DNS Setting on GR10-HW-EU

[chrisse]

I have several GR10-HW-EU access points set up. They broadcast both Guest WIFI's (which I have configured in my Meraki Go App) and "ordinary" WIFI's (which use my IP Pool and DHCP provided by the central Cisco Business 350 Series Managed Switches). If a client connects to the "ordinary" WIFI's, which are part of my home network, they are assigned an IP from the configured IP pool.

The devices on my Guest WIFI are unable to reach devices in my "normal" network, which is what I want. I have seen that they are assigned a different IP address (like completely different IP address range) compared to my "ordinary" WIFI. So far, this is logical. Also note that the GR10-HW-EU-Access points all have a static IP address which is on the same subnet than my IP pool (but the access points have a static IP and do not use DHCP and the IP pool).

However, my central DNS is also part of my home network. I have configured each access point to use the DNS on my home network. I have realized that the Guest WIFI devices seem to use the DNS on my home network as well, which first appeared a bit strange to me. I thought that the Guest WIFI devices (different IP address) would be completely shielded from accessing any device in my home network. The devices as such (ie. my kids tablets are on guest wifi) are unable to access other devices on the local network directly (ie. cannot print on my printer in my home network), but it appears as if the access point then uses it's own internal IP address to route the traffic to the local network and the DNS (somehow behaving like a router).

Is this how it's supposed to work and is my explanation (that the AP indeed acts like a small router) sound and valid? Or am I missing a point here?

[Karsten Iwen · Accepted solution]

This is also the way the "regular" Meraki APs do Guest-networks. The AP itself provides the new IP network and the AP applies NAT/PAT to all guest traffic and sends it out with it's own IP address. By default the AP itself is the DNS-server for the client and the AP forwards DNS to it's own upstream DNS server which is your internal DNS. But access-control should still be applied. Your guests might be able to resolve the names of your printer, but they can't reach the internal devices.

BTW: There is a dedicated community for Meraki Go: https://community.meraki.com/t5/Meraki-Go-Community/ct-p/go

[chrisse]

Thanks Karsten for your response and clarification. This confirms my observation.

Thanks also for pointing me to the Meraki-Community. I was unaware of this, as I used to post my Cisco Switch - question(s) in this forum. I'll stick to the Meraki Go-Forum for future Meraki-questions.

[Rich R]

You don't have to use NAT mode.  In your case it would be better to use Bridge mode and leave the NAT to your home network.  That way all your wireless clients will be on the same broadcast domain/subnet and you'll be able to use peer to peer applications like printing

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignment
https://documentation.meraki.com/Go/Features/Meraki_Go_-_Wireless_Address_Translation