OpenWrt Access Point & Routed AP with Guest WiFi on AGPF modem/router

The Pirelli Alice Gate VoIP 2 Plus, also known as agpf, is a ADSL modem router with WiFi and Voip capabilities.
The main chip is the BCM6358KFBG, they support OpenWrt.
OpenWrt is a linux distribution for embedded devices, you can find further information on the openwrt website: https://openwrt.org. Although hardware Voip and ADSL is not supported on this router, this device can be pretty usefull for other network roles.

I've saved three of them from junkyard and I start playing with that devices.

This post reports how I've built a Access Point and a Routed Access Point for a Guest WiFi using OpenWrt.
Also a wired guest connection is served.

Let's suppose we are serving our main network on 192.168.1.0/24 ip ranges, and we would like a guest network, isolated from the 192.168.1.0/24 one, on the 192.168.2.0/24 ip range.

The following steps is needed only if your router hasn't OpenWrt on board.
The first step to start the game will be load the OpenWrt firmware.
The following steps may brick your device, so continue at your risk.
You can find a complete guide here: https://wiki.openwrt.org/toh/pirelli/agpf.
Summarizing it will be very simple, you just have to connect the router to a RS232 port, set the port at 115200 baud, no parity, 8bits and open your terminal software. Here you can the serial connection pins https://wiki.openwrt.org/_media/media/pirelli/alice-agpf.jpg, on the left the GND, top right RX, bottom right TX).
To enter the CFE prompt, you can press any key during the boot process, when the countdown stop message appears.
You have to run a TFTP server, to provide the firmware to your router.
I'm using tftpd32 (http://tftpd32.jounin.net/) and the Chaos Calmer 15.05.1 firmware (https://downloads.openwrt.org/chaos_calmer/15.05.1/brcm63xx/generic/openwrt-15.05.1-brcm63xx-generic-AGV2+W-squashfs-cfe.bin).
Just put the firmware in your tftpd32 folder, run the software and select the server interface to serve.
Supposing your interface is 192.168.1.120, on the CFE prompt you have to run the flashimage command as follow
> flashimage 192.168.1.120:openwrt-15.05.1-brcm63xx-generic-AGV2+W-squashfs-cfe.bin
This would load the firmware on your router.
The router will reboot, and you can now access the router by the 192.168.1.1 address on your web browser.
Note: if you would like to change your IP address using serial interface, just edit the network config file using the command
$vi /etc/config/network
You should change the ipaddr of the interface 'lan', also you can add your gateway and dns option here.

Now that you have a working OpenWrt device, we can setup it to provide the main WiFi access and a guest WiFi access.

Just open the Luci web interface of your OpenWrt, set your password and enable a SSH access to the main lan. The SSH access allows us to run configuration command throgh a SSH terminal.

Before going on we have to say that the WiFi board of this router does not support multiple SSID, so we have to use a USB adapater.
The following steps is needed only if your OpenWrt router does not supports multiple SSID and you have a RT72 driver compatible device, otherwise you must use your device proper driver.
I've a Ralink RT2501USB/RT2571W usb adapater, to make it work with at AGPF router we have to load the modules for USB and for the adapter.
We will do this by the opkg package system.
After the system reboot, to update the packages repository, we will run the command
$opkg update
We will install usbutils and the wireless tools, not closely needed but may be usefull
$opkg install usbutils
$opkg install wireless-tools
Now we are going to install USB modules
$opkg install kmod-usb-uhci
$opkg install kmod-usb2
A reboot is needed now.
We will install the Ralink RT2501USB/RT2571W (RT73) module
$opkg install kmod-rt73-usb
We will now reboot.
Now you should see a secondary WiFi on the Luci web interface.

We can now setup the first WiFi interface, and bind that to the lan network.
The DHCP must be disabled on the lan network to simulate an AP bridge behaviour.

We will make a new switch, that is new VLAN.
On VLAN 1, we disable port 2, 3 and 4, set 5 is untagged
On VLAN 2, we enable port 3, 5 is tagged
We are going to use port 3 as a wired guest port.
Note that the port 5 is the CPU, the physical port for port 3 is Eth4, port 2 Eth3.. and so on.

The untagged traffic will run on VLAN 1, the tagged one on VLAN 2.

Now we have to add guest firewall rules for guest interface.

This rule has to accept input, accept output, reject forward and Allow forward to destination zones -> lan, this way all the traffic will be forwared to lan.

The lan firewall rule must have enabled Masquerading and MSS clamping, it also have to Allow forward from source zones -> guest, to accept the forward traffic from guest, and Restrict Masquerading to all subnet but not the 192.168.1.0/24, by the value !192.168.1.0/24.

We can now add a guest interface, as bridge and add the VLAN 2 created on port 3.
We are going to set the guest interface with a static address, and enable DHCP for the guest interface assign the interface to the guest firewall zone.

Now we can set the guest WiFi, binding it to the guest interface.

Now we would have a primary WiFi over our main subnet 192.168.1.0/24, and a guest WiFi + a guest wired connection through port 3 of the router over our secondary subnet  192.168.2.0/24.

You can find below the main configuration files as example.

/etc/config/network

config interface 'loopback'
 option ifname 'lo'
 option proto 'static'
 option ipaddr '127.0.0.1'
 option netmask '255.0.0.0'

config globals 'globals'
 option ula_prefix 'fd6e:e9df:eb78::/48'

config interface 'lan'
 option ifname 'eth1'
 option force_link '1'
 option type 'bridge'
 option proto 'static'
 option ipaddr '192.168.1.3'
 option netmask '255.255.255.0'
 option ip6assign '60'
 option gateway '192.168.1.1'
 option dns '192.168.1.1'

config interface 'wan'
 option ifname 'eth0'
 option proto 'dhcp'

config interface 'wan6'
 option ifname 'eth0'
 option proto 'dhcpv6'

config switch
 option name 'eth1'
 option reset '1'
 option enable_vlan '1'

config switch_vlan
 option device 'eth1'
 option vlan '1'
 option ports '0 1 2 5'

config switch_vlan
 option device 'eth1'
 option vlan '2'
 option ports '3 5t'

config interface 'guest'
 option type 'bridge'
 option proto 'static'
 option ifname 'eth1.2'
 option ipaddr '192.168.2.1'
 option netmask '255.255.255.0'

/etc/config/firewall

config defaults
 option syn_flood '1'
 option input 'ACCEPT'
 option output 'ACCEPT'
 option forward 'REJECT'

config zone
 option name 'lan'
 option input 'ACCEPT'
 option output 'ACCEPT'
 option forward 'ACCEPT'
 option network 'lan'
 option masq '1'
 option mtu_fix '1'
 list masq_dest '!192.168.1.0/24'

config zone
 option name 'wan'
 option input 'REJECT'
 option output 'ACCEPT'
 option forward 'REJECT'
 option masq '1'
 option mtu_fix '1'
 option network 'wan wan6'

config forwarding
 option src 'lan'
 option dest 'wan'

config rule
 option name 'Allow-DHCP-Renew'
 option src 'wan'
 option proto 'udp'
 option dest_port '68'
 option target 'ACCEPT'
 option family 'ipv4'

config rule
 option name 'Allow-Ping'
 option src 'wan'
 option proto 'icmp'
 option icmp_type 'echo-request'
 option family 'ipv4'
 option target 'ACCEPT'

config rule
 option name 'Allow-IGMP'
 option src 'wan'
 option proto 'igmp'
 option family 'ipv4'
 option target 'ACCEPT'

config rule
 option name 'Allow-DHCPv6'
 option src 'wan'
 option proto 'udp'
 option src_ip 'fe80::/10'
 option src_port '547'
 option dest_ip 'fe80::/10'
 option dest_port '546'
 option family 'ipv6'
 option target 'ACCEPT'

config rule
 option name 'Allow-MLD'
 option src 'wan'
 option proto 'icmp'
 option src_ip 'fe80::/10'
 list icmp_type '130/0'
 list icmp_type '131/0'
 list icmp_type '132/0'
 list icmp_type '143/0'
 option family 'ipv6'
 option target 'ACCEPT'

config rule
 option name 'Allow-ICMPv6-Input'
 option src 'wan'
 option proto 'icmp'
 list icmp_type 'echo-request'
 list icmp_type 'echo-reply'
 list icmp_type 'destination-unreachable'
 list icmp_type 'packet-too-big'
 list icmp_type 'time-exceeded'
 list icmp_type 'bad-header'
 list icmp_type 'unknown-header-type'
 list icmp_type 'router-solicitation'
 list icmp_type 'neighbour-solicitation'
 list icmp_type 'router-advertisement'
 list icmp_type 'neighbour-advertisement'
 option limit '1000/sec'
 option family 'ipv6'
 option target 'ACCEPT'

config rule
 option name 'Allow-ICMPv6-Forward'
 option src 'wan'
 option dest '*'
 option proto 'icmp'
 list icmp_type 'echo-request'
 list icmp_type 'echo-reply'
 list icmp_type 'destination-unreachable'
 list icmp_type 'packet-too-big'
 list icmp_type 'time-exceeded'
 list icmp_type 'bad-header'
 list icmp_type 'unknown-header-type'
 option limit '1000/sec'
 option family 'ipv6'
 option target 'ACCEPT'

config include
 option path '/etc/firewall.user'

config rule
 option src 'wan'
 option dest 'lan'
 option proto 'esp'
 option target 'ACCEPT'

config rule
 option src 'wan'
 option dest 'lan'
 option dest_port '500'
 option proto 'udp'
 option target 'ACCEPT'

config zone
 option input 'ACCEPT'
 option forward 'REJECT'
 option output 'ACCEPT'
 option name 'guest'
 option network 'guest'

config forwarding
 option dest 'lan'
 option src 'guest'

/etc/config/wireless

config wifi-device 'radio0'
 option type 'mac80211'
 option hwmode '11g'
 option path 'pci0000:00/0000:00:01.0/ssb0:0'
 option channel '1'
 option txpower '20'
 option country 'IT'

config wifi-iface
 option device 'radio0'
 option mode 'ap'
 option network 'lan'
 option encryption 'none'
 option ssid 'OpenWrt'

config wifi-device 'radio1'
 option type 'mac80211'
 option channel '11'
 option hwmode '11g'
 option path 'platform/ehci-platform/usb1/1-1/1-1:1.0'
 option txpower '20'
 option country 'IT'

config wifi-iface
 option device 'radio1'
 option mode 'ap'
 option ssid 'OpenWrtGuest'
 option network 'guest'
 option encryption 'none' 

/etc/config/dhcp

config dnsmasq
 option domainneeded '1'
 option boguspriv '1'
 option filterwin2k '0'
 option localise_queries '1'
 option rebind_protection '1'
 option rebind_localhost '1'
 option local '/lan/'
 option domain 'lan'
 option expandhosts '1'
 option nonegcache '0'
 option authoritative '1'
 option readethers '1'
 option leasefile '/tmp/dhcp.leases'
 option resolvfile '/tmp/resolv.conf.auto'
 option localservice '1'

config dhcp 'lan'
 option interface 'lan'
 option dhcpv6 'server'
 option ra 'server'
 option ignore '1'
 option ra_management '1'

config dhcp 'wan'
 option interface 'wan'
 option ignore '1'

config odhcpd 'odhcpd'
 option maindhcp '0'
 option leasefile '/tmp/hosts/odhcpd'
 option leasetrigger '/usr/sbin/odhcpd-update'

config dhcp 'guest'
 option start '100'
 option leasetime '12h'
 option limit '150'
 option interface 'guest' 

Notes

• read risk disclaimer
• excuse my bad english