I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a 1-physical-wifi-radio OpenWRT router; and a bunch of computers connected to the wifi) and to prevent users of the 2nd wifi from accessing my router config page and any services running on any of my own devices (e.g., non-Internet-visible file shares and servers).
My current security measures are iptables rules that prevent 2nd-wifi-user access to my original network based on source IPs or source interfaces. My fear is that these may not be sufficient.
(option 1: ip-based filtering) iptables -I FORWARD -s $GUEST_SUBNET -d $HOME_SUBNET -j REJECT (option 2: interface-based filtering) iptables -I FORWARD -i $GUEST_INTERFACE -d $HOME_SUBNET -j REJECT
I don't know much about spoofing but it seems to me that if a 2nd-wifi-user "doctored" his requests to the router configuration page (that sits within $HOME_SUBNET) as being from a source IP within $HOME_SUBNET, he could access and interact with the configuration page since he'd be able to sniff all of the traffic to the fake source IP address and construct sensible responses. Right?
If I'm wrong, and my iptables rules are in fact sufficient, could someone please explain why a spoof is not possible given my rules and reasoning.
Otherwise, does the encryption on my home wifi play a role in this? For instance, if my home wifi was WEP/WPA2/802.1x-encrypted, then would the response to the fake $HOME_SUBNET source IP be encrypted as well and thus be unreadable to my guests (thereby effectively securing my home network from my guests)? This seems sensible...
PS: this question follows from a recent question of mine and the responses I received for it.
EDIT: Just to be clear, my home wifi and guest wifi are emitted by the same router.