Change IP Guest Wifi

Have been following this interesting discussion and felt, "This calls for an experiment!"

Step 1.

Connected an RBR750 with firmware v4.6.14.3 (the latest) to my Orbi RBR50 in the default mode (Router).

Because of the IP address conflict, the RBR750 defined its LAN as 10.0.0.x

Enabled the RBR750 Guest WiFi.

Connected laptop to the RBR750 with Ethernet, and received IP address 10.0.0.2 (as expected)

Connected two devices to the RBR750 Guest WiFi and received 192.168.2.2 and 192.168.2.3.

This was a surprise (to me) because I had naively thought that since it was using 10.0.0.x for the primary LAN, that it would just "bump up" the third octet to something like 10.0.1.x or 10.0.2.x.  Oh well.  This behavior is consistent with the way the AX product creates a separate Guest LAN.

None of these devices are visible on the primary RBR50 because they are hidden behind the RBR750 NAT. (As they should be.)

Step 2.

Changed the RBR750 from Router mode to Access Point (AP) mode.

Because it is no longer in router mode, the primary LAN subnet (10.0.0.x) disappeared.  That laptop wired directly to the RBR750 received an IP address from the primary RBR50. (as was expected).  Because the laptop MAC address appears in the RBR50 LAN setup table, it received the IP address from the assignment table.

Those two devices connected to the RBR750 Guest WiFi did not change IP address.  They remain 192.168.2.2 and 192.168.2.3

Both devices on the RBR750 Guest WiFi continue to have internet access.

Neither of these two devices appear on the primary RBR50 Attached Devices display.  In addition to being "Guests", they are also Ghosts!  They do not exist!

How can a device that does not exist and has an IP address that is not in the RBR50 LAN access the internet???

Neither of these devices can be reached from the RBR50 LAN. (do not respond to ping)

Devices on this Guest network cannot see each other.

Oh.... There are now two entries on the RBR50 Attached Devices page for the RBR750 router:

• One for its address on the RBR50 LAN (happens to be 192.168.1.76).
  This is how that laptop wired to the RBR750 is able to communicate.
• Another is 192.168.2.1  Oh, my.  that is the gateway IP address for the RBR750 Guest WiFi.
  (Having only one RBR750, I can only speculate what happens if a second RBR750 router is connected to the primary RBR50 in AP mode.
  • Does it get another IP in the 192.168.2.x subnet?
  • Does it get an IP in a different subnet?
  • No Clue.
• In addition, the RBR750 AP/Router mode display is unusual:
  
  Notice that it does not mention the Guest WiFi SSID, even though two devices ARE connected to the Guest WiFi SSID.  Pulling up the Help information at the bottom of the screen claims that Guest WiFi is not available.  The RBR750 User Manual does  not mention what is "not available" when the device is in AP mode.

Conclusions:

• If the RBR750 is connected to any router other than a Netgear Orbi, there is going to be serious trouble.because packets from the RBR750 WAN port will appear to come from two different IP subnets.
  • Packets from devices connected to the primary network will appear to come from the IP subnet assigned by the upstream router.
  • Packets from devices connected to the RBR750 Guest WiFi will appear to come from IP address (not subnet) 192.168.2.x
  • Why doesn't this cause an ARP conflict?  i.e. one MAC address with two IP addresses?  Maybe because they are in different subnets so ARP broadcasts remain 'separate' somehow?
• An Orbi router can handle this because it has a static route enabled inside the router that says the primary IP subnet is in one direction and what we usually think of as the VPN connection is in another direction.  The RBR750 Guest WiFi subnet appears to be a (something like) a device connected through VPN which may have lots of other devices that it is using NAT to hide.  There can be more than one device connected through VPN (and possibly hiding many devices behind themselves with NAT).
• So, what can be done to the pfSense Firewall?
  • The existing 192.168.2.x network needs to be assigned to a different subnet (a huge chore).
  • There needs to be a new rule permitting 192.168.2.x access only to the internet and not to the primary networks.

All this could have been avoided if Netgear provided a method for users to define the IP subnet (and maybe the DHCP pool) being used for:

• Guest WiFi
• VPN Connections.  (Yes, there was a post from a user who wanted to connect his laptop to two different Orbi systems but could not because both systems assigned his laptop an IP address in (you guessed it) 192.168.2.x.  So the laptop no longer knows "where is?"  anything with a 192.168.2.x IP address.  VPN1 or VPN2?