Create a 2nd LAN at home, have I done it right?

[estwig]

The goal is a second LAN on my home network, to keep my work devices separate from my toys.

This is what I've done, have I got it right?

Virgin hub in modem mode, connected to the primary router, DHCP is enabled. This router dishes out ip addresses in the range 192.168.1.2 to 192.168.1.254, this has my toys on it; android devices, security cams, TV's and music, the IOT's are on an isolated guest network.

Connected to the primary router is a secondary router, it has an external ip address of 192.168.1.7, DHCP is enabled. This router dishes out ip addresses in the range 192.168.2.2 to 192.168.2.254, this has my work devices on it, desktop, ip phone and two laptops.

Bridge mode, UPnP, remote access, etc, are all turned off on both routers.

Have I achieved the goal of devices on the first LAN, not being able to see and therefore connect to, devices on the second LAN, and vice versa?

 

[KM-Tiger]

A few issues:

Your secondary router has an address within the DHCP scope of the primary router. How do you ensure it does indeed get that address? Or another device does not get that address.

How are you controlling DHCP to ensure devices get an address from the correct router?

 

[estwig]

A few issues:

Your secondary router has an address within the DHCP scope of the primary router. How do you ensure it does indeed get that address? Or another device does not get that address.

How are you controlling DHCP to ensure devices get an address from the correct router?

Hello mate!

Are you saying the secondary router needs a static ip address, or it might go t*ts up at some point?

Surely I'm controlling what addresses devices get, by which router they are plugged into.

 

[forevergroup]

Yes, if you have your second set of devices on a different subnet (192.168.2.0/24) behind a router that is providing NAT to 192.168.1.7 then the devices won't be able to communicate between the two subnets.

Nothing on the 192.168.1.0/24 subnet will be able to 'see' a 192.168.2.0/24 address.

That said, what you've essentially created for all devices within the 192.168.2.0/24 subnet is a double-NAT situation which is highly suboptimal.

The correct way to do this is to have one router that is VLAN-capable and have two separate VLANs - Let's say VLAN 100 192.168.1.0/24 and VLAN 192.168.2.0/24 and preferably a management VLAN for the network devices themselves let's say VLAN 500 192.168.5.0/whatever.

You then either use a VLAN-capable switch - or if that is a challenge for you, connect separate unmanaged switches to the router interface assigned to each VLAN.

Likewise, traffc between VLANs is restricted at Layer 3 e.g. you would configure those restrictions on the router.

The above does require some degree of networking knowledge but is worth doing some research. I'm sure you can pick up a refurb Cisco Small Business VLAN-capable router (and switches if needed) cheap on eBay.

We don't need to segregate networks in hardware like that these days. That doesn't mean we don't see it done incorrectly in the wild. I went into a £15m turnover business with four (!) Draytek routers a couple of years back. I also frequently see plenty of peripheral systems like VoIP and CCTV on separate infrastructure that should really be consolidated. It's worth learning more about doing this correctly and a home lab is the best way to do that. Good luck!

 

[KM-Tiger]

Are you saying the secondary router needs a static ip address, or it might go t*ts up at some point?

Surely I'm controlling what addresses devices get, by which router they are plugged into.

A static IP for the secondary will make any troubleshooting easier. Start the primary range at say 192.168.1.10 and statically allocate 192.168.1.7 to the secondary.

"Which you are plugged into" *should* work to allocate IP addresses appropriately. However make sure there are no Wifi connections that could get an address from the 'wrong' router.

Also DHCP works by a device requesting an address broadcasting to the entire network to find a DHCP server. Where there are 2 DHCP servers on a network, the first one to answer gets to allocate the address. So you need to ensure that broadcasts on one network cannot reach the other network. eg via a wireless device.

 

[ink1ing]

The setup you have sounds very similar to what I've done to get a network in my garden workshop. It works fine for me.

As mentioned above I have set static IPs on a lot of things but I generally find that makes life easier anyway. I don't have a problem with devices on the Wifi networks as they're 50 meters apart.

 

[estwig]

Yes, if you have your second set of devices on a different subnet (192.168.2.0/24) behind a router that is providing NAT to 192.168.1.7 then the devices won't be able to communicate between the two subnets.

Nothing on the 192.168.1.0/24 subnet will be able to 'see' a 192.168.2.0/24 address.

That said, what you've essentially created for all devices within the 192.168.2.0/24 subnet is a double-NAT situation which is highly suboptimal.

The correct way to do this is to have one router that is VLAN-capable and have two separate VLANs - Let's say VLAN 100 192.168.1.0/24 and VLAN 192.168.2.0/24 and preferably a management VLAN for the network devices themselves let's say VLAN 500 192.168.5.0/whatever.

You then either use a VLAN-capable switch - or if that is a challenge for you, connect separate unmanaged switches to the router interface assigned to each VLAN.

Likewise, traffc between VLANs is restricted at Layer 3 e.g. you would configure those restrictions on the router.

The above does require some degree of networking knowledge but is worth doing some research. I'm sure you can pick up a refurb Cisco Small Business VLAN-capable router (and switches if needed) cheap on eBay.

We don't need to segregate networks in hardware like that these days. That doesn't mean we don't see it done incorrectly in the wild. I went into a £15m turnover business with four (!) Draytek routers a couple of years back. I also frequently see plenty of peripheral systems like VoIP and CCTV on separate infrastructure that should really be consolidated. It's worth learning more about doing this correctly and a home lab is the best way to do that. Good luck!

My last router was a top end Draytek capable of VLANs, I couldn't get my head around VLANs, then it got fried in a DDOS attack!

Anything CISCO is too much for me I'm afraid, I don't really wanna learn this, I want it to work, I want to be able to fix it when it breaks.

 

[estwig]

A static IP for the secondary will make any troubleshooting easier. Start the primary range at say 192.168.1.10 and statically allocate 192.168.1.7 to the secondary.

"Which you are plugged into" *should* work to allocate IP addresses appropriately. However make sure there are no Wifi connections that could get an address from the 'wrong' router.

Also DHCP works by a device requesting an address broadcasting to the entire network to find a DHCP server. Where there are 2 DHCP servers on a network, the first one to answer gets to allocate the address. So you need to ensure that broadcasts on one network cannot reach the other network. eg via a wireless device.

Wifi is nailed down, that's a weak link in my security, I'm all over it!

I'll set the static IP thing, thank you.

 

[KM-Tiger]

I couldn't get my head around VLANs,

On one level VLANS are simple, but harder to implement.

VLANS work because every network packet gets marked with a number which identifies which VLAN it belongs to.

To have VLANS you need a device that can do the marking, and a firewall/router that can understand those marks and behave accordingly, eg apply different rules to different VLANS, and not allow routing between them, even though everything is on the same physical network.

It can achieve what you are after, but probably not worth it in your case.