DMZ Wireless access in a small network using a WRT54G v7.0

Preparations on the router

1. We set up a static IP address on the interface that is going to be connected to the Linksys

2. We make sure the DHCP server listens on that interface, and we configure a shared-network in the ISC DHCPD /etc/dhcpd.conf, with inside it subnets for the logical networks on either side of the Linksys:

     shared-network wireless
     {
     subnet 10.0.137.0 netmask 255.255.255.0 {
     option broadcast-address 10.0.137.255;
     option routers 10.0.137.1;
     option domain-name "wireless";
     option domain-name-servers 10.0.137.1, <snip>
   
     host wrt54g3       { hardware ethernet 00:11:22:33:44:55 ; fixed-address 10.0.137.251 ; } # wrt54g v7.0
     }
     }
   	    

3. We make sure the BIND named listens on the interface. Because this is an intranet nameserver, we allow it to only serve to directly connected networks. The network behind the Linksys is not directly connected, so we need to explicitly allow requests coming from it to be served in /var/named/etc/named.conf:

     acl clients {
     localnets;
     10.0.138.0/24; # Wireless clients
     ::1;
     };
     <snip>
     options {
     <snip>
     allow-query { clients; };
     <snip>
     };
   
   	    

4. We also configure the firewall on the router to

   • do NAT on its 'outer' interface for the subnet on the router side of the Linksys,

   • also do NAT for the subnet on the laptop side of the Linksys,

   • not do such NAT for packets travelling between LAN-side-of-router subnets,

   • allow incoming traffic from the subnets on either side of the Linksys.

   These rules strongly depend on the firewall used. Those given below are more or less those on my router before its upgrade, and should serve only as a general guideline...

   <snip>
   wirelessnet=$wireless_if:network
   wirelessclientnet="10.0.138.0/24"
   <snip>
   # SNAT on wireless
   nat on $wan_if proto tcp from $wirelessnet to any port $client_out_tcp -> ($wan_if:0)
   nat on $wan_if proto udp from $wirelessnet to any port $client_out_udp -> ($wan_if:0)
   nat on $wan_if proto icmp from $wirelessnet to any -> ($wan_if:0)
   # SNAT for wireless clients
   nat on $wan_if proto tcp from $wirelessclientnet to any port $client_out_tcp -> ($wan_if:0)
   nat on $wan_if proto udp from $wirelessclientnet to any port $client_out_udp -> ($wan_if:0)
   nat on $wan_if proto icmp from $wirelessclientnet to any -> ($wan_if:0)
   <snip>
   no nat on $wan_if from $intranet to $wirelessclientnet
   no nat on $wan_if from $wirelessnet to $wirelessnet
   <snip some more of these 'no nat' rules>
   <snip>
   # Block everything by default
   block log all
   <snip>
   # Allow all traffic on wireless
   pass in log on $wireless_if from $wirelessnet
   pass in log on $wireless_if from $wirelessclientnet
   pass out log on $wireless_if
   	    

5. Reload the DHCP daemon, the BIND daemon, and the firewall ruleset.

Factory resetting the WRT54G

I got the little box second hand, and I don't know the previous owner's password, wo we'll have to reset it. As documented at a technicallyeasy page, the reset button (at the back of the device, next to the WAN port, should be pressed for 30 seconds.

	Note
	There are also docs that speak of 30 seconds reset while powered on, then 30 while powered off, then another powered on again. That drops us in a firmware upgrade dialog, and another brief press of the reset button will get us out of that, after which I don't see much difference with the just-once-30-seconds approach.

Getting to the GUI

We now disconnect the cable to the router from the Linksys, so it is only connected to the laptop. Then we do a DHCP RENEW on the laptop. y (For Linux, that's sudo dhclient eth0.) It will receive an IP number, and the LinkSys' GUI will be available on 192.168.1.1, with username blank and passwd 'admin'. We now have the situation as in .

Figure 2.  The situation after factory reset of the Linksys

	Note
	Disconnecting the router just makes sure the router's DHCP daemon doesn't interfere iwth the Linksys (yet). It reduces confusion.

Turning off wireless access (for the time being)

The wireless interface of the Linksys is turned on by default, with no security whatsoever. This is necessary to make the thing work out of the box. And we only expose the laptop by leaving it on. But I turned it off anyway.

Setting a password

Under Administration->Management, we now set a new password, then click Save Settings.

Accessing the Linksys from the PC

We now want access to the Linksys' GUI from the PC.

1. Under Administration->Management, we set Remote Management to Enable and its Management Port to 80.

   	Note
   	This wouldn't be very safe if the router were on the Internet with its WAN connection. But it's just connected to our router, which blocks HTTP traffic initiated from the Internet, so the danger is quite a bit smaller.

2. Under Administration->Management, we set Wireless Web Access to Disable.

3. Press Save Settings again.

4. Reconnect the cable between the Linksys (on the WAN port) and the router

5. Go to Status->Router and press DHCP Renew

Now we can access the GUI at http://10.0.137.251 from a browser on the PC. We do so from now on.

Assigning a new LAN-side IP to the Linksys

The Linksys cannot do DHCP for its own IP number on the LAN side, so we must configure that manually.

1. Using a browser on the PC, go to the Setup->Basic Setup menu (the default when the WebGUI opens), and set Local IP Address to 10.0.138.251.

2. And set the time zone if you wish.

3. Then Save Settings

Wireless settings

1. 	Warning
   	After this step, your networks are temporarily open to access from any wireless client in the area. So I temporarily blocked traffic incoming on the router from the range behind the Linksys. But you might just finish the next step quickly and be done with it.

   Under Wireless->Basic Wireless Settings, set Wireless Network Mode to mixed and choose an SSID, then press Save Settings.

2. Under Wireless->Wireless Security, set Security Mode to WPA2 Personal and pick a good 'WPA Shared Key' password, then press Save Settings.

3. Connect to the Linksys from the Laptop, using a wireless connection.

Misc. domestic tasks

Figure 3.  The Linksys with wireless

We have now gotten to the situation of . Wireless access to the laptop is accomplished. The situation can now be 'finetuned' further (e.g. tighten wireless access with MAC filters, add firewall rules on the router to disable access from the wireless network to the rest of the intranet, etc. etc.)