I'm trying to upgrade my home network, which involves upgrading to gigabit and 802.11n and adding several APs. But I'd also like to update the security. Currently I have WPA(1) personal with a password because I have a few devices that can't handle WPA2 or even AES. I'd like to split the network between a WPA2-Enterprise (with RADIUS) segment and an unsecure segment that is rate-limited and restricted and requires a "secure" user to generate a code. The legacy devices would be whitelisted and moved to that network where they'd be allowed to make their device-specific requests (so MAC spoofing wouldn't work)
I'm not worried about that stuff. What I am worried about is both presenting both SSIDs from the same device and segregating the broadcast domains. I know I need a VLAN to do this, but managed switches are... not in the budget.
So here's the question - I want to keep the two WLANs separate. I can set up the APs to tag each SSID with a different VLAN, but without switches that explicitly handle VLANs, can I segregate the broadcast domains? If not, what would happen - would the network work as if both SSIDs connected to the same segment, or would it not work at all? If this wouldn't work, is there any way to "tunnel" one of the SSIDs' traffic to my Linux server/router to achieve the same effect?
More information -
I have yet to buy the APs, but I was planning on getting one that could run DD-WRT or OpenWrt or similar (Linux-based). They would be connected via unmanaged gigabit switches; unfortunately I don't have home runs to a wiring closet (which would make this easy!) as this was a "retrofit" installation in an old house. My server can handle VLANs, and the switches should pass tagged packets but won't do any discrimination based on their content (right?)