1

I'm designing a network that basically needs to separate staff network and customer network. The client currently has a standard ISP modem/router that has no VLAN capability or any ability to separate traffic. I've suggested we should only need an EdgeRouter which will handle one network (guest/customer network) and then the ISP router will handle the private staff traffic.

We can't remove the ISP modem, as the modem currently does SIP and the ISP doesn't provide SIP details, this is why I'm restricted to having to keep the ISP modem in the design.

Conceptual design:

ISP Modem/Router -> EdgeRouter -> Access Point

Networks:

ISP Modem/Router: 192.168.15.1/24 - Main WAN Router. Staff LAN, will have an SSID. Connected directly to Eth0 on ER.

EdgeRouter Eth0: 192.168.15.2/24 - WAN interface

EdgeRouter Eth1: 172.16.0.1/24 - VLAN100, LAN interface

Ubiquiti Access Point: 172.16.0.2/24 - Tags all traffic as VLAN100

Firewall rules to allow access from 172.16.0.1 to internet and back, but no other networks should need to communicate and essentially shouldn't see each other.

I do understand VLANs, but I'm unsure if VLANs are even necessary as both networks will be operating in different subnets anyway. Would it be better to VLAN them anyway, as someone could change their IPs on a device to match the other subnet? But I don't want to complicate the network to much, there is only need for one access point. Am I designing this correctly, or should something be changed?

Would really appreciate everyones input!

Improve this question
2
  • Seriously, you should seek some legal advice before allowing strangers on a network you control (guest network). You may be held liable for anything a guest may do on such a network. The current trend is to outsource guest networks to companies that do that and have the resources and experience to prevent criminal activity on the network. Then the guest network doesn't touch your network, and you have no direct control and are legally protected.
    – Ron Maupin ♦
    Dec 11, 2019 at 14:29
  • You've misunderstood the context and situation. The network isn't used for giving guests free WiFi. The separation is for a small IT company, when devices come in for repair and then leave without being removed and would have the WiFi remembered, in conjunction with resetting passwords every so often, we'd like to implement a separation between the networks and this is what I've proposed. This question is directly related and strictly related to design, not the legality side. Hope that clears things up, however, thanks for your response.
    – Lane
    Dec 11, 2019 at 14:42

1 Answer 1

Reset to default
1

You do not need vlans in this situation. Just create the firewall rules to block 192.168.15.0/24, and allow everything else.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.