Is it possible to use Apple’s Airport Extreme Guest Network without using the Airport as your main router? YES. This is one of those situations where Apple really pisses me off. Apple loves to make their technologies proprietary and compatible with only other Apple gear. And that really sucks when you need their gear to work with other manufactures products out of necessity and Apple we’re talking about things that have been industry standards for decades!

The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs, but Apple has gone out of there way to make sure you don’t know that. The Apple overlords have gone too far in this case, and I am going to show you how it really works!

Using The Airport Extreme Guest Network with a Third Party Router

Hacking the Airport Guest Network 0002I bought several Airport Extremes when we built our new home in 2015. I’ve always liked that the Airports just work, and always reliably. Something Apple has generally been known for. So I wanted to stick with them in my new house. One of the features I was excited about was the Airport Extreme Guest Network. This feature allows you to create a second SSID, very simply that has access only to the internet. Generally your normal SSID-Guest. This network is firewalled off from your home network, allowing guests to surf the web without getting access to your private data.

However, Apple did something only Apple does. They made the requirement that the main router that connects your home to the Internet also be an Airport Extreme, otherwise the Guest Network simply does not work. So for the last year I’ve been without a guest network, a feature that I really wanted because I refuse to use the Airport as my main router. Honestly, I can’t. My network is too complex, and even if it wasn’t I have FiOS Internet which means I would have to call and get my ONT re-provisioned to use the Ethernet jack instead of MoCA (coax) which would be a major hassle.

Investigating Apple’s Guest Network

Hacking the Airport Guest Network 0001So this morning I decided to do a little tinkering. I plugged the Airport directly into my laptop with Wireshark installed and while watching the traffic I turned on the Guest Network feature. Something I saw was very interesting. There were frames crossing the network with 802.1q tags on them. That’s right! The guest network was just using a separate VLAN to operate. In fact, it was VLAN 1003. This of course got my gears turning.

All of my Airport Extremes plug into a Netgear ProSafe switch. My ActionTech MI424WR is also plugged into this same switch. The question buzzing through my brain was “Is this really that simple? If enable VLAN tagging on those ports and turn on a VLAN interface on the MI424WR will it work?” Of course I had to find out!

Enable the Airport Extreme Guest Network

The first thing you need to do is enable the Guest Network on the Airport Extreme.  Open the Airport Utility under Finder–>Go–>Utilities–>Airport Utility and then select the name of your Airport Extreme base station. On the pop-up click edit and enter the devices password. Click on the wireless tab.  At the bottom tick the box that says “Enable Guest Network” and enter the name you want to call the network. Again, most people use their normal SSID and add “-Guest” to it. Generally you’ll set the “Guest Network Security” to “None”.  Otherwise you’ll still have to give all of your guests a password, which might be useful for some people. In my case I left it wide open.Airport Extreme Guest Network -0001

Enable VLAN 1003 on your Switch

If you’re Airport Extreme is not connected directly to your router, you’ll need to enable VLAN tagging on the the ports of your switch in order for it to pass the VLAN 1003 802.1q tags to your router. If your Airport is connected directly, just go on to the next step.

If this is your first new VLAN on your switch, you’ll want to make sure all of your existing ports are set to PVID 1. This means they’ll just act as part of your normal network. They’ll pass traffic normally. Then created a new VLAN ID of 1003. This alone does nothing, but lets the switch know we want to use this ID somewhere on our network.

To make the magic happen select that VLAN and then select all of the ports that have an Airport Extreme plugged into them, and the port plugged into your router. In my case I dedicated a second port on my router for this VLAN, but that’s not necessary.

Airport Extreme Guest Network -0002

You’ll wind up with a VLAN configuration that looks something like the picture below. Ignore VLAN 2, this is unique to my network, and you won’t have it.  You’ll see that port 14 is untagged on VLAN 1 which is the normal network, and tagged on VLAN 1003, allowing it to also pass traffic for that network if it receives an 802.1q tag for that ID.

Airport Extreme Guest Network -0003,png

Configure your Router to Imitate the Airport Extreme Guest Network

At this point traffic should be passing all the way to your router, but your router doesn’t know what to do with it, and since there is no DHCP server on this VLAN, connected devices cannot get an IP address.

This is going to be very specific to your type of router, and not all routers support VLANs. This example is from my ActionTech. A Linksys, NetGear, pfSense, SonicWall, or others should all support VLANs.

Create a new VLAN on the ActionTech MI424WR under My Network–>Connections–>Add. This will be a tagged network. Name it Home/Office Guest Wireless (VLAN 1003) and enter 1003 as the VLAN ID and the click Apply. Edit the new network connection and change Internet Protocol to “Use the Following IP Address” and pick a subnet that suites your fancy. I decided to go with 192.168.200.0/24. Enter the names of the DNS servers you use, I prefer Google DNS, especially for guest networks. Lastly, under IP Address distribution, enable the DHCP server and select a range of IPs for it to give out.  I just gave it everything but .1 since nothing else should ever be on this network.

Airport Extreme Guest Network -0004,png

In my case I wanted to dedicate port 3 for this VLAN because I plan to rate limit this network to 15 Mb/s to keep people from using all of my bandwidth. Under My Network–>Connections–>Ethernet/Coaxial click settings and click the Hardware Switch Ports. I assigned Port 3 to be dedicated to VLAN 1003.  After that I plugged another cable from the MI424WR’s port 3 into port 8 of my NetGear ProSafe. If you decide to go this route, don’t plug in that cable until you have removed PVID 1 from that port or you will cause a loop and bring your network down. Then I just logged into the ProSafe and set the QoS Rate Limit for port 8 to 15 Mb/s.

Airport Extreme Guest Network -0005,png

Secure the Airport Extreme Guest Network

At this point all you’ve done is created another network, but they can all talk to each other. We don’t want the Airport Extreme Guest Network to be able to talk to our home network. Create a firewall rule that drops all packets from your main subnet to the guest network. On the ActionTech MI424WR this is accomplished by going to Firewall Settings–>Advanced Filtering–>The New VLAN you created–>Add.

I just entered the IP address ranges of my two existing VLANs, and set the action to Drop.

Airport Extreme Guest Network -0006,png

That’s it.  Your new Airport Extreme Guest Network feature has been hacked to work on your 3rd party router! Users should be able to connect to the guest network, DHCP an address from the new IP range and access the Internet, but not your local private network!

So the answer is yes! You can use Apple’s Guest Wireless Network with 3rd party routers!!