WAX202 as an AP problem

Hello Simon,

---

Dnomis wrote:

I have a Billion BiPAC 8800AXL R2 as my main router.

I have 2 SSID subnets set up lets call them ABC and ABC-Guest

ABC uses 192.168.1.xxx and ABC-Guest uses 192.168.2.xxx allowing access to the Internet but not the local ports.

 

When I use the WAX202 in AP mode it doesn't heed the restrictions from the main router and allows access to all subnets. Is this because it connects to the main router via one of the Ethernet ports on the BiPAC?

This is because these two networks and two subnets by default only exist on your router Wireless side, not on the LAN where the AP can connect to by default.

Going a little bit  beyond of the Netgear community scope, your router only supports port based VLAN not tagged based VLAN.

So you can only isolate a port from the other ports. If you want to isolate your airports from the routers wifi/LAN ports, setup a 'Interface Grouping' and create a new group to isolate the port your Airport connects to as the WAN link

example below for isolating a guest wifi network

Example for a guest wifi network (it is the same for the LAN port isolation, just need to create a new rule)

1. Click on Interface Grouping
2. Click on 'Add'
3. Enter a 'Group Name' eg guest
4. Under 'Available LAN Interfaces' select your 'Guest Network' and click on the arrow pointing left, so the guest wifi network should now be added to 'Grouped LAN Interfaces'
5. Click on 'Apply'
6. Under 'Group Isolation' tick the box and click on 'Apply'
7. Click on 'LAN >> Ethernet'
8. Under 'Group Name' select your guest wifi group for this example I used 'guest'
9. Tick 'LAN Side Firewall' and click on 'Apply' (with this option enabled anyone connected to the guest wifi network, will not be able to access the routers web gui, they can only access the internet)

Said this: With a properly configured VLAN-capable switch - a simple Netgear Plus or Ethernet Easy Smart Managed Essentials Switch, you can configure an additional VLAN, define two LAN ports as access ports for each VLAN e.g. one for VLAN 1 [U]ntagged, PVID 1, one for VLAN 200 [U]ntagged, PVID 200 [and nothing else on these ports], then define a so called trunk port for the WAX as one for VLAN 1 [U]ntagged, PVID 1, plus VLAN 200 [T]agged [and nothing else on these ports]. Now configure the second ABC-Guest on the WAX associated to the VLAN 200.

That's all folks.