5.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option multicast_querier '1'
        option igmp_snooping '0'
        option isolate '0'
        option bridge_empty '1'
        option disabled '0'

config interface 'wwan'
        option proto 'dhcp'
        option metric '20'

config interface 'modem_1_1_2_6'
        option proto 'dhcpv6'
        option disabled '1'
        option device '@modem_1_1_2'

config rule 'policy_direct_rt'
        option lookup 'main'
        option suppress_prefixlength '0'
        option priority '1100'

config rule 'policy_default_rt_vpn'
        option mark '0x8000/0xc000'
        option lookup '8000'
        option priority '1101'
        option invert '1'

config rule6 'policy_direct_rt6'
        option lookup 'main'
        option suppress_prefixlength '0'
        option priority '1100'

config rule6 'policy_default_rt_vpn6'
        option mark '0x8000/0xc000'
        option lookup '8000'
        option priority '1101'
        option invert '1'

config rule 'policy_default_rt_vpn_ts'
        option lookup 'main'
        option priority '1099'
        option mark '0x80000/0xc0000'
        option invert '0'

cat /etc/config/wireless*****************************************************************************************

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/c000000.wifi'
        option band '5g'
        option htmode 'HE80'
        option country 'US'
        option channel 'auto'
        option hwmode '11a'
        option cell_density '0'
        option channels '36,40,44,48'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option hidden '0'
        option ssid 'GL-AX1800-5.0Ghz'
        option key '<REDACTED>'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/c000000.wifi+1'
        option band '2g'
        option country 'US'
        option disabled '0'
        option channel 'auto'
        option htmode 'HE40'
        option legacy_rates '0'
        option hwmode '11g'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option encryption 'psk2'
        option wds '1'
        option isolate '0'
        option ssid 'GL-AX1800-2.4'
        option hidden '0'
        option key '<REDACTED>'
        option disabled '1'

config wifi-iface 'guest2g'
        option device 'radio1'
        option network 'guest'
        option mode 'ap'
        option encryption 'psk2'
        option guest '1'
        option wds '1'
        option isolate '1'
        option hidden '0'
        option key '<REDACTED>'
        option ssid 'GL-AX1800-2.4Ghz-Guest'
        option disabled '0'

config wifi-iface 'guest2g'
        option device 'radio1'
        option network 'guest'
        option mode 'ap'
        option encryption 'psk2'
        option guest '1'
        option wds '1'
        option isolate '1'
        option hidden '0'
        option key '<REDACTED>'
        option ssid 'GL-AX1800-2.4Ghz-Guest'
        option disabled '0'

cat /etc/config/firewall************************************************************************************

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        list network 'lan'

config zone
        option name 'wan'
        option output 'ACCEPT'
        option forward 'REJECT'
        option mtu_fix '1'
        option input 'DROP'
        option masq '1'
        list network 'wan'
        list network 'wan6'
        list network 'wwan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config rule
        option name 'Support-UDP-Traceroute'
        option src 'wan'
        option dest_port '33434:33689'
        option proto 'udp'
        option family 'ipv4'
        option target 'REJECT'
        option enabled '0'

config include
        option path '/etc/firewall.user'

config include 'nat6'
        option path '/etc/firewall.nat6'
        option reload '1'

config rule 'process_mark'
        option name 'process_mark'
        option dest '*'
        option proto 'all'
        option extra '-m owner --gid-owner 65533'
        option target 'MARK'
        option set_xmark '0x8000/0xc000'

config rule 'wan_in_conn_mark'
        option name 'wan_in_conn_mark'
        option src 'wan'
        option dest '*'
        option target 'MARK'
        option enabled '0'
        option set_xmark '0x8000/0xc000'
        option extra '-j CONNMARK --set-xmark 0x8000/0xc000'

config rule 'lan_in_conn_mark_restore'
        option name 'lan_in_conn_mark_restore'
        option src 'lan'
        option dest '*'
        option target 'MARK'
        option enabled '0'
        option set_xmark '0x8000/0xc000'
        option extra '-m connmark --mark 0x8000/0xc000 -j CONNMARK --restore-mark'

config rule 'out_conn_mark_restore'
        option name 'out_conn_mark_restore'
        option dest '*'
        option target 'MARK'
        option enabled '0'
        option set_xmark '0x8000/0xc000'
        option extra '-m connmark --mark 0x8000/0xc000 -j CONNMARK --restore-mark'

config include 'swap_wan_in_conn_mark'
        option type 'script'
        option reload '1'
        option enabled '0'
        option path '/etc/firewall.swap_wan_in_conn_mark.sh'

config rule 'block_dns'
        option name 'block_dns'
        option src '*'
        option device 'br-+'
        option dest_port '53'
        option target 'REJECT'
        option enabled '0'

config zone
        option name 'guest'
        option forward 'REJECT'
        option output 'ACCEPT'
        option input 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option name 'Allow-DHCP'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '67-68'

config rule
        option name 'Allow-DNS'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53'

config include 'vpn_server_policy'
        option type 'script'
        option path '/etc/firewall.vpn_server_policy.sh'
        option reload '1'
        option enabled '1'

config rule 'sambasharewan'
        option src 'wan'
        option dest_port '137 138 139 445'
        option dest_proto 'tcpudp'
        option target 'DROP'

config rule 'sambasharelan'
        option src 'lan'
        option dest_port '137 138 139 445'
        option dest_proto 'tcpudp'
        option target 'ACCEPT'

config rule 'glnas_ser'
        option src 'wan'
        option dest_port '6000-6002'
        option dest_proto 'tcp'
        option target 'DROP'

config rule 'webdav_wan'
        option src 'wan'
        option dest_port '6008'
        option dest_proto 'tcp'
        option target 'DROP'

config include 'gls2s'
        option type 'script'
        option path '/var/etc/gls2s.include'
        option reload '1'

config include 'glblock'
        option type 'script'
        option path '/usr/bin/gl_block.sh'
        option reload '1'

config zone
        option name 'guest'
        option forward 'REJECT'
        option output 'ACCEPT'
        option input 'REJECT'
        list network 'guest'

config forwarding
        option src 'guest'
        option dest 'wan'

config rule
        option name 'Allow-DHCP'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'udp'
        option dest_port '67-68'

config rule
        option name 'Allow-DNS'
        option src 'guest'
        option target 'ACCEPT'
        option proto 'tcp udp'
        option dest_port '53'
12

There is a misunderstanding.

"Copy exactly" means copy the guest setion and rename it appropriately, like what you do with the IP.

The following images show part of the modification. You just search "guest", copy the section and rename it as "guest1"

image
image1113×667 14.6 KB

image
image1115×662 15.6 KB

image
image1059×634 13.3 KB