topic Re: VLAN in Tech Help - Software/Hardware etc

VLAN

Steevo — Mon, 16 Mar 2015 18:55:03 GMT

I'm considering splitting my network into two so that I can provide a guest network via two APs whilst keeping my business network private. Currently using Windows Homegroup to do this, but wondering whether a VLAN router would be a better bet. Can anyone advise further please?

Re: VLAN

VileReynard — Mon, 16 Mar 2015 19:59:17 GMT

You might do better to connect via a different ISP.
This would allow your business network to have a very limited amount of redundancy.

Re: VLAN

Steevo — Mon, 16 Mar 2015 22:09:11 GMT

Could you explain this please?

Re: VLAN

nanotm — Tue, 17 Mar 2015 14:59:45 GMT

you could do this with a single wifi router,method;
your current network is 192.168.1.x>xxx subnet 255.255.255.0
new wifi router hook it up to laptop with a wire enter admin mode, configure it's dhcp server to run from 192.168.2.x>xxx subnet mask 255.255.255.5 save and restart
unplug the wire from the laptop and plug it into the current network router, bingo you have an unmapable separate network for guests that still has internet access giving you complete isolation between work and guest network.
you can also utilise QoS to rate limit the bandwidth available to the guest network so that cheeky people cant be streaming movies and blocking your work access
no idea what foxy is on about but I suspect he's implying you should have fall over redundancy for your internet connection using multiple isp's and leased lines (which is hugely pricey)
edited a typo

Re: VLAN

Steevo — Tue, 17 Mar 2015 15:05:25 GMT

Wow! That sounds rather handy if I can do it as simply as that. I wasn't aware you could daisy chain two routers like that and that one would take the IP from the previous, but could also then assign IPs itself using a different set of IPs.

Re: VLAN

pwatson — Tue, 17 Mar 2015 15:10:29 GMT

Do NOT do what nanotm has suggested!!!
As described (connecting the LAN port of the second router to a LAN port on the 1st router) will not work at all. Connecting the WAN port of the 2nd router to a LAN port on the 1st will result in a working system *but* all the devices on the 1st LAN will be visible on the 2nd!!!
Far better either putting a firewall between the two networks, preferably with a captive portal that displays acceptable use polices etc when first used. At the very least, investigate routers that implement access isolation.

Re: VLAN

VileReynard — Tue, 17 Mar 2015 15:24:10 GMT

Quote from: vilefoxdemonofdoom
You might do better to connect via a different ISP.
This would allow your business network to have a very limited amount of redundancy.

Simply subscribe to a totally different ISP with its own router/access point.
If your Plusnet connection fails, you could use the "guest" connection as a temporary backup.
(Obviously all guests would have to be kicked off).

Re: VLAN

nanotm — Tue, 17 Mar 2015 15:47:53 GMT

Quote from: pwatson
Do NOT do what nanotm has suggested!!!
As described (connecting the LAN port of the second router to a LAN port on the 1st router) will not work at all. Connecting the WAN port of the 2nd router to a LAN port on the 1st will result in a working system *but* all the devices on the 1st LAN will be visible on the 2nd!!!
Far better either putting a firewall between the two networks, preferably with a captive portal that displays acceptable use polices etc when first used. At the very least, investigate routers that implement access isolation.

I didn't specify the exact steps but thanks for pointing out you have to use the wan port on the secondary router, (the one I'm currently using its in lan port 1 because there isn't a wan port and that's what the manufacturer recommends)
@steevo its slightly more involved than I indicated, there's more setup steps required in the admin mode side of the secondary router, but essentially it is as simple as changing the network address space provided by the secondary router,
the exact steps to take will depend on the router you purchase to use for the guest network, and what router your using as a primary, personally I have a billion 7800dx primary router and then have a buffalo airport as the secondary router, so for me it was a case of using the lan port on the router to a lan port on the other router with separate address space's.
the secondary unit clients cannot see or here any of the primary network, and the primary network can only see the secondary router but none of the clients on it.
and its a hell of a lot simpler than trying to create virtual LAN's
here's a quick search of methods people have used to set things up in the past https://www.google.co.uk/?gws_rd=ssl#q=create+guest+network+with+second+router
hopefully you will get yours up and running in under an hour just like I did

Re: VLAN

pwatson — Tue, 17 Mar 2015 15:55:31 GMT

Again DO NOT DO THIS (apologies for shouting, but it's important that the point is made!)
Simply connecting a second router to the first means that everything on the first LAN is visible on the second!!!

Re: VLAN

Steevo — Tue, 17 Mar 2015 15:56:47 GMT

Now I'm all confused!!
@vilefoxdemonofdoom thanks for your suggestion but I don't want a second ISP/connection/cost etc. I'm happy to split the existing connection.
Would something like this do as a second router coming off my Plusnet modem router? Or perhaps this if I were to replace the 582N?
Sorry for the dim questions. I'm not too bad with technology, but happy to admit I'm totally out of my depth here.

Re: VLAN

pwatson — Tue, 17 Mar 2015 15:59:29 GMT

Please see my post above!
If you're going to buy a new router, buy one that has properly implemented Guest network facilities and use it as your only router.

Re: VLAN

Steevo — Tue, 17 Mar 2015 16:20:03 GMT

Thank you @pwatson. I shall steer clear of using two standard routers as above.
Are you able to suggest a few such routers please? I've seen consumer routers that have "Guest WiFi" but I could do with a wired solution so I could assign one specific port to guests to split from there.

Re: VLAN

pwatson — Tue, 17 Mar 2015 16:33:53 GMT

Regrettably it's not a subject I've looked into, so I can't recommend specific hardware. I'd look into the Draytek range as they have VLAN facilities or routers that can run firmware such as OpenWRT, DD-WRT or Tomato .

Re: VLAN

Oldjim — Tue, 17 Mar 2015 16:41:25 GMT

this is a bit old but may help http://www.pcworld.com/article/2038219/8-essential-features-you-need-in-a-business-router.html
Otherwise if you Google Router with VLAN is may bring up a few options

Re: VLAN

Steevo — Tue, 17 Mar 2015 16:56:50 GMT

Thanks Oldjim. That's where I found the two Ciscos.

Re: VLAN

VileReynard — Wed, 18 Mar 2015 00:07:17 GMT

Quote from: Steevo
Now I'm all confused!!
@vilefoxdemonofdoom thanks for your suggestion but I don't want a second ISP/connection/cost etc. I'm happy to split the existing connection.
Would something like this do as a second router coming off my Plusnet modem router? Or perhaps this if I were to replace the 582N?
Sorry for the dim questions. I'm not too bad with technology, but happy to admit I'm totally out of my depth here.

My router - a netgear WNR1000v3 provides a basic guest capability, which I don't use.
I can't restrict its bandwidth or anything else - see attached

Re: VLAN

nanotm — Wed, 18 Mar 2015 00:18:48 GMT

you need a business grade device for the "extras" like that, it requires creating a group that's isolated from the remainder of the network firewalling it from the lan side and then you can split the bandwidth ratio between the groups however you desire,
for instance my router offers me the chance to group or ungroup each lan port and each wifi network (i can have 8 of them) all with their own dhcp server still function as a upnp virtual server host (no need to use dmz or port forwarding for anything)
but i prefer to have separate devices for each network so I can just unplug one and still work without needing to undo/redo all the setup each time i want to take it down or put it back up again.
but it seems more people would rather choose the less intuitive and more basic routers because they can save a few quid /

Re: VLAN

Anotherone — Wed, 18 Mar 2015 10:46:34 GMT

I thought the TG582n had the ability to set up a guest network, but not something I've looked into? Anyone?

Re: VLAN

Oldjim — Wed, 18 Mar 2015 14:27:12 GMT

to avoid confusion
the OP wants to do it wired not wireless

Re: VLAN

nanotm — Wed, 18 Mar 2015 14:55:05 GMT

then he needs a router that allows port grouping,
I don't know about any other sort of router through experience but I do know for a fact the billion 7800dx does have this facility.
it allows you to create either wired or wireless groups each group may be setup under a single dhcp server and if you use group isolation then they are totally separate from each other, it allows you to set QoS rate for each group (you can have up to 8 groups) specify which group is allowed to access the router and it allows for search filtering or url blacklisting /whitelisting per group or globally, with or without time stipulations and a whole host of other stuff that not running a business I don't use....
I'm certain others will do the same but not many of them cost under £200