Setting up multiple Wi-Fi SSIDs with VLANs on AdvancedTomato
AdvancedTomato is a GUI for the Shibby fork of Tomato, a custom firmware for wireless routers with Broadcom chipsets. After moving to a new apartment, I had an Asus RT-AC68U laying around, which supports AdvancedTomato. At the time of this writing, AdvancedTomato hasn't received an update in almost two years. This is because the project depends on updates to the Shibby fork, which also hasn't been updated. There is another version of Tomato called FreshTomato, which has more recent builds and security fixes. When I have time, I'll probably flash my router with FreshTomato (unless I upgrade to a UniFi system before then).
We'll be configuring three networks and their respective SSIDs:
LAN network has full access to everything, no VLAN, and is the native SSID on the router.
IoT network is restricted to internet access only and has mDNS "repeated" between it and the
Guest network is for guests to access the internet only, and has bandwidth restrictions.
Basic Settings > Network > WAN Settings:
Type to Disabled
Bridge WAN to LAN to Enabled
Basic Settings > Network > WAN Settings, create two other bridge interfaces
br1 will be used for the
IoT network, and
br2 will be used for the
Don't forget to hit Save at the bottom of the page.
Create Virtual SSIDs
Advanced Settings > Virtual Wireless:
Create two additional 2.4GHz networks (and additionally 5GHz networks if you prefer), and assign the new networks to each bridge that were created earlier.
To actually segregate traffic, VLANs will be used (in conjunction with a router/firewall that supports them). Under
Advanced Settings > VLAN, create two VLANs:
VLAN 8 is setup for the
IoT network, and VLAN 9 is setup for the
Block GUI Access
In order to block access to the GUI from the
IoT networks, a Firewall script must be added:
#!/bin/sh iptables -I INPUT -i br1 -j DROP iptables -I INPUT -i br2 -j DROP