< Return to Tutorials

Adding a Second SSID

Mar 2, 2016

This guide will show you how to set up a second (and in turn multiple) SSID for your network.

In this example we will be creating an SSID for guest access, separate from your own private SSID.

SSH to your OpenWRT device

If you are using Windows then start PuTTY and click Session on the left side, select SSH from the options, and then enter in the IP Address of your OpenWRT box into the Host Name field.

Once you’ve done this just click on Open to start up the SSH connection.

If you are connecting via terminal, then just SSH to your OpenWRT device using the following command, where 192.168.1.1 is your OpenWRT device’s IP address.

ssh [email protected]

Create a new network interface

First we need to define a new interface in our network config, so run the following command:

vi /etc/config/network

Now that you have the network config file open, we can add in the following new interface which we are going to name ‘public’.

config 'interface' 'public'
        option 'proto' 'static'
        option 'ipaddr' '10.0.0.1'
        option 'netmask' '255.255.255.0'

Create a new network

Next up we want to create the new guest network/SSID. Run the following command:

vi /etc/config/wireless

Now you can simply copy and paste the existing ‘wifi-iface’ section and change a couple things.

option ‘device’ — Change this to the name of the radio you want to broadcast this network.

option ‘network’ — Change this to the name of the interface you created previously.

option ‘ssid’ — Change to the name you want guests to see when looking for your network.

option ‘isolate’ 1 — add this to the config to prevent clients on the network from connecting to each other.

You should end up with something like the following:

config 'wifi-iface'
        option 'device'     'wifi0'
        option 'mode'       'ap'
        option 'network'    'public'
        option 'ssid'       'Guest_WiFi'
        option 'encryption' 'none'
        option 'isolate'    1

Define a new DHCP pool

If you want DHCP on your guest network, then we will need to make a couple additions to the DHCP config.

Run the following command:

vi /etc/config/dhcp

This will open the DHCP config where you will need to add in the following:

config 'dhcp' 'public'
        option 'interface'  'public'
        option 'start'      '50'
        option 'limit'      '200'
        option 'leasetime'  '1h'

Set option ‘interface’ to the name of the network interface you created at the start.

Define firewall rules

Now we need to secure the public guest network. So run the following command to open the firewall config:

vi /etc/config/firewall

To err on the side of caution, we want to allow guests to the web via http and https, but do not want them to have access to the LAN or anything else.

Add a new zone section for the ‘public’ interface. We are going to allow SSH, DNS and DHCP to the guests, and allow guests http and https to the outside world. Then we want to block everything else.

config zone                                     
      option name 'public'                 
      option network 'public'              
      option forward 'REJECT'             
      option output 'ACCEPT'              
      option input 'REJECT'

config forwarding                               
      option src 'public'                  
      option dest 'wan'

config rule                                     
      option src 'public'                      
      option src_port '67-68'                 
      option dest_port '67-68'                
      option proto 'udp'                      
      option target 'ACCEPT'                  
      option name 'Allow DHCP request'        

config rule                                     
      option src 'public'                      
      option dest_port '53'                   
      option proto 'tcpudp'                   
      option target 'ACCEPT'                  
      option name 'Allow DNS Queries'         

config rule                                     
      option src 'public'                      
      option dest 'lan'                       
      option name 'Deny Guest on LAN'        
      option proto 'all'                      
      option target 'DROP'                    

config rule                                     
      option target 'ACCEPT'                  
      option src 'public'                      
      option dest 'wan'                       
      option name 'Allow Guest on WAN http'      
      option proto 'tcp'                      
      option dest_port '80'                   

config rule                                 
      option target 'ACCEPT'              
      option src 'public'                  
      option dest 'wan'                      
      option name 'Allow Guest on WAN https'  
      option proto 'tcp'                  
      option dest_port '443'

config rule                                     
      option src 'public'                      
      option dest 'wan'                       
      option name 'Deny Guest on WAN'
      option proto 'all'                  
      option target 'DROP'

After making all of these changes, you will need to either restart the processes or reboot your box.

To restart the processes run the following commands:

/etc/init.d/dnsmasq restart
/etc/init.d/firewall restart
/etc/init.d/network restart

(Optional) Limit guest broadband connection

If you are running a public connection for users it is advised, but not necessary, to limit their broadband usage to limit abuse of your network. There is a handy package you can install to manage this easily. Run the following command:

opkg install wshaper

Once the package is installed, run the following command:

vi /etc/config/wshaper

Set the network option to the name of the network interface you created at the start, and adjust the downlink and uplink options to the download and upload speed limits you want to apply (in kbit).

config wshaper 'settings'
      option network 'public'
      option downlink '1024'
      option uplink '512'

Cucumber Tony is a cloud based WiFi management platform for businesses. The firmware gives consumer-grade WiFi access points enterprise-like capabilities. Or you can utilise the captive portal solution with your existing infrastructure. Create a free account and check it here cucumberwifi.io

Come join Cucumber

Sign Up

Sign-up for Cucumber Tony, it's free for unlimited access points :)