Hi Morgan,
I've been wanting to replace my ISP router because of its back door anyway, so I got myself a pair of VLAN aware Netgear GS108E switches and started experimenting. Used one to split the inbound VLANs for ITV and internet and dedicated the rest of the ports for LAN use. Moved the second one to my work space two floors up to try split up my LAN with a dedicated segment for Squeezebox devices - those things spit a shipload of broadcast messages over the network, causing serious performance issues with other devices that do not need to receive those messages but will evaluate them.
Here's my (working!) setup:
/etc/hostapd/hostapd.conf:
Code: Select all
interface=wlan0
bssid=02:xx:xx:xx:xx:x0
...
ssid=gordon
channel=5
wpa=3
wpa_passphrase=ExtremelySecret
...
bss=wlan0_0
ssid=squeezeplay
bss=wlan0_1
ssid=guest
For explanation of bssid visit
http://wiki.stocksy.co.uk/wiki/Multiple ... th_hostapd. I use no password on the secondary SSID's. I'll explain further on.
/etc/network/interfaces:
Code: Select all
...
# Wireless LAN
iface wlan0 inet static
address 192.168.57.254
netmask 255.255.255.0
pre-up /sbin/ifconfig wlan0 hw ether 02:xx:xx:xx:xx:x0
# 57 = "W"
# Squeezeplay
iface wlan0_0 inet manual
pre-up /sbin/ifconfig wlan0 up
iface eth1.1311 inet manual
iface br0 inet static
address 10.13.11.1
netmask 255.255.255.248
bridge_ports eth1.1311 wlan0_0
# 0x1311 = "SQ" - "@@" (can't use 5351 > 4096)
# Guest network
iface wlan0_1 inet static
address xyz.xyz.xyz.1
netmask 255.255.255.248
pre-up /sbin/ifconfig wlan0 up
Netmask for both Squeezebox and the Guest network allow for 5 clients to connect (range 0-7 where 0 is the net number, 7 the broadcast address and 1 the server)
/etc/dnsmasq.d/squeezeplay.conf:
Code: Select all
interface=br0
dhcp-range=br0,10.13.11.2,10.13.11.6,15m
# Assign fixed addresses and DNS names to the Squeezebox devices
dhcp-host=00:04:20:xx:xx:xx,10.13.11.2,assurancetourix
dhcp-host=00:04:20:xx:xx:xx,10.13.11.3,maestria
dhcp-host=00:04:20:xx:xx:xx,10.13.11.4,kakofonix
dhcp-host=00:04:20:xx:xx:xx,10.13.11.5,squeezeremote
# Dummy host to block the one remaining address in this segment
dhcp-host=02:04:20:xx:xx:x0,10.13.11.6
Note the prepending of 'br0' to the value of dhcp-range. I made a similar change to the existing file /etc/dnsmasq.d/bubba.conf where I inserted 'eth1' in that line.
Relevant portion of
/etc/network/firewall.conf:
Code: Select all
:SQUEEZEPLAY - [0:0]
-A INPUT -i br0 -j SQUEEZEPLAY
-A FORWARD -i br0 -j SQUEEZEPLAY
-A SQUEEZEPLAY -d 10.0.0.0/8 -p tcp -m tcp --dport 80 -j REJECT
-A SQUEEZEPLAY -d 172.12.0.0/12 -p tcp -m tcp --dport 80 -j REJECT
-A SQUEEZEPLAY -d 192.168.0.0/16 -p tcp -m tcp --dport 80 -j REJECT
-A SQUEEZEPLAY -p tcp -m multiport --dports 3483,9000,9090,80 -j ACCEPT
-A SQUEEZEPLAY -p udp -m multiport --dports 3483,67,68,53,17784 -j ACCEPT
-A SQUEEZEPLAY -d 224.0.0.0/24 -j ACCEPT
-A SQUEEZEPLAY -j REJECT
(this gives access to local/remote LMS, dhcp, dns and remote http - required for internet radio)
The fixed assignments in the DHCP server will prevent anyone to receive an IP when they attach to the Squeezeplay network. The strict firewall will further prevent real damage from someone spoofing a valid MAC address and I save CPU power by not needing to cipher the audio streams.
