I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network.
Initially, I used IP filtering with iptables but I figure that a guest who spoofs his IP could possibly still gain access to my primary network.
At the moment, I'm using interface-based filtering with iptables. Am I correct in assuming that this is spoof-proof, and that guests will not be able to access my primary network?
PS: My router is running OpenWRT.
Following user3192427's answer, I need to add some details about my requirements. First, I have no control over the primary network's encryption (it could be open, WEP, WPA2 or 802.1x). Second, the guest network has to be open. Third and most importantly, my main concern is that the addition of a guest network doesn't add vulnerabilities.
So, I understand from user3192427's answer that my current solution still allows attackers to gain insights into my primary network's topology. What I want to know is if it adds an entry point into my primary network that wasn't there before. For instance, if my primary network was open and insecured, the addition of an open guest network wouldn't make it any more insecure. If my primary network had WEP or WPA2, attackers could still break into it by sniffing traffic and by "guessing" the key even without an open guest network. If my primary network had 802.1x (properly configured), AFAIK attackers couldn't get in. So, my rephrased question is: Assuming my primary network is impenetrable, would the addition of an open guest network make it penetrable (as in making it possible to literally break into one of the devices on it or into the router).