I need to configure my wireless router so all wireless devices are on a different subnet (

The wireless devices should be able to access the internet, but ideally not the workstations on the LAN.

Here is my network:

enter image description here

All suggestions welcome!

  • What are the make/models of the default gateway router and the core switch? This can be straightforward provided they both support VLANs. – Paul Mar 22 '13 at 2:03
  • A little more information on what you're currently running is needed. Is this a home network (I assume not) or a business/work network? What model of wireless controller/router do you have? etc.. – Josh Mar 22 '13 at 2:49
  • It's actually a non-profit organization. I don't have the models of the routers with me right now- but it's all residential-grade equipment. I don't think VLANs are an option this time. – Austin ''Danger'' Powers Mar 22 '13 at 3:09

The way to accomplish this using consumer grade equipment is using a 3 router Y configuration

enter image description here

By setting the two routers up using the same subnet but on different "LAN"s it is impossible for one network to talk to the other network.

Think of it this way: you have a computer on LAN A with a IP of and a one of the wireless clients on LAN B with a IP of If on LAN B you request (one of the wireless clients trying to connect to a wired client) it goes to LAN B's router, sees that it is a request for the 192.168.1.x subnet and does not forward the packet any further up the chain (it could but it would not matter, see the lower section of this answer). It also sees that it does not know of any computer at (The only computer it knows about is and reports back to the original computer "destination host unknown". If we request any other IP other than 192.168.1.x it will use the gateway and continue on to the internet to try and resolve your IP connection.

This gives you complete security on your network giving you two LANs that are physically impossible to talk to each other while still letting both connect to the internet.

Depending on how your wireless router's firmware works you may be able to do it with two routers by just moving the connection of the wireless from it's LAN port to its WAN port. However you can only do this if the wireless router does NOT forward requests it can't resolve to the gateway for it's own subnet (so in my previous example the wireless router must NOT check the WAN port for for the two router configuration). The upside to this if your router does behave the way you want you don't need to buy any additional hardware.

In the 3 router Y configuration it does not matter if the router forwards requests or not because on the Y LAN there are no 192.168.1.x computers, only the two routers WAN interfaces which are both 192.168.0.x.

Here is a new diagram that is closer to your original diagram to help explain it. enter image description here

  • So just to check- there would be no physical connection between the 2 routers at the bottom of the diagram? And those 2 routers ( & are connected to the gateway router by their WAN ports? – Austin ''Danger'' Powers Mar 22 '13 at 17:00
  • @Dan Correct, in the above diagram the light blue is the WAN ports and the orange is the LAN ports. However, one correction about what you said, you had the IP of the WAN ports wrong. All of the computers past the 2nd set of routers (on both networks) have IP's in the 192.168.1.x range, but all of the machines on the Y network (and in this configuration it should only be the internet router's LAN side and the two sub routers WAN side) will have IP's in the 192.168.0.x range. – Scott Chamberlain Mar 22 '13 at 17:55
  • @Dan Added a new diagram to be closer to your original one to help explain. – Scott Chamberlain Mar 22 '13 at 18:14
  • 1
    You can do it in consumer-grade routers too if you are using a more powerful custom firmware (dd-wrt, tomato, ect.) that let you write directly to the underlying Linux system's iptables command. – Scott Chamberlain Dec 30 '13 at 20:11
  • 1
    @toffee.beanns No, it can not. The entire point of this configuration is to prevent guest laptops on the wifi to access anything not on the wifi. – Scott Chamberlain Aug 22 '18 at 19:19

I'm assuming your wireless router is a sub-$100 one you'd buy at a department store.

You really need a router with 3 interfaces. A PC running Linux with 3 network cards does this nicely - one NIC is the WAN, the other NIC is connected to your LAN hosts, and the third your wireless router is plugged into. You can then run a DHCP on the Linux box listening and giving out IPs on the LAN and WLAN interface.

You're in for a bit of iptables configuration in order to make sure the WLAN hosts can't talk to the LAN hosts (relatively simple since they are on separate subnets).

You could also put the LAN hosts behind their own router, and configure any SPI firewall settings on the wireless and wired router to drop traffic from the other subnet. Note that in this situation you'll need a separate DHCP server running on each subnet since broadcast traffic isn't forwarded by routers.

You could also, if the wireless router supports it, tell it to block all outgoing traffic originating from behind it to the subnet that your wired LAN is on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.