Add A Separate Wireless Network For Guests - DrayTek

For better network security, it is common to set up an isolated network for guests and separate them from your private network. To achieve this, it requires creating another LAN subnet with the tag-based VLAN feature on the gateway router.

Vigor AP supports multiple SSIDs. We can create different SSIDs for staff and guests and link them to their respective networks by VLAN IDs.

This article demonstrates how to add a separate wireless network for guests on a Vigor AP.

DrayOS DrayOS 5 Linux

Setup on Vigor Router

1. Go to LAN >> VLAN, check Enable, and configure the VLAN as follows:- VLAN 0 is for the main network:

1. Include all the LAN ports,
2. use the default Subnet,
3. leave VLAN tag disabled,

- VLAN 1 for the guest network:

1. Include the LAN port which AP is going to connect
2. Include SSID 2 if your router has Wi-Fi built-in
3. select "LAN 2" for Subnet,
4. enable VLAN Tag, and enter a number for VID.

2. Go to LAN >> General Setup, check "Enable" for LAN 2. You may edit the IP range in Details Page.

3. (Optional) If your router has built-in Wi-Fi, go to Wireless LAN >> General Setup to enable SSID 2.

And set up the password for the guest Wi-Fi at Wireless LAN >>Security

The Configuration of the AP

1. Go to Wireless LAN >> General Setup, enable for a second SSID, customize the SSID, and enter the VLAN ID as the same number as we use in LAN profile settings.

2. Set up a password for the Guest SSID at Wireless LAN >> Security.

Verify the Configuration

Connect the AP to the router. Now, clients connecting to the guest SSID should get an IP in the range in the new LAN profile.

And they should not be able to ping a host on the main network.

Create a Guests network on the Vigor Router:

1. Go to LAN >> VLAN. Enable the VLAN feature and configure it as follows:

- VLAN0 LAN1 is for the main network for staff:

• Include all the LAN ports
• Select LAN1 for Subnet
• Leave VLAN tag disabled

- VLAN1 LAN2 is for the guest network:

• Include the LAN port which AP is going to connect
• Select "LAN2" for Subnet,
• Enable VLAN Tag, and enter a number for VID. Here we set VID as 5

2. Go to LAN >> General Setup. Enable LAN2 subnet and edit the IP range in Details Page.

Add an SSID for Guests on the AP1062C:

1. Go to Configuration / LAN. In VLAN List tab, add a VLAN ID and configure it as follows:

• Set VLAN ID to 5.
• Enter a name for this VLAN ID.
• Select [LAN]LAN1.

Then click Apply to save the settings.

2. Go to Configuration / Wireless LAN. In SSID tab, add an SSID for guests and edit it as follows:

• Enter the SSID name.
• Select Enabled.
• Select the security method and enter a password.
• Select the VLAN ID added in step 1.
• Apply the SSID to the desired band.

Then click Apply to save the settings.

Verify the Configuration:

When the WiFi client connects to the guest SSID, it should get an IP from router's LAN2 interface.

The client should not be able to ping a host on the main network.

The Configuration of the Router

1. Go to LAN >> General Setup to add a new LAN profile for guests.　

2. Set up the LAN profile as follows:

1. Enter the profile name
2. Check Enable
3. Enter a number for VLAN ID
4. Set up the IP Address and Subnet Mask
5. Select "Enable" for DHCP Server and enter the IP range for guests at DHCP Start IP and DHCP End IP
6. Click Apply to save the profile

3. Go to LAN >> Switch to add a VLAN for guests.

4. Enter VLAN ID as the same number as in the LAN profile, add the port to which the Wireless AP will be connecting into Member.

The Configuration of the AP

1. Go to Wireless LAN >> General Setup, enable for a second SSID, customize the SSID, and enter the VLAN ID as the same number as we use in LAN profile settings.

2. Set up a password for the Guest SSID at Wireless LAN >> Security.

Verify the Configuration

Connect the AP to the router. Now, clients connecting to the guest SSID should get an IP in the range in the new LAN profile.

And they should not be able to ping a host on the main network.