Sonicwall TZ210 - Set up public wifi on separate subnet & interface

Question

I want to set up a public wifi by connecting another router to the X6 interface, and put it on a separate subnet (192.168.10.0/24) & in the DMZ Zone to keep it away from the regular LAN. I believe I have the network settings correct: the router has acquired the IP and DNS information from the TZ210, and the TZ210 shows it as an active DHCP lease. X6 is in the DMZ.

I now have a routing/NAT/firewall problem, since I can't get any traffic to travel from the subnet to the internet. I can't get to any external websites and can't ping the TZ210 from the subnet. X0 is the regular LAN, and X1 is the WAN.

Looking for any tips or tutorials on this. Here's my current relevant rules:

Routing

Source: X6 Subnet Destination: Any Service: Any Gateway: Default Gateway Interface: X6

Source: Any Destination: X6 Subnet Service: Any Gateway: 0.0.0.0 Interface: X6

NAT Policies

Source Original: Any Translated: WAN IP Destination Original: Any Translated: Original Inbound: X6 Outbound: X1

Source Original: Any Translated: U0 IP Destination Original: Any Translated: Original Inbound: X6 Outbound: U0

Firewall

DMZ > LAN : Deny All

DMZ > WAN : Allow All

LAN > DMZ : Allow All

WAN > DMZ : Allow All

Answer 1

You should try to plug a computer right in the X6 Interface, assign a static IP (the one you gave to the X6 Interface) and try to access the Internet from the computer. If you are able to access the Internet, then the second router might be causing the problem. If you still don't have access to the Internet, then your Sonicwall must have some misconfiguration.

Here is what I suggest:

Create a new Zone that you will call "Public" with whatever security options that you want. Then, you assign the zone to the desired Interface (in your case, X6) in the Static IP mode (192.168.10.1). Then, you create a DHCP range pre-populated to the X6 interface. Once this is done, get the MAC address of your second router and reserve the 192.168.10.2 IP in the SW DHCP. Then on your second router, assign the static IP 192.168.10.2 and set it as a DHCP relay. Then you can test with the WiFi of the wireless computer.

Regards,

Answer 2

I accomplish this by using Port Shielding and Zoning. My assumption is that the "router" you are attaching to the X6 interface is simply for the purpose of broadcasting a discrete SSID for your "guest network"? If this is the case put the device in bridge mode (disable DHCP and NAT) and connect it to Interface X6. You can them create a separate Port Shield Group and Zone for this single interface, set up DHCP for said interface, and apply access rules preventing any traffic from traversing from your guest zone to anything other than the WAN zone. Here is a decent article on the basic concepts: http://thebeagle.itgroove.net/2013/10/18/sonicwall-zones-and-portshield-groups/?doing_wp_cron=1398093241.7734529972076416015625