6 Replies Latest reply: Jun 28, 2014 5:10 AM by Alex Narvey
RobertM1984 Level 1 (10 points)

After trying for days to figure this out I was finally able to get a working solution and I now have my APE providing a guest and main network while using my lion server as the Dsn server for the main network.


The setup is a bit of a hack and does require you to have at least two devices with staticly assigned ip information on the main network but it does allow you to serve dhcp for both networks from the server and make some services available to the guest network such as iTunes remote for parties.


1) delete your custom Dns entries from the Internet settings in the APE and set two dhcp reservations for .2 and .3 (in this case my Mac mini server and my airport express)


2) reduce the dhcp range to only have 2 available IPs ( and save settings


3) on a computer connected to the main network install wireshark and begin sniffing for packets. Connect at least one device to your guest network and look for any packets that have an ip from your guest network (usually 172.16.42.x) once you capture one of these packets expand the vlan information. This should list a vlan ID ( in my case this was 1003. I would suspect this is universal but do not know)


4) on your server open network preferences, click the gear at the bottom and click "manage virtual interfaces", add a vlan that matches the vlan ID from above. Click ok and apply your settings. The vlan interface should get an ip in the guest network range from your APE.


* if you are running lion you will need to install server admin tools before proceeding*


5) open server admin and add the dhcp service. Create an entry for your primary network (ex: 10.0.1.x) make the dhcp range one higher than the settings in step 2 ( ie: to assign this to the physical interface. Make sure this entry has your internal DNA servers


6) add another entry for the guest networks ip range (ex: 172.16.42.x) again set it one ip higher than step 2 ( to save and activate both ranges. Assign this range to the vlan interface. Make sure this entry either contains your isps dns servers or another public dns server. Turn on dhcp.


Because you have now assigned the only two addresses in the APEs pool for your primary network to static entries there will not be any addresses to assign and the APE will not respond to requests. This will allow your server to pick up the work of assigning IPs. As for your guest network, the APE will assign IPs for two host and then stop. Your clients may either get an IP from the APE or the osx server so both should have the same info. Just make sure the two static clients on your main network have the local DNA servers entered manually.

Mac mini, Mac OS X (10.7.2), Lion Server
  • MplsEE08 Level 1 (65 points)

    I was having this same issue and this solution fixed it. However, when I attach my iPad to the guest network and do a network scan, I can access my server and all the services on it. If I manually change the DNS server settings, I can access all my internal intranet sites. How do I configure it to only provide DHCP services, and nothing else, for the VLAN?

  • RobertM1984 Level 1 (10 points)

    You would have to configure the firewall on your lion server to allow that traffic only from the main network and block it from the guest network

  • FSIT Level 1 (0 points)

    I had the same problem, then realised it was a simple DNS issue.


    Connect to the wireless Guest Network (it doesn't matter if you are using the 172.16.x.x or 192.168.x.x range) and open the advanced section of the Network settings.  Click the DNS tab and enter at lest one Public DNS Servere - I use and and hey presto - it works just fine!!!

  • TMA.HA Level 1 (0 points)

    This doesn't seem to work on the latest Airport Extreme 802.11ac model.


    I have the internal network working, but cannot seem to get hold of the vlan ID for the guest network.


    Any suggestions?

  • gliepins Level 1 (0 points)


    thanks everyone for the brainstorm.

    I managed to get it working.

    Airport Extreeme base station with 2,4 and 5ghz modes working,

    Guest network too, and the AE is set into bridge mode!

    I have another router, that does the routing and dhcp. That is a mikrotik RB450 router with 5ports.

    The trick is to have AE connected with 2 wires to the main router!

    The main wire goes from AE Wan port to the main router lan port, and the second wire goes from AE lan port to the routers other internal lan port. The AE is set to get external ip from my router and that chain works alright.

    Now the second wire is connected to an isolated port on the router. That way we make sure we serve the whole purpose of GuestNetwork. That isolated port is also set as a master port to host VLAN port with ID=1003.

    The last thing to do is to make a separate dhcp service running on the VLAN port alone. (not the phisical port).

    It doesn't matter what ip range you give out by your second dhcp service, as long as it plays well in your subnet scheme. You can simply put both your main and the guest networks close like and The dns enries stay the same for both networks.

    It should work with any router capable of VLAN and with at lease two lan ports avail.

    Forget about sniffing ip ranges out of your AE device. It's useless! Along with the vlan tag 1003 any dhcp service met on the vlan path will respong to your guest request.

    Good luck!

  • Alex Narvey Level 1 (0 points)

    I have a working solution now for using an AirPort Extreme in Bridge mode below a 3rd party router and having its Guest network work properly.



    It involves creating a special VLAN (ID = 1003) on the router.


    Once I had sorted out all the details it works great.


    It is relatively easy to do, but complex enough that I chose to describe it in detail with screen shots and diagrams in a pdf I have uploaded to the new Tutorials section of the R.A.I.S. page at http://rais.precursor.ca