I currently have a flat network at home. My boradband router comes in and is connected to a switch, which supplies the Ethernet drops within the house. I also have a wireless router connected to the switch for wireless networking in the house. Pretty basic setup.

I would like to segment this into three regions, largely to isolate the regions.

  1. an internal wired/wireless network for my workstations, NAS server, etc.
  2. a guest wireless network that can access the Internet but nothing internal.
  3. a device/IoT wireless network for the connected TV, Roku, Wii, automation devices, etc, that could access the Internet but neither the internal nor the guest networks.

What would be the best way to go about this? My initial guess would be to put a system right after the broadband router that would have four network interfaces, one for Internet, one for each of the three regions. Then, connect the switch up to the internal interface, and new/separate wireless routers to the other two interfaces. Configure this router system to allow the internal network to get anywhere, but only allow the guest and IoT networks to the Internet (and enforce using some firewall rules on the router system).

Does that seem reasonable? Is there an easier/better way to do this? And how would I build that router system? Would/should that just be a Linux server with four Ethernet interfaces (and, what software would I run on that server to provide this functionality - and ideally some stronger firewalling/etc support)?

migrated from serverfault.com Jan 31 '16 at 13:22

This question came from our site for system and network administrators.


You need one managed switch with 802.1q VLANs support, and your router needs to support 802.1q VLANs too. That way you would split your home network into 3 vlans, and attach a router via 802.1q trunk.

And no, this doesn't seem reasonable. Get an IT job to be more occupied with this stuff at work. :) Furthermore, this is an off-topic on ServerFault, because SF is mainly dedicated to the commercial production systems discussions. Though you a planning an enterprise-grade setup, this is stil you home. That's probably why it's inapropriate for home.


A semi pro router will allow you to make such thing. I got a sonicwall at home, and it do your point 1 & 2. For point 3 you could simply double nat. Use your router under the other router.

You could create another VLAN, but as its for your home its your choice, but you will need a L3 switch that can route the packet to your router, and your router will have to know that subnet to route it to the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy