View source for How to set up a guest WiFi network

<p style="color:red">The information on this page is updated in accordance with the [https://wiki.teltonika-networks.com/view/FW_%26_SDK_Downloads'''00.07.4'''] firmware version .</p>
==Introduction==
Most of us are aware, that network security is extremely important. If your WiFi network is not properly secured, it makes you and all of your home or office resources vulnerable to a variety of security threats. To stay ahead of the curve, many companies and home users have guest WiFi. Unlike your regular WiFi network that you or your company members use, the guest WiFi network restricts what your guests can do in your network. It gives visitors access to the Internet connection, but nothing else making you or your company a lot more secure. This chapter is a guide on configuring a guest WiFi.

==Configuring the router==
Before you start configuring the router <b>turn on "Advanced WebUI" mode</b>. You can do that by clicking the "Basic" button under "Mode", which is located at the top-right corner of the WebUI. 

[[File:Networking_rutx_manual_webui_basic_advanced_mode_v1.gif|border|class=tlt-border]]


===New WiFi AP===
----

<table class="nd-othertables_2">
    <tr>
        <th width=270; style="border-bottom: 1px solid white;></th>
        <th width=950; style="border-bottom: 1px solid white;" rowspan=2>[[File:WiFi_interfaces.png|border|class=tlt-border|808x563px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 4px solid white>
Login to the router's WebUI, navigate to the '''Network → Wireless''' page. Click '''Add'''. You can use either, 2.4GHz or 5GHz WiFi. Then you will be forwarded to the configuration window.
        </td>
    </tr>
</table>

----

<table class="nd-othertables_2">
    <tr>
        <th width=220; style="border-bottom: 1px solid white;></th>
        <th width=950; style="border-bottom: 1px solid white;" rowspan=2>[[File:Create new WiFi Interface.png|border|class=tlt-border|866x407px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white;>
On '''General Setup''' tab do the following:
<ol>
    <li>'''Enable''' instance.</li>
    <li>Select mode '''Access Point'''.</li>
    <li>Enter a custom '''ESSID'''.</li>
    <li>Expand the drop-down menu '''Network'''.</li>
    <li>Create a new interface, enter a custom name '''Guest'''.</li>
</ol>
        </td>
    </tr>
</table>

----

<table class="nd-othertables_2">
    <tr>
        <th width=220; style="border-bottom: 1px solid white;></th>
        <th width=950; style="border-bottom: 1px solid white;" rowspan=2> 
[[File:Wifi interface security.png|border|class=tlt-border|866x272px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white;>
Switch to '''Wireless Security''' tab and do the following:
<ol>
    <li>Select '''Encryption''' type.</li>
    <li>Select '''Cipher''' type.</li>
    <li>Enter '''Key'''.</li>
</ol>
Once done, '''Save & Apply changes'''.
        </td>
    </tr>
</table>


===New LAN interface===
----
<table class="nd-othertables_2">
    <tr>
        <th width=220; style="border-bottom: 1px solid white;></th>
        <th width=970; style="border-bottom: 1px solid white;" rowspan=2>[[File:Guest interface config.png|border|class=tlt-border|843x633px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white>
Once you have saved the Wireless interface, a new window should pop-up. Configure it as following:
<ol>
    <li>Select '''Protocol''' - Static. Confirm by clicking "SWITCH PROTOCOL".</li>
    <li>Enter a '''IPv4 address'''.</li>
    <li>Enter a '''IPv4 netmask'''.</li>
    <li>Enable '''DHCP server'''.</li>
</ol>
'''Save & Apply changes''' when done.
        </td>
    </tr>
</table>

===Firewall rules===
----

<table class="nd-othertables_2">
    <tr>
        <th width=270; style="border-bottom: 1px solid white;></th>
        <th width=950; style="border-bottom: 1px solid white;" rowspan=2> 
[[File:Firewall zone.png|border|class=tlt-border|785x261px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white;>
Navigate to '''Network → Firewall → General Settings'''. There create a new '''Zone''' rule by pressing '''Add''' button. Then you will be forwarded to the configuration window.
<ol>
    <li></li>
</ol>
        </td>
    </tr>
</table>

----
<table class="nd-othertables_2">
    <tr>
        <th width=220; style="border-bottom: 1px solid white;></th>
        <th width=970; style="border-bottom: 1px solid white;" rowspan=2> 
[[File:Firewall zone config.png|border|class=tlt-border|849x578px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white;>
In the '''ZONE''' page, do the following:
<ol>
    <li>Enter a custom '''Name'''.</li>
    <li>Add new created ''"Guest"'' LAN to '''Covered networks'''.</li>
    <li>Select WAN interfaces for '''Allow forward to destination zones'''.</li>
    <li>Select WAN interfaces for '''Allow forward from destination zones'''.</li>
</ol>
When done, '''Save & Apply changes'''
        </td>
    </tr>
</table>

----

<table class="nd-othertables_2">
    <tr>
        <th width=250; style="border-bottom: 1px solid white;></th>
        <th width=970; style="border-bottom: 1px solid white;" rowspan=2> 
[[File:New traffic rule.png|border|class=tlt-border|787x116px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white;>
In order to disable WebUI or SSH access to the router from Guest's_WiFi network navigate to the '''Network → Firewall → Traffic Rules''' page and do the following:
<ol>
    <li>Select '''Add new forward rule'''.</li>
    <li>Enter a custom '''Name'''.</li>
    <li>Select ''"guest_zone"'' for '''Source zone'''.</li>
    <li>Select ''"lan"'' for '''Destination zone'''.</li>
    <li>Click the '''Add''' button. Then you will be forwarded to the configuration window.</li>
</ol>
        </td>
    </tr>
</table>

----
<table class="nd-othertables_2">
    <tr>
        <th width=250; style="border-bottom: 1px solid white;></th>
        <th width=970; style="border-bottom: 1px solid white;" rowspan=2> 
[[File:Traffic rule config.png|border|class=tlt-border|848x625px|right]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white;>
Do the following in the '''TRAFFIC RULES''' page:
<ol>
    <li>'''Enable''' instance.</li>
    <li>Change the '''Destination zone''' to ''"Device (input)"''.</li>
    <li>Enter the '''Destination port''' to reject. By default ports 22, 80, 443 are used to access the web user interface and SSH.</li>
    <li>Change the '''Action''' to ''"Reject"''.</li>
</ol>
'''Save & Apply''' changes.
        </td>
    </tr>
</table>

==Results==
If you've followed all the steps presented above, your configuration should be finished. If you are near a RUT, that is, in a wireless zone, turn on WiFi on your device and view the available networks. You should see the available SSID - "RUTX_WiFi_2G" and "Guest_WiFi". Select one of them and enter the appropriate WiFi password.

-----

<table class="nd-othertables_2">
    <tr>
        <th width=525; style="border-bottom: 1px solid white;"></th>
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking rutos configuration examples guest wifi 14 v1.jpg|border|class=tlt-border|300px|center]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white>
Wireless users connected to SSID: “'''RUTX_WIFI'''”, will be assign to “LAN”, and will get IP from main pool '''192.168.1.0/24'''.
        </td>
    </tr>
</table>

----

<table class="nd-othertables_2">
    <tr>
        <th width=525; style="border-bottom: 1px solid white;"></th>
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking rutos configuration examples guest wifi 13 v1.jpg|border|class=tlt-border|300px|center]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white>
LAN users are able to access any data from pool 192.168.1.0/24. For example they can access Web UI.
         <ol>
            <li></li>
            <li></li>
            <li></li>
            <li></li>
        </ol>
        </td>
    </tr>
</table>

----

<table class="nd-othertables_2">
    <tr>
        <th width=525; style="border-bottom: 1px solid white;"></th>
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking rutos configuration examples guest wifi 12 v2.jpg|border|class=tlt-border|300px|center]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white>
Wireless users connected to SSID: “'''GUEST'S_WIFI'''”, will be assign to LAN “Guest”, and will get IP from new pool '''10.10.10.0/24'''.
        <ol>
            <li></li>
            <li></li>
            <li></li>
        </ol>
        </td>
    </tr>
</table>

----

<table class="nd-othertables_2">
    <tr>
        <th width=525; style="border-bottom: 1px solid white;"></th>
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking rutos configuration examples guest wifi 11 v1.jpg|border|class=tlt-border|300px|center]]</th>
    </tr>
    <tr>
        <td style="border-bottom: 1px solid white>
Guest hosts are unable to access any data from pool 192.168.1.0/24. And access to the routers Web UI or SSH is restricted.
        <ol>
            <li></li>
            <li></li>
            <li></li>
        </ol>
        </td>
    </tr>
</table>
[[Category:Configuration Examples]]