7

A new renter moved in and wants his own private network with no communication between his and my private network. In addition, he doesn't want a centralized logging of network traffic like most home modem and routers do.

The landlord only has one Ethernet cable coming from the ISP. If I connect the ISP cable, the homeowner's router and the new renter's router to an unmanaged switch, then program the landlord's router to use the private network 192.168.1.0 and have the new renter program his router to use 192.168.2.0. Would that work and would it satisfy the new renter's demand of privacy?

Home network diagram:

Diagram

6
  • 1
    Why not just allow them to buy there own internet? Do you really have enough bandwidth to satisfy both your needs?
    – cybernard
    Sep 10 at 13:27
  • 11
    "centralized logging of network traffic like most home modem and routers do" -- do they? really? Cheap home routers with cheap and slow flash for storage? Apart from DHCP logs (maybe, and they might be volatile too), I find that rather hard to believe, some source for that claim would be nice to have here.
    – ilkkachu
    Sep 10 at 19:26
  • 1
    Can you renter use cellular internet, rather than committing to any contract term on a separate hardwired internet link ? Make it the renter's problem.
    – Criggie
    Sep 11 at 4:19
  • Why wouldn't you program them both for 192.168.1.0? They're two completely separate private networks. The whole point of using private IP address space is that more than one separate private network can use them. Sep 11 at 6:43
  • What kind of WAN connection is used? Is that actually Ethernet? Or is that some other form of connection (xDSL, DOCSIS...)? Is there another device (provided by the ISP) to the left of your drawing, e.g. a "modem" (which often integrates a router)?
    – jcaron
    Sep 11 at 11:48
9

As presented in the drawing, no.

Firstly a standard ISP residential contract provides a single public IP address; more than that usually requires a substantially more expensive commercial contract. I am assuming this is also a standard residential contract, not a commercial one.

If there's only one IP, it belongs to your router. Any device connected after the WAN port has a direct connection to the internet through the ISP:s routing, so it needs a separate public IP address. Which means you can't just stick a switch between the ISP and your router's WAN port and expect it to work.

If your renter is accessing the internet only via Wi-Fi, you could provide him a separate SSID. However there's the question about logging - the router might or might not log traffic, and you might or might not have the possibility to affect the behavior. You can of course check this in your router's management interface.

If your router supports VLANs, you could create a separate VLAN for your renter with the IP subnet 192.168.2.0/24, but the question of logging still remains.

I see only three ways around this:

  1. Your renter contacts an ISP of his choice to arrange his own internet access
  2. You contact your ISP and discuss about the possibility of adding another router device into your connection - I doubt this'd be allowed, and if yes a separate public IP is likely to cost money
  3. You provide your renter either his own VLAN or a separate SSID, and your renter gets himself a VPN. This is the only surefire way you, your router or the ISP has no way to know what they are doing. The routers could still log the traffic, but would only see packets between the VPN end points. The traffic inside the tunnel is encrypted, so there's no way for anyone to tell what they're accessing.

As @ilkkachu and @user1686 have already pointed out, the resources in the routers provided with residential contracts are so tight that they are unlikely to be capable of any meaningful logging. However a knowledgeable person can certainly find a way to trace the traffic between the router and ISP to collect his own logs.

Please note - this is only added for completeness. I'm in no shape or form suggesting that the OP would be even considering to imagine starting to plan something like this :-)

3
  • We don't know how many IP addresses the ISP provides.
    – ilkkachu
    Sep 10 at 19:24
  • 3
    @ilkkachu You are correct. I made an assumption based on how the vast majority of ISPs operate with private residential contracts. That assumption had a very high probability; and has basically proven correct. You might notice that I advised contacting the ISP about more IPs - if they were already available they would say so. In my view this is a bit of a moot point, but I amended my answer anyway. Sep 10 at 19:41
  • Most consumer AP/router devices will gladly route between separate SSIDs, if not actually having them all on the same broadcast domain. Sep 12 at 1:31
6

In addition, he doesn't want a centralized logging of network traffic like most home modem and routers do.

But they generally don't... (Many home routers literally don't even have the resources for that. (CPU requirements aside, where would they store those logs if the OS alone barely fits in the flash chip?)

Yes, your layout would create two separate networks which do not interact. (In fact the routers don't even need to have different LAN addresses – only the Wi-Fi SSIDs must be different.)

But this would work only if the ISP allows multiple devices on the same line (leasing two different WAN IP addresses). Some ISPs will allow this, but many won't.

Also, if the renter is worried about routers, I'm wondering whether he'll be just as worried about switches, as most managed switches happen to have "port mirroring" features.

9
  • Can't the 2 routers use the same WAN IP address from the ISP? I figured the unmanaged switch would split the IP based on MAC address and forward traffic to the desired router.
    – JT Taurkus
    Sep 10 at 11:10
  • No they can't. Yes, technically the switch would just forward traffic based on the MAC address . (It doesn't exactly "split the IP" though; it doesn't handle IP. I think you're thinking of routers rather than switches.) But the upstream router at your ISP will have problems – it doesn't keep track of MAC addresses for each individual connection; it only keeps track of one MAC address per IP in general. (Routers, big and small, use exactly the same kind of "ARP table" as PCs.) So once the ISP's gateway notes that your WAN IP is at MAC address X, it'll send all traffic to that address X.
    – user1686
    Sep 10 at 11:18
  • (This is the same reason why you, at home, are using a router to begin with – instead of just connecting all your devices to a switch. If they could all be directly assigned the same IP address, you wouldn't need a router – but they cannot, so instead the router alone gets the WAN IP address and does translation i.e. NAT for your other devices. In this plan, if it turns out that the ISP indeed doesn't allow multiple WAN IP addresses per residential connection, then you'd also need a 3rd router to split traffic between the two – or a single VLAN router for everything, as Peregrino recommends.)
    – user1686
    Sep 10 at 11:22
  • About adding a third router in the soup, before the question gets asked... I really wouldn't. First many ISPs don't allow replacing the routers they provide with your own for both practical and security reasons. Secondly daisy-chaining one router's WAN port to another router's LAN port is possible if the WAN port is RJ45, not RJ11. However these SoHo routers NAT the traffic between LAN and WAN ports, which means any traffic from an internal LAN over two SoHo routers will be double-NATted. That in itself has a good chance of presenting its very own set of new, interesting problems... Sep 10 at 12:33
  • @Peregrino69 I used to work for a small computer repair place. I've replace dozens of routers, and never had any problem with the ISP objecting. Sure, cable companies used to lock the internet access to one MAC, but rebooting the modem always fixed that issue. I've also never had problems with "double-NAT"; the only issue there is getting port forwarding to work (assuming you need it). I'm not saying that a third router would solve the OP's problems, but I don't really think it would be the headache you imagine, either. Sep 12 at 2:23
0

Your connection design would work if you have the option for multiple IP addresses from your ISP. If you only have access to one IP you could go with a VLAN solution but this is not an easy setup for a regular home user. Plus your hardware will need to support VLANS. You could add a router behind the landlords router (the same as adding a third router basically) but this would cause a ton of issues down the road. The best solution if you have access to only one IP address is to have your renter get there own connection. Especially if they are that concerned about privacy.

Your initial design would be considered an easy solution with access to multiple IPs. A separate internet connection would be the most secure and practical solution for the renter. All the other solutions would be a trial and error setup or the hiring of a skilled network technician to have it work as desired. Most advanced network connections like your renter is asking for would be considered beyond most common home users skill level. I mean no offence by that comment. I just want to let you know that there would be no plug in some cables, push a few buttons and you are all running without issues.

I also agree with the other post of a home/ISP router not being able to track anything of use. They just do not have the hardware to do anything more than the basics which would include this local IP went to this public IP at best.

Edit: With access to only 1 IP your setup would still work but take out the switch and just plug into a second LAN port on your ISP connection for the renters line. This will not help with there privacy concerns as the ISP connection will log what is going on and not separate from the landlord or renter connection. It would allow for local separation though as what comes from one router will not show in the other router. This is allowing that your ISP router has more than one LAN port. You could try this option as it should only take a few minutes to see if it works with your current ISP connection. If you go to ipaddress.com from a computer connected to each router and you get a different public IP then your are good to go. If you get the same IP then you have access to only 1 IP and stuck with getting an upgraded connection or a separate line for the renter.

2
  • Sry mate but the test in Edit part is pointless. All egress traffic will still be passing that one WAN port at the edge which has that one public IP, so no tool can ever show anything but that one public IP. Setting up a VPN will do it - the public IP of the VPN user will be from the VPN provider. Doesn't require any special skillset, just the know-how to install an app and configure it according to provider's instructions. No trial/error. It's a lot cheaper than any ISP connection, and provides between the client and server total, unbreakable privacy to boot. Sep 10 at 23:15
  • @Crazy - It's unnecessary to add "edit" when you edit your contributions. Every single change is tracked through the revision system.
    – Ramhound
    Sep 11 at 5:21
0

The landlord only has one ethernet cable coming from the ISP. If I connect the ISP cable, homeowner's router and the new renter's router to an unmanaged switch, then

This depends on how the ISP hardware is setup. If it gives a single public IP to whatever is plugged in, this will not work. If the ISP provided equipment does NAT (ie. gives private addresses), sure you can plug in two NAT routers and they will work just fine with DOUBLE NAT. Some people think it is evil, but it would work fine. Even if the ISP line is more like a cable modem and provides a single public IP, you could put your own NAT router in front of the two "subscriber" routers.

A new renter moved in and wants his own private network with no communication between his and my private network.

In the case above with double NAT, actually you could each spy on each other, because the two "subscriber" routers share a broadcast domain on the WAN port. Anyone who has access to that cable can spy, period. Switches provide cosmetic protection, but it is easily circumvented. There are entire classes of MITM attack that arise from sharing a broadcast domain there. Honestly, it is a little secure, but you need a bit of trust.

The correct "business flavored" way would be to buy a router that supports VLAN ports like a Ubiquiti or Cisco Meraki thing, give both "subscribers" a port with separate VLAN, then correctly firewall between them. This actually would be pretty secure for everyone, and more closely matches what an ISP would (ideally) do.

In addition, he doesn't want a centralized logging of network traffic like most home modem and routers do.

This is a BIG problem, if your tenant does not trust you to be their ISP, you can not be their ISP. In the above scenario with an expensive business router, they still need to trust you. Most carriers will gladly provide two independent services to an address, it is the only "zero-trust" solution available.

Trust goes the other way too, like if your tenant downloads a million movies, or does crime, or violates the ToS of your internet service, it will likely come back to you!

12
  • "they will work just fine with DOUBLE NAT. Some people think it is evil, but it would work fine" - did it occur to you that some people might have actual practical experience about double-natting NOT working "just fine"; maybe even both in private and professional setting? Sep 11 at 9:38
  • @Peregrino69 I sincerely doubt that three home routers serving two households would ever encounter any of the practical limitations of double NAT, besides maybe around port forwarding. At least Cisco even suggests using double NAT with access points in many circumstances. It is not really as bad as people make it sound. Sep 12 at 1:28
  • Oh no, it indeed isn't :-D But it can't be categorically said to be just fine either. I've not heard Cisco (or anyone else) actually recommending it. Just browsing, most likely OK, but how about port forwarding? Sep 12 at 6:09
  • @Peregrino69 The example that comes to mind is with Meraki APs, they use a deterministic hashing algorithm to assign local IPs (from a HUGE pool) so clients can roam without coordination between the DHCP servers on each device. This enormous address space would be annoying to route on the main network, so NAT is used to distill it to one valid main network address. The APs backhaul to another security appliance running NAT. Granted, it is a much more valid use case than the one mentioned above with better hardware, but actually works just fine. Sep 12 at 7:12
  • @Peregrino69 As far as port forwarding, it is not relevant to the Meraki example above, but in the posted question they could put matching forwards on both devices. First a forward from gateway router to customer router, then customer router can forward to local device. No chance of uPnP working, but I personally turn that off anyways! Sep 12 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.