Isolating guest networks

Question

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network.

Initially, I used IP filtering with iptables but I figure that a guest who spoofs his IP could possibly still gain access to my primary network.

At the moment, I'm using interface-based filtering with iptables. Am I correct in assuming that this is spoof-proof, and that guests will not be able to access my primary network?

Thanks!

PS: My router is running OpenWRT.

EDIT:

Following user3192427's answer, I need to add some details about my requirements. First, I have no control over the primary network's encryption (it could be open, WEP, WPA2 or 802.1x). Second, the guest network has to be open. Third and most importantly, my main concern is that the addition of a guest network doesn't add vulnerabilities.

So, I understand from user3192427's answer that my current solution still allows attackers to gain insights into my primary network's topology. What I want to know is if it adds an entry point into my primary network that wasn't there before. For instance, if my primary network was open and insecured, the addition of an open guest network wouldn't make it any more insecure. If my primary network had WEP or WPA2, attackers could still break into it by sniffing traffic and by "guessing" the key even without an open guest network. If my primary network had 802.1x (properly configured), AFAIK attackers couldn't get in. So, my rephrased question is: Assuming my primary network is impenetrable, would the addition of an open guest network make it penetrable (as in making it possible to literally break into one of the devices on it or into the router).

Answer 1

I hate to say the answer is yes/no but given the information I have to and I will explain why. It really depends on your guests and your level of paranoia/how much time you want to spend administering this AP.

You can write iptable rules to keep a guest from gaining information about/accessing your internal network but you pretty much have to write a rule for every type of protocol that could leak including arp,dns,smb,bonjour,etc... While this is doable you would need to revisit these rules pretty regular and compare against packet captures you are collecting from the guest network to make sure they are still working.

If your guests are the hacker types things like 802.1q won't stop them. VLANs are designed for routing and network identification, not security. Vlans need something on top of them to do additional security. If you google VLAN hopping you can find resources to do this pretty easily.

In order to secure the setup you mentioned I would look at this article: http://www.zdnet.com/blog/ou/a-secure-wireless-lan-hotspot-for-anonymous-users/587 (its a few years old but the technology is the same). You can set up 802.1x auth on DD-WRT.

A quick example would be here: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=684347

Don't forget to use different keys for your primary and guest network. If a guest can decrypt your traffic they might not be able to access it but doing packet caps would give them a lot of information about it.

Answer 2

On OpenWRT, it is possible to run two SSIDs at the same time, thanks to 802.1Q Trunking technique. Please find more details in the following article:

Multiple Access Points over -802.1Q using Open WRT

Just check at the beginning if your router is able to handle this.