Setup Guest Network with OS X Server and Airport Extreme - NEED HELP!

Question

Setup Guest Network with OS X Server and Airport Extreme - NEED HELP!

Hi All,

So I have a small business with a Mac Mini Server (10.6.5) and an Airport Extreme. The Airport is handling the routing and DHCP duties, while the Server is handling the DNS. The Airport is pointed to pull DNS from the Server. All internal systems work great accessing the internet and folders on the Server.

I need to setup a Guest network for internet access, so I turned this function on in the Airport Extreme. It sets up fine, but if you connect to that new Guest Network the system hangs trying to open a web page. My thinking is since the Server is the one handling the DNS it is not working for Guest computers since they are not part of our internal network. At least that is my theory, I could be wrong.

With this type of setup what do I need to modify to get this working? Anyone have any ideas?

20" 2.4 iMac and 13" 2.53 MacBook Pro, Mac OS X (10.6.5)

Posted on Feb 2, 2011 12:00 PM

Reply

Answer 1

bfrew

Level 1

0 points

Mar 30, 2011 12:17 PM in response to Erick Reddekopp

i have just run into this problem myself. clients of the guest network get the airport's IP address for their DNS server ... but, for some reason the airport is unable to fulfill DNS requests.

in my case, i have 2 DNS servers configured in the APE: 1) internal DNS, like you, 2) external DNS (in case the internal server is down). if i remove the internal DNS from the configuration and just use the external DNS, guest access works fine.

so, that clearly means it is the internal DNS that is causing the problem. but, even when there are alternative DNS servers in the Airport configuration, it still fails. shouldn't the APE be able to use the secondary DNS to fulfill guest requests? if anybody could explain why the Airport Extreme is unable to fulfill DNS requests to the guest network, i would also appreciate it.

Reply

Answer 2

Mar 30, 2011 3:03 PM in response to bfrew

Can the guest network route IP to the private network? (That's not usually the case, after all.) If there's no route, there's no DNS, and if there's no DNS, clients will report reachability errors secondary to the DNS reachability errors. It's likely feasible to hack that access here, but then that largely defeats the purpose of a guest network.

I don't know off-hand if the Airport Extreme can have two sets of DNS servers, one for private and one for the guest LAN.

And I'd tend to keep away from having ISP DNS and local DNS in the same client configuration as you might not be getting your translations from where you think you're using. The usual uptime approach is to double up on DNS servers, configuring one as with secondary zones from the other.

Reply

Answer 3

bfrew

Level 1

0 points

Mar 30, 2011 3:36 PM in response to MrHoffman

hey mrhoffman, thanks so much for the interest in this topic!

Can the guest network route IP to the private network? (That's not usually the case, after all.)

nope, the guest network can not reach the private network. this is what apple says, and i can verify from experimentation, however, the routing table in the APE is not accessible ... at least, i don't know how to access it. nor do i really want to, separate networks is what i want.

I don't know off-hand if the Airport Extreme can have two sets of DNS servers, one for private and one for the guest LAN.

there is no obvious way of doing this ... of course, for me, that would be the best solution here!

And I'd tend to keep away from having ISP DNS and local DNS in the same client configuration as you might not be getting your translations from where you think you're using.

i see. duplicate internal DNS servers is a bit overkill for me, so i think removing the ISP DNS from the configuration would be preferred for my private network; then handling downtime appropriately ... i.e. server reboot!

but, that leaves the guest network out in the cold.

the technical part i still don't understand is what happens to the DNS request once it gets to the APE. my guest client thinks that the APE is the DNS server, it doesn't know about the internal server. it is the APE that thinks my internal server is the DNS server ... alternatively, it thinks that the ISP server is a secondary option (which after your remarks will be changed). so, when the guest client asks the APE for a DNS lookup, what happens? does the APE try to forward the client to the internal server and cause the routing issues you described? or does the APE then make a request itself to the internal server as a proxy? the thing that is causing this confusion for me is that when i look at the guest client's DNS server, it is the APE and not my internal server (however, when a private client connects, its DNS server is the internal server).

i appreciate your help and knowledge,
b

Reply

Answer 4

Mar 30, 2011 3:49 PM in response to bfrew

Check the DNS server logs and the firewall logs on the local DNS server, and see if you're getting queries forwarded from the subnet the Airport is operating for guests. Issue a few dig commands or some such over in the guest network to poke at DNS services.

(I don't run Airports in this configuration, so I don't have a way to test this.)

Reply

Answer 5

Rathelm

Level 1

10 points

Mar 30, 2011 4:45 PM in response to MrHoffman

The Airport's DHCP settings just needs to utilize one of your ISP DNS servers to feed the guest network DNS data.

Message was edited by: Rathelm for clarity

Reply

Answer 6

Mar 30, 2011 5:16 PM in response to Rathelm

The Airport's DHCP settings just needs to utilize one of your ISP DNS servers to feed the guest network DNS data.

True. But if it's (also) passing out DNS server addresses over on the private LAN, then those addresses needs to be distinct from the DNS server addresses passed out on the guest LAN.

I don't run Airport and Time Capsule in this configuration, so I don't know if it has two sets of DNS addresses. From OP, I'm assuming it does not; that the devices make the assumption that there is one set of addresses.

Another potential option is to move DHCP off the Airport or Time Capsule device for the private LAN. There are other boxes on the private LAN that can pass out addresses, not the least of which is the Mac OS X Server box that's fielding DNS services here.

Reply

Answer 7

bfrew

Level 1

0 points

Mar 31, 2011 11:41 AM in response to MrHoffman

thanks rathelm for joining us! mrhoffman has assessed my problem correctly, the APE serving as the DHCP server can only be configured to use 1 set of DNS entries. so, unfortunately, the guest and private clients get the same settings.

actually, that's not quite true, because the private clients get the actual settings ... meaning, my internal DNS server IP address, whereas the guest clients get the IP address of the APE. but, it seems the effect is the same ... guest clients trying to get DNS information from the private DNS server.

Check the DNS server logs and the firewall logs on the local DNS server, and see if you're getting queries forwarded from the subnet the Airport is operating for guests.

okay, i did my homework and there is no indication in any log that communication is being attempted between the APE and the internal DNS server when guest clients start making DNS requests. having access the the APE logs might be useful, my guess now is that the APE firewall is stopping the communication (... as it should, i suppose).

From OP, I'm assuming it does not; that the devices make the assumption that there is one set of addresses.

yep, that is my story. there is no way to do it using the Airport Utility, at least.

Another potential option is to move DHCP off the Airport or Time Capsule device for the private LAN

now we are getting back to the more technically complex environment that i thought the APE w/ guest network would simplify. i have had this environment working with a router hierarchy and separate DHCP servers ... but, i was really hoping to pare down the equipment, so that the complexity of the setup matched the technical needs/savvy of the office.

i think, maybe the conclusion is that unless Apple decides to allow one to configure private and guest DNS settings separately, the setup i describe above is beyond the scope of the APE alone.

Reply

Answer 8

Jan 1, 2012 9:51 AM in response to Erick Reddekopp

After trying for days to figure this out I was finally able to get a working solution and I now have my APE providing a guest and main network while using my lion server as the Dsn server for the main network.

The setup is a bit of a hack and does require you to have at least two devices with staticly assigned ip information on the main network but it does allow you to serve dhcp for both networks from the server and make some services available to the guest network such as iTunes remote for parties.

1) delete your custom Dns entries from the Internet settings in the APE and set two dhcp reservations for .2 and .3 (in this case my Mac mini server and my airport express)

2) reduce the dhcp range to only have 2 available IPs (10.0.1.2-10.0.1.3) and save settings

3) on a computer connected to the main network install wireshark and begin sniffing for packets. Connect at least one device to your guest network and look for any packets that have an ip from your guest network (usually 172.16.42.x) once you capture one of these packets expand the vlan information. This should list a vlan ID ( in my case this was 1003. I would suspect this is universal but do not know)

4) on your server open network preferences, click the gear at the bottom and click "manage virtual interfaces", add a vlan that matches the vlan ID from above. Click ok and apply your settings. The vlan interface should get an ip in the guest network range from your APE.

* if you are running lion you will need to install server admin tools before proceeding*

5) open server admin and add the dhcp service. Create an entry for your primary network (ex: 10.0.1.x) make the dhcp range one higher than the settings in step 2 ( ie: 10.0.1.4 to 10.0.1.253) assign this to the physical interface. Make sure this entry has your internal DNA servers

6) add another entry for the guest networks ip range (ex: 172.16.42.x) again set it one ip higher than step 2 ( 172.16.42.4 to 172.16.42.253) save and activate both ranges. Assign this range to the vlan interface. Make sure this entry either contains your isps dns servers or another public dns server. Turn on dhcp.

Because you have now assigned the only two addresses in the APEs pool for your primary network to static entries there will not be any addresses to assign and the APE will not respond to requests. This will allow your server to pick up the work of assigning IPs. As for your guest network, the APE will assign IPs for two host and then stop. Your clients may either get an IP from the APE or the osx server so both should have the same info. Just make sure the two static clients on your main network have the local DNA servers entered manually.

Reply

Answer 9

Grind

Level 1

5 points

Jan 2, 2014 2:28 AM in response to RobertM1984

Thank you so much Robert! It took me hours to find your post, but it was very helpful! I might add that the VLAN ID of my newly purchased Airport Extreme also was 1003, so it's possible that's a universal setting.

Reply