I currently have a flat network at home. My boradband router comes in and is connected to a switch, which supplies the Ethernet drops within the house. I also have a wireless router connected to the switch for wireless networking in the house. Pretty basic setup.
I would like to segment this into three regions, largely to isolate the regions.
- an internal wired/wireless network for my workstations, NAS server, etc.
- a guest wireless network that can access the Internet but nothing internal.
- a device/IoT wireless network for the connected TV, Roku, Wii, automation devices, etc, that could access the Internet but neither the internal nor the guest networks.
What would be the best way to go about this? My initial guess would be to put a system right after the broadband router that would have four network interfaces, one for Internet, one for each of the three regions. Then, connect the switch up to the internal interface, and new/separate wireless routers to the other two interfaces. Configure this router system to allow the internal network to get anywhere, but only allow the guest and IoT networks to the Internet (and enforce using some firewall rules on the router system).
Does that seem reasonable? Is there an easier/better way to do this? And how would I build that router system? Would/should that just be a Linux server with four Ethernet interfaces (and, what software would I run on that server to provide this functionality - and ideally some stronger firewalling/etc support)?