Change IP Guest Wifi

[hya_it]

Hello,
I want to change the IP range of my guest Wifi, since 192.168.2.1, which is the default one, is a LAN that I am already using and I have the problem that it has LAN access when it should not be like that. I have tried with the following that I have seen in the forum.

Spoiler

• nvram set lan1_ipaddr=192.168.3.1
• nvram set lan1_gateway=192.168.3.1
• nvram set lan_ipaddr2=192.168.3.
• nvram set dhcp_start2=192.168.3.2
• nvram set dhcp_end2=192.168.3.254
• nvram commit
• reboot the router

These parameters are added but it does nothing, it continues giving the IP 192.168.2.x.

Is there any way to resolve this?

Currently, my RBR750 device with V.4.6.14.3_2.3.12 is in AP mode assuming the DHCP range of a PFSense firewall with IP 192.168.100.1.

Thank you

[plemans]

Why not just switch the other device off the 2.1 subnet? Might be easier. 

[hya_it]

I have 30 computers + 10 devices + previous configurations in the Firewall. It's not easier haha

[plemans]

Yeah, probably not easier. I don't mess to much with the telnet into the orbi series so maybe someone else has ideas on that front. 

[FURRYe38]

I don't believe GN is configurable on its IP address range since the intent of the GN is for limited and temporary use by devices that only need internet access for a short period of time. 

[CrimpOn]

When the Orbi is in AP mode, doesn't the pfSense box assign IPs to every device that connects, including the Orbi units themselves and everything that connects to the Orbi (no matter what WiFi SSID they use)?

[hya_it]

That is what happens with the main Wi-Fi, the PFSense assigns the IPs by DHCP or fixed, but in this subnet of the guest Wi-Fi 192.168.2.x it does not pay attention... also, it does not even go through the firewall... That's why I want to change that configuration via telnet but what I put above looks like it was for previous versions.

[plemans]

To be honest, the guest network shouldn't even work in AP mode. 

https://kb.netgear.com/000061277/Which-features-are-disabled-on-my-Orbi-router-when-it-is-set-to-AP-...

https://kb.netgear.com/26765/Which-features-are-disabled-on-my-NETGEAR-router-when-it-is-set-to-AP-M...

Probably a bug that its enabling at all. 

[FURRYe38]

Was told by NG that GN is now supported in AP mode...

[CrimpOn]

Have been following this interesting discussion and felt, "This calls for an experiment!"

Step 1.

Connected an RBR750 with firmware v4.6.14.3 (the latest) to my Orbi RBR50 in the default mode (Router).

Because of the IP address conflict, the RBR750 defined its LAN as 10.0.0.x

Enabled the RBR750 Guest WiFi.

Connected laptop to the RBR750 with Ethernet, and received IP address 10.0.0.2 (as expected)

Connected two devices to the RBR750 Guest WiFi and received 192.168.2.2 and 192.168.2.3.

This was a surprise (to me) because I had naively thought that since it was using 10.0.0.x for the primary LAN, that it would just "bump up" the third octet to something like 10.0.1.x or 10.0.2.x.  Oh well.  This behavior is consistent with the way the AX product creates a separate Guest LAN.

None of these devices are visible on the primary RBR50 because they are hidden behind the RBR750 NAT. (As they should be.)

Step 2.

Changed the RBR750 from Router mode to Access Point (AP) mode.

Because it is no longer in router mode, the primary LAN subnet (10.0.0.x) disappeared.  That laptop wired directly to the RBR750 received an IP address from the primary RBR50. (as was expected).  Because the laptop MAC address appears in the RBR50 LAN setup table, it received the IP address from the assignment table.

Those two devices connected to the RBR750 Guest WiFi did not change IP address.  They remain 192.168.2.2 and 192.168.2.3

Both devices on the RBR750 Guest WiFi continue to have internet access.

Neither of these two devices appear on the primary RBR50 Attached Devices display.  In addition to being "Guests", they are also Ghosts!  They do not exist!

How can a device that does not exist and has an IP address that is not in the RBR50 LAN access the internet???

Neither of these devices can be reached from the RBR50 LAN. (do not respond to ping)

Devices on this Guest network cannot see each other.

Oh.... There are now two entries on the RBR50 Attached Devices page for the RBR750 router:

• One for its address on the RBR50 LAN (happens to be 192.168.1.76).
  This is how that laptop wired to the RBR750 is able to communicate.
• Another is 192.168.2.1  Oh, my.  that is the gateway IP address for the RBR750 Guest WiFi.
  (Having only one RBR750, I can only speculate what happens if a second RBR750 router is connected to the primary RBR50 in AP mode.
  • Does it get another IP in the 192.168.2.x subnet?
  • Does it get an IP in a different subnet?
  • No Clue.
• In addition, the RBR750 AP/Router mode display is unusual:
  
  Notice that it does not mention the Guest WiFi SSID, even though two devices ARE connected to the Guest WiFi SSID.  Pulling up the Help information at the bottom of the screen claims that Guest WiFi is not available.  The RBR750 User Manual does  not mention what is "not available" when the device is in AP mode.

Conclusions:

• If the RBR750 is connected to any router other than a Netgear Orbi, there is going to be serious trouble.because packets from the RBR750 WAN port will appear to come from two different IP subnets.
  • Packets from devices connected to the primary network will appear to come from the IP subnet assigned by the upstream router.
  • Packets from devices connected to the RBR750 Guest WiFi will appear to come from IP address (not subnet) 192.168.2.x
  • Why doesn't this cause an ARP conflict?  i.e. one MAC address with two IP addresses?  Maybe because they are in different subnets so ARP broadcasts remain 'separate' somehow?
• An Orbi router can handle this because it has a static route enabled inside the router that says the primary IP subnet is in one direction and what we usually think of as the VPN connection is in another direction.  The RBR750 Guest WiFi subnet appears to be a (something like) a device connected through VPN which may have lots of other devices that it is using NAT to hide.  There can be more than one device connected through VPN (and possibly hiding many devices behind themselves with NAT).
• So, what can be done to the pfSense Firewall?
  • The existing 192.168.2.x network needs to be assigned to a different subnet (a huge chore).
  • There needs to be a new rule permitting 192.168.2.x access only to the internet and not to the primary networks.

All this could have been avoided if Netgear provided a method for users to define the IP subnet (and maybe the DHCP pool) being used for:

• Guest WiFi
• VPN Connections.  (Yes, there was a post from a user who wanted to connect his laptop to two different Orbi systems but could not because both systems assigned his laptop an IP address in (you guessed it) 192.168.2.x.  So the laptop no longer knows "where is?"  anything with a 192.168.2.x IP address.  VPN1 or VPN2?