Skip navigation

Tip: AirPort Extreme guest network with internal DNS for primary

5869 Views 5 Replies Latest reply: Jan 21, 2014 8:41 AM by gliepins RSS
RobertM1984 Calculating status...
Currently Being Moderated
Jan 1, 2012 9:58 AM

After trying for days to figure this out I was finally able to get a working solution and I now have my APE providing a guest and main network while using my lion server as the Dsn server for the main network.


The setup is a bit of a hack and does require you to have at least two devices with staticly assigned ip information on the main network but it does allow you to serve dhcp for both networks from the server and make some services available to the guest network such as iTunes remote for parties.


1) delete your custom Dns entries from the Internet settings in the APE and set two dhcp reservations for .2 and .3 (in this case my Mac mini server and my airport express)


2) reduce the dhcp range to only have 2 available IPs ( and save settings


3) on a computer connected to the main network install wireshark and begin sniffing for packets. Connect at least one device to your guest network and look for any packets that have an ip from your guest network (usually 172.16.42.x) once you capture one of these packets expand the vlan information. This should list a vlan ID ( in my case this was 1003. I would suspect this is universal but do not know)


4) on your server open network preferences, click the gear at the bottom and click "manage virtual interfaces", add a vlan that matches the vlan ID from above. Click ok and apply your settings. The vlan interface should get an ip in the guest network range from your APE.


* if you are running lion you will need to install server admin tools before proceeding*


5) open server admin and add the dhcp service. Create an entry for your primary network (ex: 10.0.1.x) make the dhcp range one higher than the settings in step 2 ( ie: to assign this to the physical interface. Make sure this entry has your internal DNA servers


6) add another entry for the guest networks ip range (ex: 172.16.42.x) again set it one ip higher than step 2 ( to save and activate both ranges. Assign this range to the vlan interface. Make sure this entry either contains your isps dns servers or another public dns server. Turn on dhcp.


Because you have now assigned the only two addresses in the APEs pool for your primary network to static entries there will not be any addresses to assign and the APE will not respond to requests. This will allow your server to pick up the work of assigning IPs. As for your guest network, the APE will assign IPs for two host and then stop. Your clients may either get an IP from the APE or the osx server so both should have the same info. Just make sure the two static clients on your main network have the local DNA servers entered manually.

Mac mini, Mac OS X (10.7.2), Lion Server
  • MplsEE08 Level 1 Level 1 (25 points)

    I was having this same issue and this solution fixed it. However, when I attach my iPad to the guest network and do a network scan, I can access my server and all the services on it. If I manually change the DNS server settings, I can access all my internal intranet sites. How do I configure it to only provide DHCP services, and nothing else, for the VLAN?

  • FSIT Calculating status...

    I had the same problem, then realised it was a simple DNS issue.


    Connect to the wireless Guest Network (it doesn't matter if you are using the 172.16.x.x or 192.168.x.x range) and open the advanced section of the Network settings.  Click the DNS tab and enter at lest one Public DNS Servere - I use and and hey presto - it works just fine!!!

  • TMA.HA Calculating status...

    This doesn't seem to work on the latest Airport Extreme 802.11ac model.


    I have the internal network working, but cannot seem to get hold of the vlan ID for the guest network.


    Any suggestions?

  • gliepins Calculating status...


    thanks everyone for the brainstorm.

    I managed to get it working.

    Airport Extreeme base station with 2,4 and 5ghz modes working,

    Guest network too, and the AE is set into bridge mode!

    I have another router, that does the routing and dhcp. That is a mikrotik RB450 router with 5ports.

    The trick is to have AE connected with 2 wires to the main router!

    The main wire goes from AE Wan port to the main router lan port, and the second wire goes from AE lan port to the routers other internal lan port. The AE is set to get external ip from my router and that chain works alright.

    Now the second wire is connected to an isolated port on the router. That way we make sure we serve the whole purpose of GuestNetwork. That isolated port is also set as a master port to host VLAN port with ID=1003.

    The last thing to do is to make a separate dhcp service running on the VLAN port alone. (not the phisical port).

    It doesn't matter what ip range you give out by your second dhcp service, as long as it plays well in your subnet scheme. You can simply put both your main and the guest networks close like and The dns enries stay the same for both networks.

    It should work with any router capable of VLAN and with at lease two lan ports avail.

    Forget about sniffing ip ranges out of your AE device. It's useless! Along with the vlan tag 1003 any dhcp service met on the vlan path will respong to your guest request.

    Good luck!


More Like This

  • Retrieving data ...

Bookmarked By (2)

This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.