0

I need to created a fully isolated network at home so I have one network for home use (few iOT and mobile clients etc...) and one network for work.

Both network need to be fully isolated, so nobody can detect the other network.

I have a gigabit broadband which need to be initiated by one router using PPPoE (the current router I have don't really support VLAN so I guess I need to replace it)

My understanding is that I need one Router to connect to the ONT (FTTH terminal) start the PPPoE / VLAN (for the ISP) and create one VLAN for a second router(dedicated to my second network).

Does that make any sense ?

For the second network, do I actually need a second router or should I get a switch instead ? (I only have desktop client connecting to the second network via ethernet)

Improve this question
3
  • Seems pretty overkill, usually a second router behind the first one, or a VPN takes care of this... Is this at the request of your employer? They should have a standard practice document for situations like this, if not, contact your IT department.
    – acejavelin
    May 27, 2019 at 13:52
  • What router do you currently have? Good routers can handle multiple networks on their own.
    – user1686
    May 27, 2019 at 13:53
  • Thanks for the replies, it's our department rules to have two different network, can't really go through VPN unfortunately. Basically just trying to hide the home network and make it secure for the work network. -- I have a Synology RT1900AC but don't think that's can do the job.
    – Kevin
    May 27, 2019 at 13:57

2 Answers 2

Reset to default
2

A router that handles VLANs would allow you to set up two networks that both use the same gateway to the internet (the FTTH connection). Usually this is done by using a separate physical port on the router for each VLAN. You would need a switch attached to each VLAN/port assuming that you need multiple devices on each network. This means two basic switches or one VLAN-aware switch with appropriate configuration. Do not connect cables between the two switches.

Normal router behaviour would allow the two LANs to communicate but this could be prevented by a bi-directional firewall rule preventing this.

Improve this answer
2
  • Thank you for your reply, so I might go with a UBIQUITI Networks EdgeRouter X 5 and ES-8-150W. Although I'm just wondering, as I only have one client to isolate from the rest, would setup a different subnet to a specific ethernet port be enough to isolate the client without going through VLANs?
    – Kevin
    May 27, 2019 at 17:56
  • 1
    No, this would not provide genuine isolation from sophisticated malware. You do not need two switches, though, if one network is only going to have one device on it. It could connect directly to the router port.
    – Daniel K
    May 28, 2019 at 7:35
1

How does the work computer connect? My thought for the simpilist approach is 1 router where the work computer connects via Wi-Fi to the guest network and any home computers/iot connect to the home network. Both protected from the internet and can't see the other network.

Improve this answer
1
  • Unfortunately it's have to ben ethernet only
    – Kevin
    May 28, 2019 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.