NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
R7450 AP Mode Stop Guest access LAN
I am new to AP Mode
I have a R7450 router and have placed it into AP mode.
I connected the WAN RJ45 to a LAN RJ45 on another Netgear Router (This is the one that is in normal router mode that actually has a connection to the internet) I will call this the "Master router"
The Master router is a R6350 and is configured as follows:
WAN RJ45 is connected to the ISP gateway
LAN RJ45 has a wired uplink to the R7450 (the one in AP mode)
The Guest Network WiFi is enabled and I don't allow guest devices to see each other or access my local network
The Slave router (R7450) running in AP Mode is configured as follows:
WAN RJ45 has a wired uplink to the R6350 (the master running in normal router mode)
The Guest Network WiFi is enabled. The picks to allow guests to see each other is "greyed out" (I can't change it) but it does looked "checked"
When I connect to the Guest Network on the AP router (R7450 - Slave) I am able to see everything on the LAN back at the Master router (R6350) I am even able to log onto the R6350 using a guest connection on the AP.
My question is how do I stop guest devices on the AP router from getting to my LAN? How do I lock a guest down to internet only?
11 Replies
It is not clear (to me) that this is possible.
When in AP mode, the R7450 has no role in assigning IP addresses to client devices. That happens on the primary router. Devices connect to the R7450, either to one of the Ethernet ports or via WiFi, and the DHCP request that they broadcast is relayed to the primary router. The primary router goes through its regular process and responds with a DHCP offer, either from the LAN Setup table (IP assignment) or from the DHCP "pool". The primary router has no information about how the device connected.
It might be useful to look in the primary router Attached Devices display and see how devices connected to the AP are reported. Do they show as 'wired' or 'WiFi'?
This is one of the factors that led to the creation of mesh WiFi systems. (such as Google, eero, Asus, Linksys, TP-Link Deco, and Netgear Orbi & Nighthawk mesh) The other factor is that devices connected to an Access Point or WiFi Extender often do not roam seamlessly between that system and the primary WiFi system.
You can't due to the AP being on same subnet as the host router.
My question is how do I stop guest devices on the AP router from getting to my LAN? How do I lock a guest down to internet only?
Well, it is possible (despite the earlier comments from CrimpOn and FURRYe38 ), but it does require a different setup. Basically you don't run the R7450 in AP mode. Instead set up both routers as routers.
WiFi
internet --->--- R7450 Router ----->----- guest wifi
|
| R7450 LAN port
|
+-------------------> -------------------R6350 Router --->--- LAN and Home Wifi
R6350 WAN port
You would be running double-NAT on your main home network. That would require some care in setting up port forwarding if you use that. You wouldn't be able to use upnp on the R6350 either.
But it would make it impossible for anyone connecting to the R7450 wifi to reach anything on the R6350 network. Folks on the guest network could reach the R7450 web admin page, so you would need a strong password for that. (Note you could reach the R7450's web admin page from your home network).
Beg to disagree. This configuration will prevent devices on the R7450 Guest WiFi from communicating with devices on the R7450 primary network.
However, it will not prevent devices on the R7450 Guest WiFi from communicating with devices on the R6350 primary network.
Suppose the R6350 LAN is subnet 192.168.1.x (the default) and assigns 192.168.1.n to the WAN port on the R7450.
The R7450 LAN must be different. The typical default for Netgear routers is 10.0.0.x.
Suppose a device on the R7450 Guest WiFi attempts to 'ping' any IP in 192.168.1.x. The R7450 will say, "not on my LAN. Send this out the WAN port."
The WAN port will say, "hmmm. That's on the same LAN subnet as I am. Use ARP to find the MAC address and send it there."
This will solve half the problem.
I have an RBR750 in router mode connected to the primary RBR50. The LAN is 192.168.1.x
The RBR750 LAN is 10.0.0.x and the RBR750 Guest WiFi LAN is 192.168.2.x
Devices on both the RBR750 primary LAN and on the RBR750 Guest WiFi LAN can ping devices on the RBR50 primary LAN.
Enjoyed the experiment.
This configuration can be set to keep any device on the R7450 LAN (primary or guest) from communicating with devices on the R6350 Guest WiFi LAN, but the objective is to keep them from communicating with the primary LAN.
Only a mesh WiFi system will do this.
Beg to disagree. This configuration will prevent devices on the R7450 Guest WiFi from communicating with devices on the R7450 primary network.
However, it will not prevent devices on the R7450 Guest WiFi from communicating with devices on the R6350 primary network.Suppose the R6350 LAN is subnet 192.168.1.x (the default) and assigns 192.168.1.n to the WAN port on the R7450.
Of course it will. Look again at the diagram. The R7450 is the edge router (for instance creating a 192.168.1.x subnet), the R6350 is behind the R7450 (for instance creating a 10.0.0.x subnet). Clients on the R6350 will be able to reach clients on the R7450 (including those on the guest network). But the NAT in the R6350 prevents the R7450 devices from reaching clients on the R6350. You set up the experiment backwards.
Part of the trick here is that you do need to make sure that the R6350 WAN port is the only thing connected to the R7450 ethernet.
FWIW, this is very similar to my own setup - my ISP router has to be the edge router in for my set top boxes to work. The Orbi is in in router mode behind the ISP router. Devices on the Orbi network can still reach clients on the ISP router network. But not the reverse.
Thanks for everyone's replies. I
It is really too bad Netgear did not put more effort into programming more features into the device when in AP mode.
Locking down the Guest network to Internet Only is of great importance to me. There are so many IP enabled devices running in my house (Alexa, thermostats, Roku, garage doors, smart watches, washer/dryer, etc.) I don't trust them on the same network with my laptop that has important data. All of those smart gadgets are a Cyber attack waiting to happen.
One day I might upgrade to mesh but for now I am going to just run multiple devices in router mode.
Thanks
One problem with IoT devices and being on a separate isolated network is that the IoT devices supporting apps pn phones and pads won't beable to connect to there IoT devices if the mobile phone or pad is not on the same network or not isolated from the Iot device. Most phones and pad will connect to the main network for most users. GN brings in this isolation and could block communications between the IoT device and there supporting apps.
Also historical use of APs is designed for being on same network. GN is not a factor in most home class APs. GN is always handled at the host router level. So one reason why these low end routers don't have extras or what some users want. If you need this then you may need to find something else.
I've had IoT devices on my main network for years. Haven't had any issues to date. Justed added some more smart bulbs.
Locking down the Guest network to Internet Only is of great importance to me.
If you follow my block diagram (connecting the R7450 as a router to your ISP, and connecting the R6350 as a router to a LAN port on the R7450), you will find that it does exactly that. CrimpOn used the wrong arrangement in his experiment.
You might find that setting up some new devices will require temporarily disabling the client isolation. I know that Arlo cameras can't be installed unless the phone can directly reach the camera (and vice versa).
All my IOT devices are on my Guest network with no ability to talk to each other or my home LAN. I have not found 1 IOT device that could not function this way. I have smart switches (controlling outlets and lights), Honeywell Thermostat, Alexa Echo, Samsung washer/dryer, Chamberlain Garage door openers, Roku, etc.
All of the devices only need the internet. The IOT App on your smartphone then connects to some database on the internet/cloud to control these devices. That's why when the internet goes down you can't control these IOT devices even though your home LAN is still powered up and working fine.
There are some technologies (like Home Assistant) that starting to make use of the new IOT standard (MATTER) that does all the control locally but most IOT users dont have this
Thats why I leave my IoT devices on the main home network. If internet goes down, I can still control them if needed from the WLAN side.
This would be an interesting experiment to conduct. i.e. Deliberately disconnect the WiFi system from the internet and connect the smartphone to the WiFi LAN. Then go through smartphone apps and see how many function correctly with only local access. Obviously, this experiment can be conducted only if IoT devices are on the primary or IoT network (because the Guest WiFi on newer systems cannot communicate with devices on the primary/IoT networks).
When I have the house to myself (and remember) this might be a fun activity.
