IMPORTANT: installing custom firmware always pose risk of bricking your device. Do it at your own risk.

This guide will show you how to use custom firmware DD-WRT on Asus RT-AC3200 as a wireless access point (WAP) to setup multiple Wi-Fi VLANs.

This is an alternate method of setting up Wi-Fi subnets of a 3 steps guide to protect home network using subnets.

Prerequisite: VLAN infrastructure in place for the wired network described in Part 1 and Part 2 of the 3 steps guide.

This guide will step you through the flash of custom firmware DD-WRT and setup the 3 wireless VLANs.

  • VLAN 40 (SSID: Mobile): Your mobile devices
  • VLAN 42 (SSID: IoT): IoT devices
  • VLAN 44 (SSID: Guest): Guest devices

How to enable recovery mode for RT-AC3200?

Asus router has recovery mode that allows you the flash firmware or reset to default settings (or factory reset for official firmware).

reset button
Reset button
  1. turn off the router
  2. press and hold the reset button (do not release)
  3. turn on the router
  4. wait for about 20 seconds on official firmware (or 5 seconds on DD-WRT already)
  5. release the reset button

Note: When the router is on official firmware, you need at least about 20 seconds. Otherwise, the recovery mode may only show up briefly for like 10 seconds and the router will proceed to reboot.

recovery mode
Recovery mode

How to factory reset?

There are several ways of performing factory reset. Each method shall achieve the same results.

Hard Reset

The 30/30/30 reset works on older routers, but not new routers like RT-AC3200. So don’t use it.

  • with the unit turned on, press and hold the reset button
  • wait until power led started blinking slowly (about 5 seconds)
  • release the reset button

Reset using Recovery mode

  • enable recovery mode
  • click on Restore default NVRAM values
erase NVRAM
Factory reset by clearing NVRAM

Reset using web gui

  • access web gui of the router
  • go to Administration > Restore/Save/Upload Setting
  • click Restore and then OK
reset using web gui

Note: if you are already on DD-WRT, go to Administration > Factory Defaults, select Yes and click Apply Settings.

How to flash DD-WRT?

Note: The Administration > Firmware Upgrade option available in the web gui of the latest official firmware (v3.0.0.4.382_50624) does not allow you to flash custom firmware.

What you need: A stand alone computer you can connect directly to the router

  • download DD-WRT build for router (search ‘RT-AC3200’ or your router model for the correct build)
  • remove the router from your network
  • perform factory reset using Hard reset method (this will reset router’s IP address to 192.168.1.1)
  • enter recovery mode
  • set your computer’s IPv4 address to something like 192.168.1.100 and connect to the router
  • browse to router’s IP at http://192.168.1.1. The recover mode screen should show up
  • click Choose File and select the DD-WRT build file downloaded.
  • click Upload

IMPORTANT: Flashing the firmware can take long time (over 10 minutes). Do NOT power off or interrupt the process or you may brick your router.

  • wait for the upload is complete
firmware upload complete
  • wait patiently (could be over 10 minutes) while router is flashing the firmware and reboot. You can ping and try browse http://192.168.1.1 to see if the install is finished.
  • when web browser responses with following screen, congratulations, you have successfully installed DD-WRT!
  • provide your credentials and click Change Password to finish initial setup
DD-WRT installed

How to revert back to official ASUS firmware?

Configure DD-WRT to serve as a wireless access point (WAP)

NOTE: DD-WRT web gui could be glitchy and not responding at times. Instead of rebooting, you could try to restart web gui server (faster).

DD-WRT default setup as a router but we only need it to serve as access point. So we will update some settings to make it run as WAP.

  • go to Setup > Basic Setup
  • select Disabled for WAN Connection Type
  • enable Assign WAN port to Switch checkbox
  • select Disabled for DHCP Server
  • click Save
Wireless access point basic setup
  • go to Setup > Advanced Routing
  • select Routing for Operating Mode
  • click Save
setup as router instead of gateway
  • go to Services > Services
  • select Disable for DNSMasq
  • click Save
disable DNS
  • go to Security > Firewall
  • select Disable for SPI Firewall
  • click Apply Settings
disable SPI firewall

Setup multiple SSIDs with VLANs support

To enable multiple SSIDs with VLANs, we will create separate bridges. One bridge for each VLAN and it’s associated wireless interface(s).

RT-AC3200 has 3 physical wireless interfaces (eth1, eth2 & eth3). 2 are 5GHz and 1 is 2.4GHz.

DD-WRT automatically created a default bridge ‘br0‘ and has all wireless interfaces, default VLAN 1 (for LAN) and VLAN 2 (for WAN) as it’s members.

The bridging table can be found at Setup > Networking

default bridge setting

Setup VLAN 40 (SSID: Mobile)

We will use all 3 wireless interfaces for VLAN 40.

Use ‘Mobile’ as SSID

  • go to Wireless > Basic Settings
  • replace ‘dd-wrt’ by ‘Mobile‘ as Wireless Network Name (SSID) for ALL 3 wireless interfaces
  • scroll down and click Apply Settings
update default SSID

Create new Bridge

  • go to Setup > Networking
  • click Add inside Create Bridge section
  • enter ‘br1‘ as Name
  • select Off for STP
  • scroll to bottom and click Apply Settings
create bridge br1

Assign wireless interfaces to the Bridge

  • click Add inside Assign to Bridge 3 times
  • select br1 as Assignment for all 3 rows
  • select eth1 as Interface for 1st row
  • select eth2 as Interface for 2nd row
  • select eth3 as Interface for the last row
  • scroll to bottom and click Apply Settings
assign to bridge br1

Setup VLAN 40 and assign to the Bridge

DD-WRT web gui can only manage VLAN 0 – 15. To use VLAN higher than 15, we would use startup script (startup commands) to perform the setup. This startup script is executed once every time the router finishes rebooting.

Note: VLAN 16 – 21 are used for other purposes. So do not use them.

  • go to Administration > Commands
  • add the following scripts to the Commands text box
  • click Save Startup
echo "4t 5t" > /proc/switch/eth0/vlan/40/ports
/sbin/vconfig add eth0 40
/sbin/ifconfig vlan40 up
/sbin/ifconfig vlan40 txqueuelen 1000
/usr/sbin/brctl addif br1 vlan40

Explanation: Configure and assign VLAN 40 to WAN port tagged (4t) and CPU port tagged (5t). Then set VLAN 40 as a member of bridge br1.

startup script to configure VLAN 40 and assign to bridge br1

Setup VLAN 42 (SSID: IoT)

We will create a virtual wireless interface for VLAN 42.

Create virtual wireless interface

  • go to Wireless > Basic Settings
  • click Add at Virtual Interfaces section below Wireless Physical Interface wl0 section
  • enter ‘IoT‘ as Wireless Network Name (SSID)
  • scroll to bottom and click Apply Settings

note: this virtual interface is named wl0.1

create virtual interface for VLAN 42

Create new Bridge

  • go to Setup > Networking
  • click Add inside Create Bridge section
  • enter ‘br2‘ as Name
  • select Off for STP
  • scroll to bottom and click Apply Settings
create bridge br2 for VLAN 42

Assign wireless interface to the Bridge

  • click Add inside Assign to Bridge
  • select br2 as Assignment
  • select wl0.1 as Interface
  • scroll to bottom and click Apply Settings
assign virtual interface to bridge br2

Setup VLAN 42 and assign to the Bridge

  • go to Administration > Commands
  • click Edit at Startup section
  • append the following scripts to the Commands text box
  • click Save Startup
echo "4t 5t" > /proc/switch/eth0/vlan/42/ports
/sbin/vconfig add eth0 42
/sbin/ifconfig vlan42 up
/sbin/ifconfig vlan42 txqueuelen 1000
/usr/sbin/brctl addif br2 vlan42
append startup script to configure VLAN 42 and assign to bridge br2

Setup VLAN 44 (SSID: Guest)

We will create a virtual wireless interface for VLAN 44.

Create virtual wireless interface

  • go to Wireless > Basic Settings
  • click Add at Virtual Interfaces section below Wireless Physical Interface wl2 section
  • enter ‘Guest‘ as Wireless Network Name (SSID)
  • scroll to bottom and click Apply Settings

note: this virtual interface is named wl2.1

create virtual interface for VLAN 44

Create new Bridge

  • go to Setup > Networking
  • click Add inside Create Bridge section
  • enter ‘br3‘ as Name
  • select Off for STP
  • scroll to bottom and click Apply Settings
create bridge br3 for VLAN 44

Assign wireless interface to the Bridge

  • click Add inside Assign to Bridge
  • select br3 as Assignment
  • select wl2.1 as Interface
  • scroll to bottom and click Apply Settings
assign virtual interface wl2.1 to bridge br3

Setup VLAN 44 and assign to the Bridge

  • go to Administration > Commands
  • click Edit at Startup section
  • append the following scripts to the Commands text box
  • click Save Startup
echo "4t 5t" > /proc/switch/eth0/vlan/44/ports
/sbin/vconfig add eth0 44
/sbin/ifconfig vlan44 up
/sbin/ifconfig vlan44 txqueuelen 1000
/usr/sbin/brctl addif br3 vlan44
append startup script to configure VLAN 44 and assign to bridge br3

Enable wireless network securities

We have setup 5 wireless interfaces (3 physical and 2 virtual). It’s time to enable their security. They are all disabled by default.

WiFi security disabled by default
  • go to Wireless > Wireless Security
  • select WPA2-PSK for Security Mode
  • enter a good key phrase for WPA Shared Key
  • click Save
enable WiFi securities for all wireless interfaces

Repeat for all 5 wireless interfaces. Note: use same password for the 3 physical wireless interfaces (wl0, wl1 & wl2)

  • click Apply Settings

Setup trunk port and management VLAN

We will configure and use WAN port as the trunk port to connect to your home network. And for security best practice, default VLAN 1 will not be used. Instead VLAN 99 will be used for native management VLAN.

IMPORTANT: DD-WRT has rearranged the ports. Starting from the left, the ports assignment are port 1, 2, 3, 4 and WAN respectively. It’s different from what’s labelled on the RT-AC3200 router.

different port assignment by DD-WRT

Setup VLAN 99 and trunk port

  • go to Administration > Commands
  • click Edit at Startup section
  • append the following scripts to the Commands text box
  • click Save Startup
echo "0u 1u 2u 3u 4t* 5t*" > /proc/switch/eth0/vlan/99/ports
/sbin/vconfig add eth0 99
/sbin/ifconfig vlan99 up
/sbin/ifconfig vlan99 txqueuelen 1000
/usr/sbin/brctl addif br0 vlan99

Explanation: Configure and assign VLAN 99 to port 1 – 4 untagged (0u 1u 2u 3u), WAN port default tagged (4t*) and CPU port default tagged (5t*). Then set VLAN 99 as a member of bridge br0.

append startup script to configure VLAN 99 and assign to bridge br0 to replace VLAN 1

Clear default VLAN 1 and VLAN 2 port assignments

  • go to Setup > VLANs
  • uncheck ALL VLAN 1
  • uncheck VLAN 2
  • click Save
clear VLAN 1 & 2 default port assignments

Assign static IP to Router

The configuration to the router is done. Now we need to assign an IP address to the router so that it’s ready to join your home network. The IP address should have the same net mask as the management VLAN 192.168.99.x.

  • go to Setup > Basic Setup
  • go to Router IP section
  • enter 192.168.99.32 as Local IP Address
  • click Apply Settings
  • reboot the router
set static IP for the router

You can disconnect your computer from the router and can now set its IPv4 address back to Obtain an IP address automatically.

Note: your computer won’t be able to connect to the router until the router joined your home network to receive an IP address from the DHCP server.

Configure pfSense and Netgear VLAN switch

Now let’s prepare pfSense and the Netgear VLAN switch with the additional VLANs before RT-AC3200 joins the home network.

Add VLAN interfaces and rules at pfSense

Follow Step 1 through 4 of Setup VLAN interfaces at pfSense firewall to add VLAN 42 and VLAN 44 to the pfSense fireware.

Add VLAN 42 and 44 to Netgear GS108Ev3 switch

  • login to the switch (would be http://192.168.99.108 if you followed the guide in Part 2)
  • go to VLAN > 802.1Q > Advanced > VLAN Configuration
  • enter 42 at VLAN ID field and click Add
  • enter 44 at VLAN ID field and click Add

Configure port 6 as a trunk port

IMPORTANT: changing port 6 to trunk port will temporarily disable the sub-network VLAN 40.

Port 6 was originally setup as VLAN 40 for use of an access point to connect all mobile devices. If you have an access point connected to port 6 for wireless connections, it’s time to unplug the access point from port 6.

Add VLAN 99 to port 6

For VLAN 99, port 6, 7 & 8 should all be untagged (show ‘U‘).

  • go to VLAN Membership
  • select VLAN ID ‘99
  • click on port 6 to show ‘U‘ (untagged)
  • click Apply
add VLAN 99 to port 6

Set port 6 PVID to management VLAN 99

  • go to Port PVID
  • enable port 6‘s checkbox
  • enter 99 to PVID text box
  • click Apply
set PVID to 99 for port 6

Convert port 6 to trunk port

  • go to VLAN Membership
  • select VLAN ID ’40’
  • click on port 6 & port 8 until both show ‘T‘ (tagged)
  • click Apply
convert port 6 to trunk port

Repeat for VLAN 42 and VLAN 44.

completed VLAN configuration
Final VLAN configuration

Hook up to the home network

Connect RT-AC3200 WAN port to port 6 of the Netgear VLAN switch and the wireless networks should be ready to use.

Configure your mobile devices to use their new SSIDs accordingly.

All set. Your home network is now properly segmented with multiple sub-networks for better protection!

Extra

How to enable SSH?

  • go to Services > Services
  • scroll down to Secure Shell
  • select Enable for SSHd
  • click Apply Settings

How to restart DD-WRT web gui?

There are times when the web gui stopped responding but the router is still working fine and you can ping the router. In this case, restarting the web gui server usually fix the problem and you don’t need to reboot the router.

  • connect to router using SSH: ssh -l root 192.168.1.1
  • enter your password to login
  • run command stopservice httpd to stop the web gui server
  • run command startservice httpd to restart the web gui server

Leave a Reply

Close Menu