Setting Up Guest WiFi with Unifi Access Points and GL.iNet Gateway: Need Guidance!

[ASchneiderBR]

Hello to the community,

I’ve recently made a transition from the Unifi gateway system as it was becoming a bit intricate for my home network setup. Instead, I opted to use devices from GL.iNet as my gateway and DHCP server. I still intend to keep the Ubiquiti wireless access points, as I’ve been quite satisfied with their performance.

Good news is, I managed to set everything up correctly. All my devices are connecting back to the network and functioning as expected since I retained the same local IP range, static IPs, and firewall rules from my previous Unifi gateway.

Now, the challenge I’m facing is setting up the guest WiFi network. I always had a guest network setup, and I would like to integrate it with the guest network existing on the new GL.iNet gateway. I observed that within the Unifi controller settings, I can configure the guest WiFi to use a VLAN from a third-party gateway. However, I’m having a hard time understanding and successfully setting up the VLAN and guest network in the advanced settings of the GL.iNet gateway. From what I can see, there are two VLANs listed – VLAN 1 and VLAN 2. I tried adding VLAN 2 to the Unifi controller, but the devices are not getting IP addresses when connected. There is already a guest network from the OPAL (192.168.9.0/24), since I’m using it temporarily until my Brume 2 arrives.

Gl.iNet:

Unifi:

Could someone kindly provide guidance on how I can set up the guest network using the Unifi access point system? Any help would be greatly appreciated. Thank you in advance!

[ASchneiderBR]

Hello again.

Giving it another try and changed those settings, still no luck:

Any ideas?

Thanks!

[alzhao]

Setting up vlan on cheap SFT1200 as your main gateway may be too much for the small router. I will ask engineers to have a check.

[ASchneiderBR]

Hello @alzhao, thanks for the reply. I’m now using a Brume 2 as main gateway, but this applies to it as well. The problem is that it doesn’t have a guest network on the native Gl-iNet UI, but I believe it can be done using the advanced UI. Can you please help me out? Thanks.

[alzhao]

So just need to make a separate vlan, which is assigned a physical port and different subnet from the private WiFi, right?

[ASchneiderBR]

Yes, I believe so! I need to isolate connected clientes as well, so they don’t see each other while connected to this guest network. The idea is to set the VLAN network from the Unifi AP to the same guest vlan so the AP can access its DHCP and connect as Guest. Thanks.

[dxf]

Creating an independent physical port (eth0.3) using VLAN.

note: If Unifi’s vlan uses tagged, then eth0.3 (LAN1) is also required; If Unifi is untagged, then eth0.3(LAN1) is also untagged.

Setting the guest interface as a bridge, and adding eth0.3(physical port), wlan2(guest 2.4g), and wlan3(guest 5g) to the guest bridge.

Now your Unifi AP can connect to OPAL via the physical port (eth0.3)

[ASchneiderBR]

Hello, thanks for information!

Sorry if wasn’t clear: what I need is to create a Guest network for the Brume 2 (GL-MT2500) since I’m now using it for the main gateway. I was using the Opal until my Brume 2 arrives, and now I had fully switched to it.

The problem is I cannot find the switch feature in the Brume 2:

Is there a way to set a Guest network for it and have my Unifi send its Guests when connected to its Guest SSID, using VLAN?

An isolated Guest network is a must for a gateway to do it, very important feature.

Thank you!

[dxf]

MT2500 doesn’t have a SWITCH, it only has two PHYs.

Creating a 802.1q VLAN, VLAN id is 12 in this example.

Creating a interfaces for subnet 192.168.9.x

Creating a firewall rule, guest accept output, reject input and forward, and accept dhcp and dns

Now you can get a guest subnet 192.168.9.x from LAN(eth1.12 vlan id is 12).

[ASchneiderBR]

Wow! Thank you so much, it worked like a charm! Really appreciate it.

I’m really happy that I’ve changed my gateway from Unifi to your solution, such an amazing HW and great opensource SW, just loving it!

The only detail that I still need to figure out: how to set the guest network so all clientes connected to it are isolated, so they can’t see each other from inside de LAN, locally.

Thank you again for your support.

[dxf]

In the mt2500, guest is already unable to access lan, and you need to set AP isolation in Unifi so clients can’t access each other

[ASchneiderBR]

Hello @dxf. Sorry to ask: everything is running fine here on my guest network, the only problem is that all clients connected to the guest network, using my Unifi AP, receive very slow internet speeds:

This problem doesn’t happen if I disable Network Acceleration, I get maximum bandwidth but it boggles my CPU usage.

Any ideas?

Thanks!

[ASchneiderBR]

Hello @dxf, sorry to bother you.

I've started this thread: https://forum.gl-inet.com/t/home-assistant-not-accessible-over-public-url-when-connected-to-wireguard-vpn-server/ and believe it has direct relation to this one, since this problem also happens when I connect to my Guest VLAN network.

What happens is that I'm unable to connect to my Home Assistant instance using the public URL when connected to the Guest/VPN network, I believe this has something to do with a firewall rule or something like that.

My HA is publicly accessible over a HTTPS URL that goes through my NGINX server.

Any ideas?

Thank you vey much.

[dxf]

pls try the following command:

uci set firewall.guest2wgserver=forwarding
uci set firewall.guest2wgserver.src='guest'
uci set firewall.guest2wgserver.dest='wgserver'
uci set firewall.guest2wgserver.enabled='1'
uci set firewall.wgserver2guest=forwarding
uci set firewall.wgserver2guest.src='wgserver'
uci set firewall.wgserver2guest.dest='guest'
uci set firewall.wgserver2guest.enabled='1'
uci commit firewall
/etc/init.d/firewall restart