Is it possible to use Apple’s Airport Extreme Guest Network without using the Airport as your main router? YES. This is one of those situations where Apple really pisses me off. Apple loves to make their technologies proprietary and compatible with only other Apple gear. And that really sucks when you need their gear to work with other manufactures products out of necessity and Apple we’re talking about things that have been industry standards for decades!

The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs, but Apple has gone out of there way to make sure you don’t know that. The Apple overlords have gone too far in this case, and I am going to show you how it really works!

Using The Airport Extreme Guest Network with a Third Party Router

Hacking the Airport Guest Network 0002I bought several Airport Extremes when we built our new home in 2015. I’ve always liked that the Airports just work, and always reliably. Something Apple has generally been known for. So I wanted to stick with them in my new house. One of the features I was excited about was the Airport Extreme Guest Network. This feature allows you to create a second SSID, very simply that has access only to the internet. Generally your normal SSID-Guest. This network is firewalled off from your home network, allowing guests to surf the web without getting access to your private data.

However, Apple did something only Apple does. They made the requirement that the main router that connects your home to the Internet also be an Airport Extreme, otherwise the Guest Network simply does not work. So for the last year I’ve been without a guest network, a feature that I really wanted because I refuse to use the Airport as my main router. Honestly, I can’t. My network is too complex, and even if it wasn’t I have FiOS Internet which means I would have to call and get my ONT re-provisioned to use the Ethernet jack instead of MoCA (coax) which would be a major hassle.

Investigating Apple’s Guest Network

Hacking the Airport Guest Network 0001So this morning I decided to do a little tinkering. I plugged the Airport directly into my laptop with Wireshark installed and while watching the traffic I turned on the Guest Network feature. Something I saw was very interesting. There were frames crossing the network with 802.1q tags on them. That’s right! The guest network was just using a separate VLAN to operate. In fact, it was VLAN 1003. This of course got my gears turning.

All of my Airport Extremes plug into a Netgear ProSafe switch. My ActionTech MI424WR is also plugged into this same switch. The question buzzing through my brain was “Is this really that simple? If enable VLAN tagging on those ports and turn on a VLAN interface on the MI424WR will it work?” Of course I had to find out!

Enable the Airport Extreme Guest Network

The first thing you need to do is enable the Guest Network on the Airport Extreme.  Open the Airport Utility under Finder–>Go–>Utilities–>Airport Utility and then select the name of your Airport Extreme base station. On the pop-up click edit and enter the devices password. Click on the wireless tab.  At the bottom tick the box that says “Enable Guest Network” and enter the name you want to call the network. Again, most people use their normal SSID and add “-Guest” to it. Generally you’ll set the “Guest Network Security” to “None”.  Otherwise you’ll still have to give all of your guests a password, which might be useful for some people. In my case I left it wide open.Airport Extreme Guest Network -0001

Enable VLAN 1003 on your Switch

If you’re Airport Extreme is not connected directly to your router, you’ll need to enable VLAN tagging on the the ports of your switch in order for it to pass the VLAN 1003 802.1q tags to your router. If your Airport is connected directly, just go on to the next step.

If this is your first new VLAN on your switch, you’ll want to make sure all of your existing ports are set to PVID 1. This means they’ll just act as part of your normal network. They’ll pass traffic normally. Then created a new VLAN ID of 1003. This alone does nothing, but lets the switch know we want to use this ID somewhere on our network.

To make the magic happen select that VLAN and then select all of the ports that have an Airport Extreme plugged into them, and the port plugged into your router. In my case I dedicated a second port on my router for this VLAN, but that’s not necessary.

Airport Extreme Guest Network -0002

You’ll wind up with a VLAN configuration that looks something like the picture below. Ignore VLAN 2, this is unique to my network, and you won’t have it.  You’ll see that port 14 is untagged on VLAN 1 which is the normal network, and tagged on VLAN 1003, allowing it to also pass traffic for that network if it receives an 802.1q tag for that ID.

Airport Extreme Guest Network -0003,png

Configure your Router to Imitate the Airport Extreme Guest Network

At this point traffic should be passing all the way to your router, but your router doesn’t know what to do with it, and since there is no DHCP server on this VLAN, connected devices cannot get an IP address.

This is going to be very specific to your type of router, and not all routers support VLANs. This example is from my ActionTech. A Linksys, NetGear, pfSense, SonicWall, or others should all support VLANs.

Create a new VLAN on the ActionTech MI424WR under My Network–>Connections–>Add. This will be a tagged network. Name it Home/Office Guest Wireless (VLAN 1003) and enter 1003 as the VLAN ID and the click Apply. Edit the new network connection and change Internet Protocol to “Use the Following IP Address” and pick a subnet that suites your fancy. I decided to go with 192.168.200.0/24. Enter the names of the DNS servers you use, I prefer Google DNS, especially for guest networks. Lastly, under IP Address distribution, enable the DHCP server and select a range of IPs for it to give out.  I just gave it everything but .1 since nothing else should ever be on this network.

Airport Extreme Guest Network -0004,png

In my case I wanted to dedicate port 3 for this VLAN because I plan to rate limit this network to 15 Mb/s to keep people from using all of my bandwidth. Under My Network–>Connections–>Ethernet/Coaxial click settings and click the Hardware Switch Ports. I assigned Port 3 to be dedicated to VLAN 1003.  After that I plugged another cable from the MI424WR’s port 3 into port 8 of my NetGear ProSafe. If you decide to go this route, don’t plug in that cable until you have removed PVID 1 from that port or you will cause a loop and bring your network down. Then I just logged into the ProSafe and set the QoS Rate Limit for port 8 to 15 Mb/s.

Airport Extreme Guest Network -0005,png

Secure the Airport Extreme Guest Network

At this point all you’ve done is created another network, but they can all talk to each other. We don’t want the Airport Extreme Guest Network to be able to talk to our home network. Create a firewall rule that drops all packets from your main subnet to the guest network. On the ActionTech MI424WR this is accomplished by going to Firewall Settings–>Advanced Filtering–>The New VLAN you created–>Add.

I just entered the IP address ranges of my two existing VLANs, and set the action to Drop.

Airport Extreme Guest Network -0006,png

That’s it.  Your new Airport Extreme Guest Network feature has been hacked to work on your 3rd party router! Users should be able to connect to the guest network, DHCP an address from the new IP range and access the Internet, but not your local private network!

So the answer is yes! You can use Apple’s Guest Wireless Network with 3rd party routers!!

23 Responses

  1. Fred K.

    This is super fantastico awesome to the extreme like made my day cool! Thanks!

    Reply
  2. michaelc

    Mike, this is a fantastic guide. Well written. I implemented same on a Sonicwall network with Netgear smart switches. Thanks for the inside info.
    Any chance you’ve tested the exposure of the VLAN1003 guest network with an Airport Express? It would seem the firmware would be same (similar).
    Thanks again!

    Reply
  3. Torrie

    Well done, sir. I rarely leave kudos but here you went and provided a perfect solution to a situation for me and a client’s network. Thank you for taking the time to do this. Much appreciated. Ran right through it and voila. Good to go. I had to jump over 2 separate switches – coupled via fiber, etc. Hit the Sonicwall and created the fun. Some virtual networking on the Sonicwall was needed, and guest services was applied there as well to keep everyone from seeing one another on the guest wireless network, but it was all fairly straightforward. Thanks again.

    Reply
  4. Jerry C

    So i have the same router connected to my ONT via the ethernet port and an airport extreme then plugged into port 4 of the actiontec router. I followed the instructions and it works but everything,regular wifi and lan ports included, connected to the extreme gets an IP address of 192.168.200.x. Shouldn’t you only get that IP range when connected to the guest network.

    Reply
  5. Jim

    Compliments for a well written post, and detailed advice. I also have two Airport Extremes in my house in bridge mode, while using a Synology router and managed switch in-between. I had wondered why the guest network on the apple extreme’s had not worked, and this answered the question. One rainy weekend I will try and implement your workaround. Cheers!

    Reply
  6. oceanscrashing

    You may not need a managed switch; An unmanaged switch will typically pass through the VLAN-tagged traffic transparently. As long as you’ve got a matching VLAN interface tagged on your firewall uplink, you should be good to go. Tested with a Netgear unmanaged switch just to verify.

    Reply
    • Mike Murray
      Mike Murray

      A lot of the Netgear devices are unmanaged “smart” switches, which will most definitely pass VLAN frames. Good call out! Thanks for the feedback!

      Reply
  7. Jimmy

    Worked exactly as described! Thank you so much!!! And F*** Apple’s bullshit!

    Reply
  8. Robert Espino

    Hello , i would to set this up with a mikrotik router, im confused where u state if its plugged in directly to the router than go to next step, would that be just configuring another vlan on the router, also as of now i have one ethernet cable coming from the airport to the lan port on the mikrotik router.

    Reply
  9. Michael

    Found this article via google search, and it helped me solve a related problem. My setup is a core router Apple Extreme, with two additional Apple Extreme’s in “Bridge Mode” and acting as wi-fi extensions attached to the LAN via Ethernet. In a three story house, one per floor equals great wi-fi all over. In the past I could never get the “Guest Network” feature to work. However after reading this article I had an epiphany, maybe the core switch is not passing the VLAN traffic. I tried plugging the secondary Airport Extreme directly to the core Apple router, and voila the guest network came alive! Therefore even with a complete Apple setup, you must deal with passing the VLAN traffic appropriately. I am sure I could have changed settings on the core switch to deal with it, but plugging it directly was an easy fix.

    Reply
  10. Greg

    Very good instructions unfortunately my Centurylink modem does not offer such flexibility. With 8 airports extremes I have no other option than to use the CenturyLink modem with IPoE transparent bridging then the master AirPort Extreme in PPPoE then as the DHCP for the rest of my network and airports. Disappointing, I really wanted to control the guest bandwidth. Do I have any other options with my existing equipment?

    Reply
  11. Dan

    Excellent info here. I have an Airport Extreme for WiFi on my network and the guest network stopped working once I put an ER-X between the APE and the modem. Using the info here, I was able to create a vlan for the ethernet port dedicated to the WiFi and separate the guest traffic to its own subnet. Vlan ID to 1003 and everything works great on the guest and main WiFi networks!

    Thank you! 🙂

    Reply
  12. Jonathan

    Thanks for this! My guest network stopped working on my AP Express ever since I started using pfSense. This solved my problem in a few minutes.

    Reply
  13. Steve McIrvin

    Thanks so much for your helpful article! Working like a champ on my Sophos UTM 9. Just had to create the VLAN and then assign it to the DNS, DHCP and Web filtering profiles as if it were another real interface. With your instructions it look just 3 minutes!

    Reply
  14. Joe Barnhart

    Awesome insight. All I needed was that VLAN number and I was off to the races. I now have gig internet and a guest network!

    Reply
  15. Ken

    Will this work with a Time Capsule? When I turn on bridge mode, the Guest Network option is disabled

    Reply
  16. Ken

    I am using the latest time capsule and I am not able to see the guest network option while in bridge mode. Do you know if Apple plugged the bridge mode bug in the time capsule?
    I am trying to setup a vlan to the TC from my Ubiquity router.

    Reply
  17. Tangier Clarke

    Mike I just came across your write up. I appreciate this. Is there any alternative to achieve this with a router that doesn’t seem to have a VLAN setting? I am using a RAC2V1K router.

    Reply
  18. Eric Woodland

    Gold! I’ve been running several of the AirPort Extreme units for a couple years. Wanted to create an isolated IoT network using the Guest function (while using my Cisco switch). Enabled the VLAN, tagged the ports and we’re in business. Thanks again!

    Reply

Leave a Reply