Level 1

0 points

Is Airport Extreme's Guest Network Really Secure?

Hi,

How secure is Airport Extreme's guest network & how exactly is it configured?

I am trying to set up two separate networks. Presently I am running the following:

-ISP modem hardwired to wireless Mac Airport router
-2 older XP desktops hardwired to Mac Airport router & 1 MacBook connected to Airport router wireless

Like so- modem --> Airport --> 2 pc's & 1 wireless Mac

I need to add a work laptop to the mix & do not want it in my existing network. So, I was planning on doing the following but was having problems with double-nating:

-ISP modem wired to new internet router
-new internet router wired to Airport Extreme (i.e.: my existing network setup) & to new router (i.e.: new network)

Like so- modem --> new internet router --> Airport(existing network) & new router(new network)

BUT... after struggling to get this working, I removed the new internet router & went back to my original setup & reset the Airport Extreme. During this simple resetting process on the Airport, I was prompted to setup a separate guest network! I didn't know this was an option & that it seems to do what I need & was trying to do with the extra routers.

Which brings me back to my question...How secure is Airport Extreme's guest network & how exactly is it configured? Will this simple Guest Network truly give me two completely separate networks? In other words, if I connect my work machine to the guest network & the work machine is infected, for example, is my existing network protected?

Thank you!

Mac OS X (10.6.5)

Posted on Dec 20, 2010 2:58 PM

22 replies

Orange991 Author

Level 1

0 points

Dec 26, 2010 10:23 AM in response to Tesserax

{quote}Remember routers can be both DHCP clients and DHCP servers. In this case I was referring to using static IPs on all of the downstream routers' WAN-sides, regardless of if they are configured as bridges or not. For those not configured as bridges, configuring them to act as DHCP servers will make configuring the network simpler.

So the main Internet router would be both a DHCP client and server; the AEBSn would just be a DHCP server, and the Linksys 2000 would be neither as it would be bridged. Make sense?{quote}

Kinda :-o FYI, the Linksys 2000 actually has NAT enabled too. So, I suppose I am a bit confused. The internet router would be set to all DHCP so that when my ISP changes the IP address, I will still be ok, right? But, if I set the other 2 routers to DHCP server only, those routers IP's will stay fixed & all of the machines connected to those routers will will be given various fixed network IP's,(which happens regardless) right?

If I have this right, how is setting up these two routers as servers any different than not? Either way, wouldn't the internet router distribute fixed IP's to the Airport & 2000? And, I assume there is an easy to find setting to set the routers to act as servers only? Sorry for all the questions!

{quote}For the 2.4 GHz band, you want at least 3-5 channel separation. Even more the better. So, if one is operating on channel 1. Use 6 or 11 for the other.

For the 5 GHz band, if one is operating on channel 149, the next available (153) would be fine. Note: The higher channels on this band provide operate at a higher power.{quote}

Well, keep in mind that both routers are dual band, 2.4 & 5 GHz

Thanks again! Your efforts are above & beyond!

Tesserax

Level 10

160,848 points

Dec 26, 2010 12:42 PM in response to Orange991

The internet router would be set to all DHCP so that when my ISP changes the IP address, I will still be ok, right? But, if I set the other 2 routers to DHCP server only, those routers IP's will stay fixed & all of the machines connected to those routers will will be given various fixed network IP's,(which happens regardless) right?

I would expect that you would have the Internet (aka, Main) router configured as a DHCP client (on the WAN-side to accept the dynamic Public IP address that your ISP is providing you) and a DHCP server on the LAN-side (to provide dynamic Private IP addresses to all network clients connected to it ... including the two other routers. I am just suggesting that you configure these downstream routers with static Private IP addresses instead.

Also, both of these downstream routers would be configured with both NAT and DHCP server enabled. That way, they can create networks with a different range of dynamic Private IP addresses from both each other and the Main router.

If I have this right, how is setting up these two routers as servers any different than not?

That way, they can create networks with a different range of dynamic Private IP addresses from both each other and the Main router.

Either way, wouldn't the internet router distribute fixed IP's to the Airport & 2000?

No. By default the Internet router's DHCP server would provide dynamic IP addresses to these downstream routers ... not fixed ones.

And, I assume there is an easy to find setting to set the routers to act as servers only?

There should be. I am familiar with the BEFSR41, but not the 2000. Either way I could try to download the user guides for both if you need help with the settings.

Sorry for all the questions!

Sorry for all the answers! 😉

Well, keep in mind that both routers are dual band, 2.4 & 5 GHz

Right, but also keep in mind that two routers that are near each other could potentially interfere with each other should they be operating on the same channels ... regardless of which radio band. That is two 2.4 or two 5 GHz networks could conflict.

Orange991 Author

Level 1

0 points

Dec 27, 2010 6:41 AM in response to Tesserax

Goodness! Great detailed answers!

Having said that...I still have more questions 😉

{quote}I am just suggesting that you configure these downstream routers with static Private IP addresses instead.{quote}

Why static as opposed to the default settings? What's wrong w/ dynamic?

Also, I do need to have a look inside these routers to see their configuration options. I wasn't aware that I could have both a static IP & DHCP function simultaneously... & at the same time too 🙂 I'll need to re-read your instructions & log into the routers to have a look around. Perhaps that will allow for a better understanding of what you are so graciously trying to explain to me.

{quote}That way, they can create networks with a different range of dynamic Private IP addresses from both each other and the Main router.{quote}

Ok...this is what I know a router to do by default. I suppose I wasn't thinking of one that is NOT being used as a server.
Thanks!

Tesserax

Level 10

160,848 points

Dec 27, 2010 1:31 PM in response to Orange991

Why static as opposed to the default settings? What's wrong w/ dynamic?

There's nothing wrong, per se, but it is a good practice to assign static IP addresses to dedicated networking infrastructure devices ... like routers and wireless access points. For example, if you have a NAS device, you will always be able to located it by IP address if that address is static.

FWIW, for my home network, my Internet (upstream) router is a Cisco RVS4000. It feeds into an Ethernet network which has a number of 802.11n AirPort Extreme Base Station (AEBSn) to provide wireless coverage throughout the house. Both AEBSns are bridged. Also attached to the RVS4000 is another Cisco Ethernet switch which supports VLANs. I use this switch to provide a number of dedicated VLAN networks to my home office for both data and VoIP.

In my networking scenario, the RVS4000 is configured as both a DHCP Client (to get the dynamic Public IP addresses from my ISP) and as a DHCP Server to provide IP addresses to all of the network clients. In addition, since I configured a number of VLANs, the RVS4000 is also able to provide dynamic Private IP addresses to the VLANs in a different address range.

Orange991 Author

Level 1

0 points

Dec 28, 2010 10:03 AM in response to Tesserax

Ok Tesserax...I think I've got it all set-up per your recommendations!

I manually set the wireless channels on both the AEBS & the Linksys 2000. We'll see how they perform. Changing the channel configuration is easy enough.

I also set both of the same routers IP's to static however I would like to be sure I did what you suggested...

On the AEBS, I went from Network Prefs > TCP/IP > Configure IPv4 > Using DHCP with manual IP address, & set the IP just as it was when set to DHCP Auto.

On the 2000, from the router's Basis Set-up screen, I changed the Internet Connection Type to Static IP & set the Internet IP Address to what is was when using DHCP. The Subnet Mask & Default Gateway were already filled in, I think. I also filled in DNS 1, 2, & 3 using exactly the same info from the Status screen when the router was set to DHCP.

How did I do?

Also, I noticed that both the AEBS & the Linksys 2000 both show the same internet IP address. Makes sense yet two machines cannot use the same IP so, correct me if I am wrong, this is remedied by the BEFS41 acting as a server & distributing different IP's to whatever is connected to its LAN ports. And, each of the network routers in turn distribute different IP's to their clients.

I hope I've got all this right...more for your sake than mine 😉 Thanks!!

Tesserax

Level 10

160,848 points

Dec 28, 2010 12:25 PM in response to Orange991

Looks like you did a great job getting it set up. Enjoy! ...and Happy New Year!

Orange991 Author

Level 1

0 points

Dec 28, 2010 3:13 PM in response to Tesserax

Thank you so much for all of your time & support! It is greatly appreciated!!

I hope you feel much reward for all of the time you must spend helping others. After all, you have posted 28,725 times. That should make for plenty of satisfaction 🙂

I spend my share of time in various forums & not everyone displays your patience, efforts & attitude. Happy New Year!

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is Airport Extreme's Guest Network Really Secure?