Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Networking VLAN, Double NAT, or Guest Wifi


  • Please log in to reply
15 replies to this topic

#1 hopperty

hopperty

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:09:02 PM

Posted 24 March 2016 - 09:15 AM

I am working on helping my church consolidate from using two internet connections with two modem/routers to one.  The current setup is office computers wired and wireless on one router.   Unsecure Wifi on the other router with two wireless access points (which are old wifi routers) that someone previously set up.

 

What is the best way to share one internet connections and keep the networks separate.  I've read tons of how-tos and the negative effects of double NATs.  I read about VLANs.

 

The local tech company quoted just using a "commercial grade" router at a price of $250. Would he just use the guest network?  Not sure how they would keep the unsecure wifi separate.

 

I was planning on a managed switch and a similar router.

 

Your help is appreciated.

Thanks.



BC AdBot (Login to Remove)

 


#2 TheJokerz

TheJokerz

  • Members
  • 286 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ohio
  • Local time:09:02 PM

Posted 24 March 2016 - 09:32 AM

I am by no means a networking expert!  So I hope I do not steer you in the wrong direction.  You could get the switch, and set one port of it for the vlan, and then connect the wifi to that one port and that will keep the unmanged guest network.  Then use the other AP for everyone one else that needs to be on that network.


utl8q0-5.png


#3 hopperty

hopperty
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:09:02 PM

Posted 24 March 2016 - 09:42 AM

That was my original plan. To split the network using vlan and putting the port the router is connected to on both networks, however, I read online about an issue with that.

#4 DeimosChaos

DeimosChaos

  • BC Advisor
  • 1,420 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:United States, Delaware
  • Local time:09:02 PM

Posted 24 March 2016 - 11:23 AM

A lot of routers have a guest network that you can have people connect to. So that is always an option. Would be a whole lot simpler as well. As far as how separate the traffic is... I'm not sure.

 

Another way you might go (which I think is more or less what TheJokerz was saying) is to just use different subnets for each network. If you get a router that can be flashed to DD-WRT you will have some better options at configuring than the standard router OS. With the standard router OS you can have it dish out IPs based off different subnet masks. So you can always play with that.


OS - Ubuntu 14.04/16.04 & Windows 10
Custom Desktop PC / Lenovo Y580 / Sager NP8258 / Dell XPS 13 (9350)
_____________________________________________________
Bachelor of Science in Computing Security from Drexel University
Security +


#5 ScathEnfys

ScathEnfys

    Bleeping Butterfly


  • Members
  • 1,375 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Deep in the Surface Web
  • Local time:09:02 PM

Posted 24 March 2016 - 11:35 AM

if you do go the subnet method, make sure that the two subnets can't talk to each other.
Proud system builder, modder, and watercooler.

GitHub | SoundCloud | Keybase

#6 hopperty

hopperty
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:09:02 PM

Posted 24 March 2016 - 11:42 AM

Doesn't two subnets cause a double NAT?  Or is there another way to do it?



#7 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:06:02 PM

Posted 24 March 2016 - 11:46 AM

follow the KISS principle

https://en.wikipedia.org/wiki/KISS_principle

 

There isn't anything wrong with the present configuration.

 

Subnetting is not the way to go and does not secure a network. Most times a simple change of your subnet mask will give you access to everything.

 

Unclear what you have been reading concerning double nat and vlans with internet but they are not true.  Think about it, you are more than double natted every time you go to a web page as a tracert will show you.  All vlans existing on the internet port is a standard configuration.  Odds are guest enabled router will not give you the coverage you need

 

Your best route is a managed switch with two vlans.  You can use all the existing equipment you have but will need an additional nonwifi/wifi disabled router.

 

internet connection<>no wifi router<>managed switch<>existing office router and guest router network

 

The only other consideration is bandwidth.  Most likely you will need to double the single internet connections bandwidth.  If you can't then stay with the two connections.


Edited by Wand3r3r, 24 March 2016 - 11:47 AM.


#8 ScathEnfys

ScathEnfys

    Bleeping Butterfly


  • Members
  • 1,375 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Deep in the Surface Web
  • Local time:09:02 PM

Posted 24 March 2016 - 11:49 AM

the problem with managed switches is the cost. I haven't heard of any issue with NATing (heck, it's what I set up for a small school's guest network), so that should work to.
Proud system builder, modder, and watercooler.

GitHub | SoundCloud | Keybase

#9 hopperty

hopperty
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:09:02 PM

Posted 24 March 2016 - 11:52 AM

Will the modem/router combo work as the "no wifi router" in your layout?  So I could do:

 

Modem/Router <>Managed Switch<>Office Router and Guest Router Network

 

Will there be any issue allowing both office and guest networks access to the no wifi router port on the managed switch. Does the router have to support VLAN?



#10 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:06:02 PM

Posted 24 March 2016 - 11:57 AM

Router doesn't have to support vlans.  Managed switches can be bought for under $200 so cost imo is not a issue.  Heck I have dlink and netgear managed switches at home though I prefer HP.  Configuration is simple.  You create two vlans public and private. Port connecting to the internet has both vlans. In your case you have port 1 go to the internet router, port2 private vlan goes to the office router and port3 public vlan goes to the guest router


Edited by Wand3r3r, 24 March 2016 - 11:57 AM.


#11 hopperty

hopperty
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:09:02 PM

Posted 24 March 2016 - 12:32 PM

I thought this was how I would do it.  But I thought I read about the modem/router dropping the tags or something to that affect.  When I set this up, I will use the modem/router for DHCP and DNS. Then the other two routers would be like trunks, or another setting?

 

 

Router doesn't have to support vlans.  Managed switches can be bought for under $200 so cost imo is not a issue.  Heck I have dlink and netgear managed switches at home though I prefer HP.  Configuration is simple.  You create two vlans public and private. Port connecting to the internet has both vlans. In your case you have port 1 go to the internet router, port2 private vlan goes to the office router and port3 public vlan goes to the guest router



#12 ScathEnfys

ScathEnfys

    Bleeping Butterfly


  • Members
  • 1,375 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Deep in the Surface Web
  • Local time:09:02 PM

Posted 24 March 2016 - 12:34 PM

Assuming you have 1 "other router" on each VLAN, you would need to set them up as access points, and access points alone.
Proud system builder, modder, and watercooler.

GitHub | SoundCloud | Keybase

#13 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:06:02 PM

Posted 24 March 2016 - 01:39 PM

Three ways to set this up:

 

Basic using a unmanaged switch. 

nonwifi router lan [192.168.0.1] connected to unmanaged switch

private wifi router wan port [192.168.0.2]

public wifi router wan port [192.168.0.3]

I would disable the nonwifi routers dhcp and do static ip assignments to the wifi routers wan ports

 

Both public and private wifi routers would have dhcp enabled so as to provide ip addresses to connecting devices

private wifi router lan [192.168.10.0/24]

public wifi router lan [192.168.20.0/24]

 

Basic using a managed switch.

nonwifi router lan [192.168.0.1] connected to managed switch

private wifi router wan port [192.168.0.2]

public wifi router wan port [192.168.0.3]

I would disable the nonwifi routers dhcp and do static ip assignments to the wifi routers wan ports

 

Both public and private wifi routers would have dhcp enabled so as to provide ip addresses to connecting devices

private wifi router lan [192.168.10.0/24]

public wifi router lan [192.168.20.0/24]

 

Simple managed switch design:

You could just have the non wifi router do dhcp for everything but you would not be connecting the wifi routers wan port to the switch.  You would connect the wifi routers by a lan port to the switch.  You would disable the wifi routers dhcp servers.  This would turn the wifi routers into glorified AP switches for both wifi and wired clients.



#14 hopperty

hopperty
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:09:02 PM

Posted 24 March 2016 - 02:01 PM

If I understand correctly.

 

Let me know if this will work then:

 

Modem/Router with DHCP on to port 1 on Managed Switch

Wifi Router and other clients on ports 2 through 6 on managed switch LAN to LAN for router

Ports 1-6 on VLAN1

Wifi Router on port 7 LAN to LAN

Ports 1 and 7 on VLAN 2

 

Both routers have DHCP off.

 

Are there any special settings I need other than setting up the ports in the VLAN?



#15 Wand3r3r

Wand3r3r

  • Members
  • 2,027 posts
  • OFFLINE
  •  
  • Local time:06:02 PM

Posted 24 March 2016 - 02:09 PM

Assuming a 8 port managed switch

Port 1 has both vlan1 and vlan2

Ports 2 thru 6 vlan1

Port 7 vlan2

 

Be aware that devices connecting to the switch will get more bandwidth than those connecting to the wifi routers.

This is why I only have the routers connecting to the switch so everyone is at the same hierarchy level.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users