Can I create two separate private networks with only one IP address using only two routers and a switch?

Question

A new renter moved in and wants his own private network with no communication between his and my private network. In addition, he doesn't want a centralized logging of network traffic like most home modem and routers do.

The landlord only has one Ethernet cable coming from the ISP. If I connect the ISP cable, the homeowner's router and the new renter's router to an unmanaged switch, then program the landlord's router to use the private network 192.168.1.0 and have the new renter program his router to use 192.168.2.0. Would that work and would it satisfy the new renter's demand of privacy?

Home network diagram:

Answer 1

As presented in the drawing, no.

Firstly a standard ISP residential contract provides a single public IP address; more than that usually requires a substantially more expensive commercial contract. I am assuming this is also a standard residential contract, not a commercial one.

If there's only one IP, it belongs to your router. Any device connected after the WAN port has a direct connection to the internet through the ISP:s routing, so it needs a separate public IP address. Which means you can't just stick a switch between the ISP and your router's WAN port and expect it to work.

If your renter is accessing the internet only via Wi-Fi, you could provide him a separate SSID. However there's the question about logging - the router might or might not log traffic, and you might or might not have the possibility to affect the behavior. You can of course check this in your router's management interface.

If your router supports VLANs, you could create a separate VLAN for your renter with the IP subnet 192.168.2.0/24, but the question of logging still remains.

I see only three ways around this:

1. Your renter contacts an ISP of his choice to arrange his own internet access
2. You contact your ISP and discuss about the possibility of adding another router device into your connection - I doubt this'd be allowed, and if yes a separate public IP is likely to cost money
3. You provide your renter either his own VLAN or a separate SSID, and your renter gets himself a VPN. This is the only surefire way you, your router or the ISP has no way to know what they are doing. The routers could still log the traffic, but would only see packets between the VPN end points. The traffic inside the tunnel is encrypted, so there's no way for anyone to tell what they're accessing.

---

As @ilkkachu and @user1686 have already pointed out, the resources in the routers provided with residential contracts are so tight that they are unlikely to be capable of any meaningful logging. However a knowledgeable person can certainly find a way to trace the traffic between the router and ISP to collect his own logs.

Please note - this is only added for completeness. I'm in no shape or form suggesting that the OP would be even considering to imagine starting to plan something like this :-)

Answer 2

In addition, he doesn't want a centralized logging of network traffic like most home modem and routers do.

But they generally don't... (Many home routers literally don't even have the resources for that. (CPU requirements aside, where would they store those logs if the OS alone barely fits in the flash chip?)

Yes, your layout would create two separate networks which do not interact. (In fact the routers don't even need to have different LAN addresses – only the Wi-Fi SSIDs must be different.)

But this would work only if the ISP allows multiple devices on the same line (leasing two different WAN IP addresses). Some ISPs will allow this, but many won't.

Also, if the renter is worried about routers, I'm wondering whether he'll be just as worried about switches, as most managed switches happen to have "port mirroring" features.

Answer 3

Your connection design would work if you have the option for multiple IP addresses from your ISP. If you only have access to one IP you could go with a VLAN solution but this is not an easy setup for a regular home user. Plus your hardware will need to support VLANS. You could add a router behind the landlords router (the same as adding a third router basically) but this would cause a ton of issues down the road. The best solution if you have access to only one IP address is to have your renter get there own connection. Especially if they are that concerned about privacy.

Your initial design would be considered an easy solution with access to multiple IPs. A separate internet connection would be the most secure and practical solution for the renter. All the other solutions would be a trial and error setup or the hiring of a skilled network technician to have it work as desired. Most advanced network connections like your renter is asking for would be considered beyond most common home users skill level. I mean no offence by that comment. I just want to let you know that there would be no plug in some cables, push a few buttons and you are all running without issues.

I also agree with the other post of a home/ISP router not being able to track anything of use. They just do not have the hardware to do anything more than the basics which would include this local IP went to this public IP at best.

Edit: With access to only 1 IP your setup would still work but take out the switch and just plug into a second LAN port on your ISP connection for the renters line. This will not help with there privacy concerns as the ISP connection will log what is going on and not separate from the landlord or renter connection. It would allow for local separation though as what comes from one router will not show in the other router. This is allowing that your ISP router has more than one LAN port. You could try this option as it should only take a few minutes to see if it works with your current ISP connection. If you go to ipaddress.com from a computer connected to each router and you get a different public IP then your are good to go. If you get the same IP then you have access to only 1 IP and stuck with getting an upgraded connection or a separate line for the renter.

Answer 4

The landlord only has one ethernet cable coming from the ISP. If I connect the ISP cable, homeowner's router and the new renter's router to an unmanaged switch, then

This depends on how the ISP hardware is setup. If it gives a single public IP to whatever is plugged in, this will not work. If the ISP provided equipment does NAT (ie. gives private addresses), sure you can plug in two NAT routers and they will work just fine with DOUBLE NAT. Some people think it is evil, but it would work fine. Even if the ISP line is more like a cable modem and provides a single public IP, you could put your own NAT router in front of the two "subscriber" routers.

A new renter moved in and wants his own private network with no communication between his and my private network.

In the case above with double NAT, actually you could each spy on each other, because the two "subscriber" routers share a broadcast domain on the WAN port. Anyone who has access to that cable can spy, period. Switches provide cosmetic protection, but it is easily circumvented. There are entire classes of MITM attack that arise from sharing a broadcast domain there. Honestly, it is a little secure, but you need a bit of trust.

The correct "business flavored" way would be to buy a router that supports VLAN ports like a Ubiquiti or Cisco Meraki thing, give both "subscribers" a port with separate VLAN, then correctly firewall between them. This actually would be pretty secure for everyone, and more closely matches what an ISP would (ideally) do.

In addition, he doesn't want a centralized logging of network traffic like most home modem and routers do.

This is a BIG problem, if your tenant does not trust you to be their ISP, you can not be their ISP. In the above scenario with an expensive business router, they still need to trust you. Most carriers will gladly provide two independent services to an address, it is the only "zero-trust" solution available.

Trust goes the other way too, like if your tenant downloads a million movies, or does crime, or violates the ToS of your internet service, it will likely come back to you!

Another thought. In the USA at least, as a landlord if you provide internet as part of the property with the lease there is a pretty good chance that you will have to maintain/repair it as a part of the property for the entire lease. This may force you to be an ISP in the bad ways too, like dealing with urgent calls that the internet is down. If your setup is bespoke--unlike say, an electrical outlet--there is no electrician to call if you are out of town, it is all you!