RT-AX86U wired network connection to second WIFI network

[kev2021]

Hi all,

So I have setup a 2nd WIFI network which I’ve connected all my IOT devices to.

I’m now considering setting up home assistant on a virtual machine and I’m wondering how can I get a wired connection to the same 2nd WIFI?  Anyway to vlan the ports on the router? I can set a port on my switch to a separate VLAN but don’t think that will work.

Alternatively, is there a way I can set traffic from main network into the 2nd WIFI network BUT not allow traffic from 2nd wifi network into the main network?

Alternatively I guess I’d have to get a separate device like a rasberry pi and connect it to the 2nd wifi and use it from that but just means more expense.

Thanks

Kev

Share the knowledge

You need to login in order to vote

[UK Sentinel]

Slightly off topic, did you ever manage to upgrade your RT-AX86U firmware to the latest release – 22525 ?

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[kev2021]

Hi,

Not bit the bullet yet… I asked of a diff forum if the Nest thermostat, nest protect and tplink smart plugs worked ok after update but no one could advise and said to basically do it and report back any issues etc so I’m sure others must have a one of those products so been holding off ATM but I suspect will need to do it at some point and take that chance..

Kev

Share the knowledge

You need to login in order to vote

[UK Sentinel]

kev2021 wrote:

Not bit the bullet yet… I asked of a diff forum if the Nest thermostat, nest protect and tplink smart plugs worked ok after update but no one could advise and said to basically do it and report back any issues etc so I’m sure others must have a one of those products so been holding off ATM but I suspect will need to do it at some point and take that chance..

I am sure ‘everyone’ is waiting for you to take the plunge

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

Liked by:

You need to login in order to vote

[UK Sentinel]

kev2021 wrote:

Alternatively, is there a way I can set traffic from main network into the 2nd WIFI network BUT not allow traffic from 2nd wifi network into the main network?

Alternatively I guess I’d have to get a separate device like a rasberry pi and connect it to the 2nd wifi and use it from that but just means more expense.

How is the 2nd WIFI network configured and how important is the separation between the two networks, is security a concern (in all its forms), if not then a firewall with VLAN’s set up’ should’ work with the switch as you describe, probable.

If security is a concern, then most definitely, a dedicated device is advisable such as a data diode or a firewall set-up correctly could suffice.

https://www.garlandtechnology.com/blog/firewalls-vs.-data-diode-why-ot-security-teams-turn-to-data-diode-taps

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[kev2021]

I didn’t want anything on the 2nd WIFI to have access to anything on my main network i.e. keep it totally separate for security reasons so that if any of my smart devices get hacked etc, they cannot get to anything else on my network other than other smart devices possibly if they can hack them.

The data diode I’ve not heard of, do they do a WIFI data diode as from a quick look, it seems like you need to plug it in and therefore back to same issue, how do I plug it into the 2nd WIFI?

Thanks

Kev

 

Share the knowledge

You need to login in order to vote

[UK Sentinel]

kev2021 wrote:

I’m now considering setting up home assistant on a virtual machine and I’m wondering how can I get a wired connection to the same 2nd WIFI?

I thought originally you wanted a wired connection, hence the suggestion for data diode which could be plugged into LAN side of 2nd Wifi segment ?

any chance of a diagram of what you are after, especially what has access to internet and what does not  (segmented)

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[kev2021]

Yes, ideally want wired connection but I don’t see how I can assign say port 2 on the router to be on the same IP range as the 2nd WIFI network (on the same network), doesn’t seem to be a way so if I plugged in a data diode, it will be on the main network, not the 2nd WIFI network range, correct?

Effectively any device I plug into the router at present on LAN port connects to my main network, doesn’t seem to be a way to say this port needs to be on the 2nd WII network, they are all on the main network. I.e. main network 192.168.1.x and 2nd WIFI 192.168.2.x, every device I plug in comes up on 192.168.1.x not 192.168.2.x if you see what I mean.

Thanks

Kev

Share the knowledge

You need to login in order to vote

[UK Sentinel]

kev2021 wrote:

So I have setup a 2nd WIFI network which I’ve connected all my IOT devices to.

Just checking, so on 2nd Wifi network, does any of the IoT devices require internet access ?

Does main network have access to internet ?

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

Liked by:

You need to login in order to vote

[kev2021]

Hi,

Main network has internet access BUT no access to 2nd WIFI network (Guest wifi on router).

2nd WIFI network has internet access but no access to main network.

So basically wanted to connect a device via cable to the guest wifi but don’t see a way to set one of the LAN ports on router to be Guest network (2nd WIFI)..

Kev

Share the knowledge

You need to login in order to vote

[UK Sentinel]

kev2021 wrote:

I didn’t want anything on the 2nd WIFI to have access to anything on my main network i.e. keep it totally separate for security reasons so that if any of my smart devices get hacked etc, they cannot get to anything else on my network other than other smart devices possibly if they can hack them.

If both main network and guest 2nd wifi both have access to internet, there is the possibility that a device on the 2nd wifi can be compromised as it has access to internet.

Diag. below hopefully gives simplistic view of what you are trying to achieve I think and does allow Main Network and 2nd Wifi (or LAN) to be physically separated.

 

Share the knowledge

Attachments:

1. 

   Main-Network-1-1.png
   

In a completely sane world, madness is the only freedom (J.G.Ballard).

Liked by:

You need to login in order to vote

[kev2021]

Thanks, yes the 2nd WIFI (guest ) network has internet access so i can control IOT devices when not at home.  I realise they could be compromised, which is why I’ve left them in guest network with no access to main network (different IP range) so if worst happens, it will only be IOT devices compromised.  All my storage, files, machines etc wont be affected on main network.

How do I go about getting a VM setup to be on the guest network when it is physically plugged into the router on wired network on main network? Doesn’t seem to be a way I can say port 3 on router is assigned to Guest network meaning it gets IP in guest network range.  If I simply assign my VM a guest IP, it wont work as everything is on the main network IP range so it wont communicate at all to anything.

if I could allocate a port on the router to be guest network via say vlan or something that would do but doesn’t seem to be a way, all LAN ports are on the main network. it seems the guest WIFI is literally just that a guest WIFI, no way to have a wired machine in that network, it looks to be WIFI only.

Thanks

Kev

Share the knowledge

You need to login in order to vote

[UK Sentinel]

One last set of questions. IoT devices on 2nd wifi, are they required to be able to see each other or have you already set up AP isolated on your ASUS router ?

FYI, only the below ASUS routers (stock firmware) currently support VLAN’s on LAN, so we may need to introduce a switch or another wifi device etc.

I am also looking at maybe an AiMesh option that will allow the AiMesh node to run a 2nd guest wifi only, thus providing the separation but unsure if performance (throughput) is important or maybe placing the wired machine in a DMZ type (“back-end” firewall) scenario to share between the LAN’s ?

Or as you say, ‘keep it simple’ and run Home Assistant via a Rasberry pi and put it is the 2nd guest area, alas not sure if you need Home assistant to access anything in Main Network ?

GT-AX11000 Pro, GT-AX6000, ROG Rapture GT-AXE16000, RT-AX86U Pro, RT-AX88U Pro, ZenWiFi Pro ET12, ZenWIFI Pro XT12

https://www.asus.com/support/FAQ/1049415/

 

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

Liked by:

You need to login in order to vote

[UK Sentinel]

But if you are feeling brave for Tutorial on LAN port isolation on Asus Merlin ….

https://www.snbforums.com/threads/lan-port-isolation-on-asus-merlin-example.73704/#post-700937

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[kev2021]

Hi,

IoT devices are all on 2nd WIFI and no issue with them seeing each other.  Nothing on 2nd WIFI can see main network devices. ah dam, any plans for Asus to bring that to the RT-AX86U? I see it is on the RT-AX88U.  Soo annoying, looks like I bought the router too soon, should of waited and bought the RT-AX86U pro…

Had a look at the guide quickly, will take a bit of familiarisation on that, not really done much network config, last time I did any network config was cisco stuff back in 2005 on a course for CCNA…. no doubt has all changed since then and no doubt different commands being non-cisco.

other option is indeed a raspberry pi or some kind of mini pc that can run home automation.  Don’t think I have anything in main network BUT I believe the raspberry pi has a LAN port so i guess i could potentially connect it to 2nd WIFI and Lan to main network but would that allow traffic between the 2 networks or just the raspberry pi to access both networks i.e. if I said access device 192.168.1.x it would go via LAN and if I said access 192.168.2.x it would go via WIFI? or would I need to somehow ensure no data can pass between the 2 networks?

Thanks

Kev

Share the knowledge

You need to login in order to vote

[Author]

Posts