I'm currently in the process of setting up some D-Link DAP-2553 WiFi access points. They have the ability to broadcast multiple SSIDs. These SSIDs can be assigned to VLANS (which I am pretty new to). I would like to have an internal network (which I assume will be VLAN1) and a guest network (like VLAN2).

What I would like to do is to have the internal network have access to the "network" so they can access our servers, etc. The guest network should only have access to the internet. The APs have the ability to prevent cross-communication between clients on the same SSID, so if they are on a VLAN separate from the main network, they won't be able to access anything other than the internet. From my reading, it looks like we need a L2 switch (such as this one) to handle the VLAN traffic. Then that switch has to go to a L3 router to handle the DHCP and DNS for the two different VLans.

Does that sound correct? We are on a very tight budget, and getting a L3 router looks to be very expensive. Are there any low cost routes to accomplish this?


Yes, everything here sounds correct, at least in terms of your SSIDs and VLAN requirements. How many users are you looking to support? (The performance requirements of this setup are probably the most significant aspect to be concerned with.) If you really targeting cost, and don't need to be held to "enterprise" standards, you have a few options for a L3 router. A Linux server can be setup for only a few hundred $ that would suffice, as long as the network card (even only if single interface) supports VLAN trunking to your switches (most do, especially under Linux). Another option is to use a SOHO router/access point that supports something like OpenWrt. With this route, the hardware specifications are much less than even a minimal computer, so you'll just need to be conscious of hardware capacity (CPU + RAM) for active number of connections, etc. Of the SOHO routers, something like the Ubiquiti RouterStation Pro may be your best option.

If you don't need your switches for anything other than supporting the wireless VLAN traffic - and again, if you're really looking to cut costs and aren't held to "enterprise" standards, you could double-purpose some of the same SOHO routers/access points as the the switches. Something like the RouterStation Pro or even a NetGear WNDR3800 or a D-Link DIR-825 have 4-5 Gigabit ethernet ports on a configurable switch, including VLAN support.

For a maximum of 15 users, you could most likely run the entire setup off of a single RouterStation Pro - including DHCP and DNS, with additional access points only needed if you need to cover additional distance. I'm hosting almost that off of a D-Link DIR-825. Elsewhere at a school I support, we have 10 PCs and 5+ laptops on a pair of older Linksys WRT54GLs. One is acting as the router (including DNS) and access point. The other is only a secondary access point for extended range. A separate server exists as a file server / Windows domain controller, which also handles the DHCP (though it wouldn't need to). Note that I'm not using the multi-SSID setup at the school, though again, I probably could if needed.

In terms of recommendations on what a re-purposed server should be running, I'd recommend your favorite Linux distribution. For an example, see my Ubuntu Linux Router Upgrade Project series of posts on my blog, specifically Enabling routing and NAT with iptables and Configuring LAN DCHP and Dynamic DNS under Ubuntu Linux. While my posts were written for Ubuntu, most of the instructions will apply almost equally to any Linux distribution. I'm also using the same posts on my own network today as I write this, having upgraded with each Ubuntu release every 6 months - so the notes are quite "stable".

  • Thanks for the feedback ziesemer! We're talking about 5-10 users at a time, 15 max, so it's going to be extremely low amounts of traffic (compared to an enterprise). In the process of setting up this new network, we're going to take down an existing server (was acting as a filter). Sounds like this could be re-purposed into router/firewall duties. Do you have any recommendations on what it should be running? – compuguru Dec 28 '11 at 5:11
  • @compuguru - Please see my updates within the answer. – ziesemer Dec 28 '11 at 5:18
  • @compuguru - No problem! FYI, I just made a few additional updates. – ziesemer Dec 28 '11 at 5:30
  • Linksys E2500 series(E3200 / E4200) has the capabilities of having Guest Network which will separate the Guest Network from the LAN Network. It is not L3 router but for really small office it is cheap. – Miro co Dec 28 '11 at 6:27

Hey the server that you have put Pfsense on it. It supports vlan tagging with the correct nic. then you can set up filters for each vlan independently.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.