Hello. Recommended a WRVS4400N router for a client of mine due to its multiple SSID and VLAN support, but I'm unable to make it do what I thought would be very easy. I wonder if anyone can shed any light on the error of my ways.
Here's the story (names and IPs changed for privacy reasons):
Site has five fixed IP addrresses from its Internet provider. One of the IPs goes to a router (Cisco 800 series) and supports a local area network for the business (including VPNs to other sites, etc. - none of which is all that important to this discussion). There is a server on the LAN and that server provides DHCP service, assigning addresses in the 192.168.200.x range.
A second fixed outside IP address is used as the WAN address on the WRVS4400N, and provides an unsecured, public WiFi service for customers on site. The LAN side of that network is assigned addresses in the 192.168.100.x range by the DHCP server built in to the router.
So far, so good.
But now, what I want to do is create a second wireless "identity" for the router that essentially makes it an access point, giving authorized people (with the right password) access to the internal, 192.168.200.x network. So: I enabled VLAN functionality on the router and created a second VLAN. Now, VLAN1 is the public network, mapped through to the 192.168.100.x addresses. VLAN2 is the private network, the idea being that it will be used for access to the private, internal network.
I created two SSIDs for the router, WiFiPublic and WiFiPrivate. WiFiPublic (with no security) was assigned to VLAN1. WiFiPrivate (with WPA security) was assigned to VLAN2. In the LAN side settings for VLAN1, I specified a router address of 192.168.100.1, and turned on DHCP distribution for the IP range 192.168.100.101 through 192.168.100.199. In the LAN side settings for VLAN2, I specified a router address of 192.168.200.250, and turned DHCP off.
Finally, I assigned all four LAN ports in the router to VLAN2. I tried a variety of ways to do this, and am pretty sure I set them so that the ports should have been associated only with VLAN2. Then I took a patch cable and patched one of the LAN ports (now part of VLAN 2) to the internal network switch (the LAN side of the other router).
So here's what I expected this configuration to do: If you connect a wireless device to the WiFiPublic SSID, it should be a part of VLAN1, which means it should get an IP address in the 192.168.100.101-199 range with a gateway of 192.168.100.1 (the wifi router's LAN adress in VLAN1). People connected to this SSID would not "see" the 192.168.200.x network, because that network is in VLAN2. If you connect a wireless device to the WiFiPrivate SSID (with the correct password), it should be a part of VLAN2, which means it should see the DHCP server out on the internal LAN, which will assign it an IP address in the 192.168.200.10-192.168.200.99 range (that's what the server's DHCP service hands out) and a gateway address of 192.168.200.254 (the address of the 800 series router). Thus, the WiFiPublic network is separate from the WiFiPrivate network, and people connecting to the private network can access internal systems but people connecting to the public network cannot.
That's what's SUPPOSED to happen.
What seems to happen instead is that the four LAN jacks are NOT isolated from VLAN1. The DHCP service provided in the internal, private network "bleeds through" to VLAN1, so that people connecting to WiFiPublic end up getting a PRIVATE IP address in the 192.68.200.x block, and further, they can see (ping, etc.) all the machines hardwired on the local LAN. Furthermore, after a time, the DHCP server on the private network apparently detects the presence of the Public DHCP server inside the WRVS4400N, which "bleeds through" to VPN2. This causes the internal DHCP server to shut down, because it thinks there's a duplicate DHCP server on the network.
So. What am I doing wrong? This seemed like a pretty simple thing. But it doesn't appear to work at all.
Any thoughts?
What I expect to happen under this configuration is that
