I’m having a very weird issue and it might be just me doing something wrong.
Setup:
Router10 - WAN1 → ISP Router using Ethernet into ISP Router Internal Ethernet port
Router10 - LAN1 → AP6-Pro
AP6-Pro - WiFi1 (VLAN3); WiFi2(VLAN4);WiFi3(VLAN5) [examples] - so Internal, Guest(isolated), IoT(isolated)
Altalabs 8 port Switch - > ISP Router Internal Ethernet port
Router WAN IP is given by the ISP Router and is on the same subnet as the Altalabs Switch and everything is DHCP on that subnet from the ISP Router.
I can get from the WiFi (Internal) to the Internet but I can’t access the ISP Router Homepage (.254) or anything on the internal network.
From the Router10 itself using “Dynamic Routing” - I can ping everything on the WiFi VLAN and the internal network which goes through the ISP Router. However, from devices on the WiFi VLAN, I can’t access anything.
What am I doing wrong?
It sounds to me like you are possibly doing double NAT with the same subnet? Does the WAN interface on your Route10 have a private IP? Based on your description it sounds like it does.
Anyway to enable passthrough/bridge mode on your ISP router so that the WAN interface on your Route10 gets a public IP from the ISP? Or, you need to use the Route10 as a switch only and not use the WAN interface.
If your ISP supports it, you could also eliminate the ISP router entirely and plug ISP connection directly into the WAN port on your Route10.
I’ve set WAN1 to DHCP from the ISP Router. The Wifi Access Point is in LAN1. The interface on Router10 allows all VLANS on LAN1. It’s very weird. Devices connected to my WiFi using VLAN3 can pick up an IP Address and can browse the Internet, however can’t ping/browse devices on my local LAN.
The Route Should be : DEVICE > WiFiAccessPoint > Router10 > ISPRouter > AltaLabsSwitch > NAS
And I can ping everything from the terminal on Router10 both ways. I’m not sure if I have to VLAN tag the WAN Interface and create a VLAN on the Router10 that would cover the subnet the ISP is serving internally.
That’s because you have disjoint layer 2. You can’t switch traffic from the LAN side of Route10 to the LAN side of the ISP router via Route10’s WAN interface. Your Alta AP wireless client is in the same subnet as your NAS, no?
Your wireless clients behind Alta AP are getting LAN IPs via DHCP from the Route10, but your ISP router LAN side clients are getting DHCP LAN IPs from the ISP router.
You need to move the ISP router to Route10 connection from the WAN port on Route10 to a LAN port on Route10 or you need to move S8 to a LAN port on Route10.
I THINK I’ve fixed it. I forgot to set the Access Point Network to DHCP on VLAN1. So now it’s picking up an address from VLAN1, which also wasn’t set to provide addresses (doh!).
So now the Router10 is giving out Addresses on VLAN1, 3, 5 & the WAN interface is picking up an address using DHCP from the ISP Router.
so my laptop .. VLAN 3 on Wifi (x.x.3.10) is able to ping the x.x.3.1 gateway on the ROUTER10 & then to the x.x.8.254 gateway which is the ISP Routers Internal Interface and everything on the x.x.8.x subnet.
The Guest WiFi treats the x.x.8.x as the Internet so can access stuff on it, I just need to see if I can use the firewall to block it or only allow it access to the x.x.8.254 gateway address