Question Issues with Wireless Guest Network ?

[proton777]

Hey all. I have a baffling issue which I have not been able to resolve regarding Guest Network in my home WiFi system. Here's a before and after look at my setup.

Before: I have Xfinity cable service feeding an Arris SBG-7580AC Gateway/Router with a LAN address of 192.168.1.1. I have a second wireless router - Linksys EA7500 V2 upstairs - which is connected to the Arris via wired LAN ethernet. It's at 192.168.1.3

Each router has 2.4 and 5 GHz bands. Each router also has Guest Network cababilites on each of those bands. So I have total of EIGHT unique SSIDs and everything worked fine until....

After: I recently upgraded my Gateway to add telephone service through Xfinity. I received my new Arris SVG2482AC and began making the limited changes needed.

I connected the new Arris router directly up to my laptop, offline, and configured it to be the new Gateway at 192.168.1.1(and 255.255.255.0) and turned off WiFi. I wanted to use this new router strictly as a Gateway, leaving the other two routers as they were, keeping the same SSIDs and passwords so I didn't have to reconfigure my existing devices.

The original gateway/router (previously at 192.168.1.1) is now assigned 192.168.1.2 and is hardwired to the new Gateway. The Linksys router upstairs is now hardwired to the original Arris now at 1.2, just as it was before. The Linksys keeps its original IP address of 192.168.1.3 and each of its four SSIDs and passwords.

Theoretically, the new hardware and limited configuration changes should all be transparent to my connected devices and I was pretty much correct.

The only problem now is none of the Guest Networks work. I kept the same FOUR Guest SSIDs with the same passwords on the same devices and no matter which Guest Network I try to use, my phone (or other device) says CONNECTED WITHOUT INTERNET. Strange. On the non-Guest networks, the internet works perfectly with all of my devices.

Digging deeper, looking at the nework settings on my phone while I am connected to any of the four Guest Networks without internet. My phone is set for DHCP and as I look at "view more", I see on one of my Guest Network's SSIDs, the IP being assigned is 192.168.28.2 and 192.168.28.3 for each of the Guest SSIDs on that router.

When I connect to the other router's Guest Network, it is assigning IP address of 192.168.3.1.

Both of these IP addresses fall outside of the DHCP range of 192.168.1.100 through 199. Both routers are doing it but only with Guest Network. Strange. Non-guest networks are fine.

If I try and change my phone's IP to STATIC and give it an IP address that's within the valid range, I still can't get to the internet.

When I used each of the other four non-Guest SSIDs, I am assigned valid IP addresses in the 192.168.1.x range.

One at a time and separately, I made each of the three routers the DHCP server on the network with the same address range and still, my devices are being assigned invalid IP addresses, only when using one of the guest SSIDs.

My phone has a network setting for "Manage Router". When I click on that while on a Guest Network, it will try to open a webpage at 192.168.3.1 and while on the other Guest Network it tries to open 192.168.28.1 - the same addresse range of the invalid IP address my phone is being assigned.

I'm not a network expert but I thought changing the netmask to 255.255.0.0 might help but it did not and it's back to the original setting.

I have no idea what this could be. I can't imagine it's a firewall issue or similar since I'm able to get to the outside world. I am only assuming the IP addresses are the problem but were not until adding a new in gateway in front of my other two existing devices.

Thanks in advance for any insight.

 

[Ralston18]

There should only be one router (main router) configured to provide network DHCP IP addresses.

The other routers, if I follow correctly, can have static IP addresses assigned making them APs.

With their respective DHCP functions disabled. They do not need to provide IP addresses with respect to any IP address ranges.

Only the Main Router (192.168.1.1) should be doing so.

Sketch out a simple diagram of your network showindg all devices and assigned IP addresses if static.

Ensure that those assigned IP addresses are outside of the DHCP IP address range allowed to the main router.

Post the sketch via imgur (www.imgur.com).

 

[bill001g]

Your problem is you are using consumer equipment that does not actually have the concept of multi networks.

Pretty much the guest feature on almost all routers just filters traffic so it can only go to the internet it is not any form of seperate network.

The only way to actually make this work when you have multiple "router/AP" that need to have guest function is to have devices that support vlans. That way you create multiple networks and the vlans keep all the traffic isolated to where you need them to be.

There is no easy way to really accomplish this with consumer equipment. Many times it will appear to work but the traffic is actually all on the same network and there is no actual security between the devices.

 

[proton777]

Ralston, see comments and link to network drawing:

There should only be one router (main router) configured to provide network DHCP IP addresses.
Correct

The other routers, if I follow correctly, can have static IP addresses assigned making them APs.
Correct

Only the Main Router (192.168.1.1) should be doing so.
It is

Sketch out a simple diagram of your network showindg all devices and assigned IP addresses if static.

Ensure that those assigned IP addresses are outside of the DHCP IP address range allowed to the main router.
They are

My Network

 

[proton777]

Your problem is you are using consumer equipment that does not actually have the concept of multi networks.

Pretty much the guest feature on almost all routers just filters traffic so it can only go to the internet it is not any form of seperate network.

The only way to actually make this work when you have multiple "router/AP" that need to have guest function is to have devices that support vlans. That way you create multiple networks and the vlans keep all the traffic isolated to where you need them to be.

There is no easy way to really accomplish this with consumer equipment. Many times it will appear to work but the traffic is actually all on the same network and there is no actual security between the devices.

bill,

I appreciate your input and don't dis-believe what you're saying but it's strange that this did work prior to adding a new gateway I still don't understand who/what is handing out those odd IP addresses only to the guest networks and why they are always the same

 

[bill001g]

In someways having a device handing out completely different IP ranges is exactly how it works when you are using vlans. Maybe one of your devices is smarter than we think.

Why do you want guest SSID.

If we look at your original install what would actually prevent someone with a IP of 192.168.1.xx talking to someone else with a IP of 192.168.1.xx.

In consumer grade routers they use wireless isolation...but this only isolates in the box not between wireless radios on different boxes. In addition they also only allow traffic to go from the wifi to the wan interface.
This works fine but when you have mulitiple "routers" in a network how does the main router know which is which. To the main router the second router appears as a ethernet cable. How does it know which packets belong on the guest network and which belong on the normal network. With higher end equipment there are vlan tags added to the packets.

 

[Ralston18]

Network diagram - very helpful to get a sense of the proverbial "big picture".

What ports are being used to connect Router 1 to Router2 and then Router 2 to Router 3?

WAN, LAN?

That 192.168.28.1 IP address is interesting.

Any hotspots set up - past or present?

 

[JohnMGotts]

I assume the connections to the remote routers are not using the WAN port per chance? They should be daisy chained via LAN connections.

 

[proton777]

In someways having a device handing out completely different IP ranges is exactly how it works when you are using vlans. Maybe one of your devices is smarter than we think.

Why do you want guest SSID.

If we look at your original install what would actually prevent someone with a IP of 192.168.1.xx talking to someone else with a IP of 192.168.1.xx.

In consumer grade routers they use wireless isolation...but this only isolates in the box not between wireless radios on different boxes. In addition they also only allow traffic to go from the wifi to the wan interface.
This works fine but when you have mulitiple "routers" in a network how does the main router know which is which. To the main router the second router appears as a ethernet cable. How does it know which packets belong on the guest network and which belong on the normal network. With higher end equipment there are vlan tags added to the packets.

Bill, I like the option of using guest networks since I do get quite a few guests and the password I use on the guest networks is a simple word I can say and everyone will understand how to log in.

My non-guest SSIDs' passwords are long and complicated and can't easily be verbalized so it's just easier to tell my frequent visitors how to access my WiFi rather than write a long string of nonsensical characters down.

 

[proton777]

I assume the connections to the remote routers are not using the WAN port per chance? They should be daisy chained via LAN connections.

Correct. I am using all wired LAN ports.

 

[proton777]

Network diagram - very helpful to get a sense of the proverbial "big picture".

What ports are being used to connect Router 1 to Router2 and then Router 2 to Router 3?

WAN, LAN?

That 192.168.28.1 IP address is interesting.

Any hotspots set up - past or present?

Ralston, all those connection are using wired LAN ports. No past or present HotSpots were ever used.

 

[bill001g]

Bill, I like the option of using guest networks since I do get quite a few guests and the password I use on the guest networks is a simple word I can say and everyone will understand how to log in.

My non-guest SSIDs' passwords are long and complicated and can't easily be verbalized so it's just easier to tell my frequent visitors how to access my WiFi rather than write a long string of nonsensical characters down.

Your problem is even though they might be different wifi "networks?" once they are changed into ethernet all the machines are on the same network. The SSID really are just different cosmetic names you put on the same IP network. The concept of network is mostly a IP based thing.

The only way to get any kind of isolation on a home network is to only use the main router for "guest". It then can force this special traffic to go to the internet and not have access to your other machines. The way it is implemented in home routers is really a hack that has extremely limited use cases which is what you see as soon as you add something more complex.

 

[Ralston18]

And I am still curious about those 192.168.28.x IP addresses.

Can you ping them?

 

[proton777]

Your problem is even though they might be different wifi "networks?" once they are changed into ethernet all the machines are on the same network. The SSID really are just different cosmetic names you put on the same IP network. The concept of network is mostly a IP based thing.

The only way to get any kind of isolation on a home network is to only use the main router for "guest". It then can force this special traffic to go to the internet and not have access to your other machines. The way it is implemented in home routers is really a hack that has extremely limited use cases which is what you see as soon as you add something more complex.

Again, thanks for your input. Even if this problem can't be resolved, at least it now makes sense as to what the reason is.

One thing I was considering doing was swapping the first two routers. If I make the existing second router as the gateway again (as it was originally), change it's IP to 192.162.1.1 , then make the existing gateway the second router and set that for 192.168.1.2, that should basically put my system back to the way it was prior to upgrading my gateway - where everything worked.

The only issue is, will the telephone service still work when moving that device to a private IP address not facing the internet...

Probably worth a try.

 

[bill001g]

It depends on how they implemented the telephone. In theory at least if you were to plug a phone into the second router it should act purely as device similar to say a magicjack. The router should not actually require a public IP and should pass over a NAT. They would want the router to function in areas where the ISP does not give their customers public IP.

You never really know though on how they implemented stuff. You don't even know if the feature will be enabled when the traffic does not use the WAN port and if you were to set it to AP mode it might completely disable the feature.
As you suspect you will have to try it.

There are many providers of VoIP hardware that will let you use land line phones if it doesn't work

 

[JohnMGotts]

I would (as an isolation test,) enable the wifi guest option on the WAN router, disconnecting its LAN port to the secondary router. Attempt connection.
If it works, reconnect the LAN and disconnect the LAN at the secondary router to the tertiary router & retest, etc., etc. This would identify the point of failure and a clue to the setup error.