R7450 AP Mode Stop Guest access LAN

Question

I am new to AP ModeI have a R7450 router and have placed it into AP mode.I connected the WAN RJ45 to a LAN RJ45 on another Netgear Router (This is the one that is in normal router mode that actually has a connection to the internet) I will call this the "Master router"&nbsp;The Master router is a R6350 and is configured as follows:WAN RJ45 is connected to the ISP gatewayLAN RJ45 has a wired uplink to the R7450 (the one in AP mode)The Guest Network WiFi is enabled and I don't allow guest devices to see each other or access my local network&nbsp;The Slave router (R7450) running in AP Mode is configured as follows:WAN RJ45 has a wired uplink to the R6350 (the master running in normal router mode)The Guest Network WiFi is enabled. The picks to allow guests to see each other is "greyed out" (I can't change it)&nbsp; but it does looked "checked"&nbsp;When I connect to the Guest Network on the AP router (R7450 - Slave) I am able to see everything on the LAN back at the Master router (R6350) I am even able to log onto the R6350 using a guest connection on the AP.&nbsp;&nbsp;My question is how do I stop guest devices on the AP router from getting to my LAN? How do I lock a guest down to internet only?

CrimpOn · Answer

It is not clear (to me) that this is possible.
&nbsp;
When in AP mode, the R7450 has no role in assigning IP addresses to client devices.&nbsp; That happens on the primary router.&nbsp; Devices connect to the R7450, either to one of the Ethernet ports or via WiFi, and the DHCP request that they broadcast is relayed to the primary router.&nbsp; The primary router goes through its regular process and responds with a DHCP offer, either from the LAN Setup table (IP assignment) or from the DHCP "pool".&nbsp; The primary router has no information about how the device connected.
&nbsp;
It might be useful to look in the primary router Attached Devices display and see how devices connected to the AP are reported.&nbsp; Do they show as 'wired' or 'WiFi'?
&nbsp;
This is one of the factors that led to the creation of mesh WiFi systems.&nbsp; (such as Google, eero, Asus, Linksys, TP-Link Deco, and Netgear Orbi &amp; Nighthawk mesh)&nbsp; The other factor is that devices connected to an Access Point or WiFi Extender often do not roam seamlessly between that system and the primary WiFi system.

FURRYe38 · Answer

You can't due to the AP being on same subnet as the host router.&nbsp;

StephenB · Answer

tkvoice wrote:
My question is how do I stop guest devices on the AP router from getting to my LAN? How do I lock a guest down to internet only?

&nbsp;
Well, it is possible (despite the earlier comments from CrimpOn​&nbsp; and FURRYe38​&nbsp;), but it does require a different setup.&nbsp; Basically you don't run the R7450 in AP mode.&nbsp; Instead set up both routers as routers.
&nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WiFi
internet ---&gt;--- R7450 Router -----&gt;----- guest wifi
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp;&nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; R7450 LAN port
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;+-------------------&gt; -------------------R6350 Router ---&gt;--- LAN and Home Wifi
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; R6350 WAN port
&nbsp;
You would be running double-NAT on your main home network.&nbsp; That would require some care in setting up port forwarding if you use that.&nbsp; You wouldn't be able to use upnp on the R6350 either.&nbsp;
&nbsp;
But it would make it impossible for anyone connecting to the R7450 wifi to reach anything on the R6350 network.&nbsp; Folks on the guest network could reach the R7450 web admin page, so you would need a strong password for that.&nbsp; (Note you could reach the R7450's web admin page from your home network).

CrimpOn · Answer

Beg to disagree.&nbsp; This configuration will prevent devices on the R7450 Guest WiFi from communicating with devices on the R7450 primary network.
However, it will not prevent devices on the R7450 Guest WiFi from communicating with devices on the R6350 primary network.
&nbsp;
Suppose the R6350 LAN is subnet 192.168.1.x (the default) and assigns 192.168.1.n to the WAN port on the R7450.
The R7450 LAN must be different.&nbsp; The typical default for Netgear routers is 10.0.0.x.
&nbsp;
Suppose a device on the R7450 Guest WiFi attempts to 'ping' any IP in 192.168.1.x.&nbsp; The R7450 will say, "not on my LAN. Send this out the WAN port."
The WAN port will say, "hmmm. That's on the same LAN subnet as I am. Use ARP to find the MAC address and send it there."
&nbsp;
This will solve half the problem.
&nbsp;
I have an RBR750 in router mode connected to the primary RBR50.&nbsp; The LAN is 192.168.1.x
The RBR750 LAN is 10.0.0.x and the RBR750 Guest WiFi LAN is 192.168.2.x
Devices on both the RBR750 primary LAN and on the RBR750 Guest WiFi LAN can ping devices on the RBR50 primary LAN.
&nbsp;
Enjoyed the experiment.
&nbsp;
This configuration can be set to keep any device on the R7450 LAN (primary or guest) from communicating with devices on the R6350 Guest WiFi LAN, but the objective is to keep them from communicating with the primary LAN.
&nbsp;
Only a mesh WiFi system will do this.

Forum Discussion

R7450 AP Mode Stop Guest access LAN

4 Replies