IMPORTANT: installing custom firmware always pose risk of bricking your device. Do it at your own risk.

This guide will show you how to use custom firmware Tomato by Shibby on Asus RT-N66U as a wireless access point (WAP) to setup multiple Wi-Fi VLANs.

This is an alternate method of setting up Wi-Fi subnets of a 3 steps guide to protect home network using subnets.

Prerequisite: VLAN infrastructure in place for the wired network described in Part 1 and Part 2 of the 3 steps guide.

This guide will step you through the flash of custom firmware Tomato and setup the 3 wireless VLANs.

  • VLAN 40 (SSID: Mobile): Your mobile devices
  • VLAN 42 (SSID: IoT): IoT devices
  • VLAN 44 (SSID: Guest): Guest devices

How to enable recovery mode for RT-N66U?

Asus router has recovery mode that allows you the flash firmware or reset to default settings (or factory reset for official firmware).

reset button
  1. turn off the router
  2. press and hold the reset button (do not release)
  3. turn on the router
  4. wait for about 8 seconds on official firmware (or 5 seconds on Tomato)
  5. release the reset button
recovery mode
Recovery mode

How to factory reset?

There are several ways of performing factory reset. Each method shall achieve the same results.

Hard Reset

The 30/30/30 reset works on older routers, but not new routers like RT-N66U. So don’t use it.

  • with the unit turned on, press and hold the reset button
  • wait until power led started blinking slowly (about 5 seconds)
  • release the reset button

Reset using Recovery mode

  • enable recovery mode
  • click on Restore default NVRAM values
erase NVRAM
Factory reset by clearing NVRAM

Reset using web gui

  • access web gui of the router
  • go to Administration > Restore/Save/Upload Setting
  • click Restore and then OK
factory reset

Note: if you are already on Tomato, go to Administration > Configuration > Restore Default Configuration, select Erase all data in NVRAM memory and click OK.

How to flash Tomato?

Note: The Administration > Firmware Upgrade option available in the web gui of the latest official firmware (v3.0.0.4.382_50624) does not allow you to flash custom firmware.

What you need: A stand alone computer you can connect directly to the router

  • download Tomato firmware (look for build specific for RT-N66U)
  • remove the router from your network
  • perform factory reset using Hard reset method (this will reset router’s IP address to 192.168.1.1)
  • enter recovery mode
  • set your computer’s IPv4 address to something like 192.168.1.100 and connect to the router
  • browse to router’s IP at http://192.168.1.1. The recover mode screen should show up
  • click Choose File and select the Tomato build file downloaded.
  • click Upload

IMPORTANT: Flashing the firmware can take long time (over 10 minutes). Do NOT power off or interrupt the process or you may brick your router.

flash firmware
  • wait for the upload is complete
firmware upload complete
  • wait patiently (could be over 10 minutes) while router is flashing the firmware and reboot. You can ping and try browse http://192.168.1.1 to see if the install is finished.
  • when web browser responses with following screen, congratulations, you have successfully installed Tomato!
Tomato installed

How to revert back to official ASUS firmware?

Configure Tomato to serve as a wireless access point (WAP)

When used as access point, we don’t need the WAN port. So we can disable it.

  • go to Basic > Network
  • select Disabled for WAN Settings > Type
  • click on Bridge br0 in LAN section
  • uncheck DHCP checkbox
  • click OK
  • scroll down and click Save
disable WAN port

Setup multiple SSIDs with VLANs support

To enable multiple SSIDs with VLANs, we will create separate bridges. One bridge for each VLAN and it’s associated wireless interface(s).

RT-N66U has 1 physical 5GHz wireless interface (eth1).

Tomato automatically created a default bridge ‘br0‘ and has wireless interface and default VLAN 1 (for LAN) as it’s members.

Create 3 new Bridges

We will create one new Bridge for each VLAN.

  • go to Basic > Network
  • go to LAN section
  • create bridge for VLAN 40
    • select 1 for Bridge
    • enter 192.168.40.1 for IP Address
    • enter 255.255.255.0 for Netmask
    • click Add
  • create bridge for VLAN 42
    • select 2 for Bridge
    • enter 192.168.42.1 for IP Address
    • enter 255.255.255.0 for Netmask
    • click Add
  • create bridge for VLAN 44
    • select 3 for Bridge
    • enter 192.168.44.1 for IP Address
    • enter 255.255.255.0 for Netmask
    • click Add
  • scroll down and click Save
Create Bridges

Update Wireless Interface eth1 (VLAN 40)

We will update settings for eth1, assign to br1 and enable security.

  • go to Advanced > Virtual Wireless
  • click on eth1 interface
  • enter ‘Mobile‘ for SSID
  • select br1 for Bridge
  • click OK
update SSID for physical wireless interface and assign to bridge br1
  • click on eth1 (wl0) tab
  • select WPA2 Personal for Security
  • enter a good key phrase for Shared Key
  • scroll down and click Overview
  • click Save
enable security for VLAN 40

Create Virtual Wireless Interface for VLAN 42

To enable multiple SSIDs, we need to create virtual wireless interface.

  • continue at Advanced > Virtual Wireless
  • select wl0.1
  • enter ‘IoT‘ for SSID
  • select br2 for Bridge
  • click Add
Create virtual interface for VLAN 42
  • select WPA2 Personal for Security
  • enter a good key phrase for Shared Key
  • scroll down and click Overview
  • click Save
enable security for VLAN 42

Create Virtual Wireless Interface for VLAN 44

  • select wl0.2
  • enter ‘GuesT‘ for SSID
  • select br3 for Bridge
  • click Add
Create virtual interface for VLAN 44
  • select WPA2 Personal for Security
  • enter a good key phrase for Shared Key
  • scroll down and click Overview
  • click Save
Enable security for VLAN 44

Configure VLAN settings

We will configure and use port 4 as trunk port (to connect to the Netgear VLAN switch).

  • setup the VLAN settings according to the screen below
  • scroll down and click Save and then OK to confirm
  • the router will now reboot
Configure VLAN settings for VLAN 40, 42, 44 & 99

Assign static IP to Router

The configuration to the router is done. Now we need to assign an IP address to the router so that it’s ready to join your home network. The IP address should have the same net mask as the management VLAN 192.168.99.x.

  • go to Basic > Network
  • click on Bridge br0
  • enter 192.168.99.66 as IP Address
  • uncheck DHCP checkbox
  • click OK
  • scroll down and click Save
set static IP of router to match home network

You can disconnect your computer from the router and can now set its IPv4 address back to Obtain an IP address automatically.

Note: your computer won’t be able to connect to the router until the router joined your home network to receive an IP address from the DHCP server.

Configure pfSense and Netgear VLAN switch

Now let’s prepare pfSense and the Netgear VLAN switch with the additional VLANs before RT-N66U joins the home network.

Add VLAN interfaces and rules at pfSense

Follow Step 1 through 4 of Setup VLAN interfaces at pfSense firewall to add VLAN 42 and VLAN 44 to the pfSense fireware.

Add VLAN 42 and 44 to Netgear GS108Ev3 switch

  • login to the switch (would be http://192.168.99.108 if you followed the guide in Part 2)
  • go to VLAN > 802.1Q > Advanced > VLAN Configuration
  • enter 42 at VLAN ID field and click Add
  • enter 44 at VLAN ID field and click Add

Configure port 6 as a trunk port

IMPORTANT: changing port 6 to trunk port will temporarily disable the sub-network VLAN 40.

Port 6 was originally setup as VLAN 40 for use of an access point to connect all mobile devices. If you have an access point connected to port 6 for wireless connections, it’s time to unplug the access point from port 6.

Add VLAN 99 to port 6

For VLAN 99, port 6, 7 & 8 should all be untagged (show ‘U‘).

  • go to VLAN Membership
  • select VLAN ID ‘99
  • click on port 6 to show ‘U‘ (untagged)
  • click Apply
add VLAN 99 to port 6

Set port 6 PVID to management VLAN 99

  • go to Port PVID
  • enable port 6‘s checkbox
  • enter 99 to PVID text box
  • click Apply
set PVID to 99 for port 6

Convert port 6 to trunk port

  • go to VLAN Membership
  • select VLAN ID ’40’
  • click on port 6 & port 8 until both show ‘T‘ (tagged)
  • click Apply
convert port 6 to trunk port

Repeat for VLAN 42 and VLAN 44.

completed VLAN configuration
Final VLAN configuration

Hook up to the home network

Connect RT-N66U port 4 to port 6 of the Netgear VLAN switch and the wireless networks should be ready to use.

Configure your mobile devices to use their new SSIDs accordingly.

All set. Your home network is now properly segmented with multiple sub-networks for better protection!

This Post Has 2 Comments

  1. This is a great guide and exactly what I was looking for. There is not a lot of these out there for this specific configuration, with pfsense, managed switch and Tomato firmware WAP. Now all I need to do is to follow this guide 🙂

    1. Awesome, glad that it’s useful for you. Thanks for your feedback. 😁

Leave a Reply

Close Menu