Wireless network separation - 2 routers

Hi

I need to separate wireless network we have for customers from our network. We have our network on ADSL router Netgear DGN2200 (192.168.0.1/24) which is dishing out DHCP and doing DNS. Computers are in Workgroup > we don't have machine with server operating system. We also have additional router WNR2200 which is plugged into the DGN2200 network and is getting IP address for its WAN port. WNR2200 has got different local subnet 172.16.16.0 with 255.255.0.0. WNR's IP address is 192.168.1.2 with 255.255.255.252 while DGN2200 gateway is 192.168.1.1 with 255.255.255.0. WNR2200 has  wireless on it for customers and has DHCP and DNS enabled for its 172.16.16.0 network.  I am not able to introduce VLAN because those routers don't support it.
The problem is that when connected to customers' wifi on WNR2200, I am able to ping and access all the devices on DGN2200's 192.168.0.0 network and obviously I don't want that.
I was wondering what's the best solution. I have researched a little bit and some people suggested getting another router in between DGN2200 and WNR2200. Additionally, I tried TP-LINK TL-WA901ND but it wouldn't sort out the problem.

Thank you for all suggestions.

Tom
Tom SkowyrskiAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Faruk Onder YerliOwnerCommented:
First of all you have use a wireless access point which is supporting guest mode. Or you can try to find in wireless menu what you have in your hand. The guest mode is deny interconnection between wireless client and LAN.

I can recommend you ubnt.com wireless system that guest network will be isolated.
0
pr0t0c0l12Commented:
Yup by definition on your router you should be putting the wireless users on the guest network. Please take a look at it below...


The NETGEAR N300 Wireless Router with USB is ideal for both professional and personal Internet use, providing Wireless-N speed for simultaneous downloads, voice and music, and online gaming. Storage for downloads is easy with ReadySHARE for shared access to a USB storage device. Faster downloads and online gaming - Provides Wireless-N speed for simultaneous downloads, streaming voice and music and online gaming, in addition to basic Internet applications. Shared storage - ReadySHARE provides fast and easy shared access to an external USB storage device. Live Parental Controls - Keeps your Internet experience safe. Blocks unsafe Internet content and applications and can be managed from anywhere. Protects connected devices through the router such as PCs, gaming consoles, and iPod touch. Guest network access - Provides separate security and access restrictions for guests using the network. Broadband usage meter - Monitors Internet traffic and sends customized reports to help keep costs under control. Jitter-free voice and gaming - Automatic Quality of Service (QoS) for reliable Internet connections. Easy setup - NETGEAR Genie CD with graphical installation guide and multi-language support. Secured connection - Push 'N' Connect ensures a quick and secure network connection. NETGEAR Green features - Power and Wi-Fi on/off buttons and 80% recycled packaging.
0
Tom SkowyrskiAuthor Commented:
Sorry but I forgot to mention that I am using the Guest Network. The option for Wireless Isolation is selected and the option to Allow access to local LAN is unticked.
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

Fred MarshallPrincipalCommented:
I believe you will find that the DNG2200 will support BOTH office and separate guest wireless networks.  Certainly v3 will do that.  Then no need for the added access point.
0
Faruk Onder YerliOwnerCommented:
I think you are using guest AP WAN port on other device LAN port. If like this one you can not prevent it. you have to use same equipment LAN and wireless than enable guest network. It will work.
0
Fred MarshallPrincipalCommented:
I had a DGN2200 that appeared to be doing the same thing but I wasn't able to check the checkbox that allows guest access to the office LAN (for unrelated reasons).

Here is what I'd recommend:

Change the DNG2200 LAN subnet.
Get another wireless router.
Give its LAN the current office subnet.
Connect its WAN to the DGN2200 LAN.
Put the office network on the new router LAN.
Set up a wireless capability on the DGN2200 for Guests.
Set up a wireless capability on the new router for the Office.

The attached shows how on the first page with the DGN2200 being the first two boxes and having one less subnet in the cascade of things.
Multiple-Subnets.pdf
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Tom SkowyrskiAuthor Commented:
As I need My DGN2200 (main router) to be the first Lan then would you agree that the easy and cheap way would be to add intermediary router like TP-link -tl-r460 between DGN2200 and WNR2200:
http://www.amazon.co.uk/TP-Link-TL-R460-Port-Cable-Router/dp/B002OMX0XQ/ref=sr_1_1?ie=UTF8&qid=1413827752&sr=8-1&keywords=TP-link+r460
Probably, I could forward the port on to-link to be able to access WNR2200 web interface.
I am not planning to have any VPN or anything which requires port forwarding on WNR2200 network.
And to Just to clarify: WAN PORT OF WNR2200 plugs into the LAN port of DGN2200. There is no AP port on WNR2200. There is AP port on DGN2200 but this is only if you want to use DGN2200 as access point (then you can't log into it and you cannot use ADSL port in that configuration).
I do not require wifi on DGN2200 and if I did I would need those devices to be able to access DGN2200 lan.
0
Tom SkowyrskiAuthor Commented:
Or another idea I have:
Would it work if I replaced DGN2200 with the router (probably entry basic level Cisco) which supports VLAN. then I would configure 3 LAN ports to be VLAN1 for local network (currently DGN2200) and the 4th LAN port on Cisco would be VLAN2 to which WNR2200 would be plugged in. Please note that WNR2200 does not support VLANs. However, I assume it would be Cisco router managing VLANs access and segregation so it would not matter.
What do you think?
0
Fred MarshallPrincipalCommented:
You would need a modem.
Then you could add a router with VLAN capability.
Then you could use each VLAN as you choose - including as you described.
Do you need office wireless?  Where from then?

If you notice the diagram I attached earlier, the *private* LAN is at the bottom of the page (and the cascade of routers) and the *guest* LAN is higher up.  This is because one can generally "see" the computers on the upper LAN from the computers on the lower LAN and not vice versa.  So, adding the WNR2200 to an upper LAN will likely allow unwanted access as you are now experiencing.  I don't really see any great application for the WNR2200 in this case unless the office LAN router has no wireless.  Then use the WNR2200 as an office wireless AP.
0
Tom SkowyrskiAuthor Commented:
fmarshall, so it looks like my mistake is that I am using Interim network as main network for wired computers (I have similar configuration which is using the main router with wireless for employees) and "2nd Subnet Wireless" is plugged directly into that main router which doesn't do VLAN.
I mentioned Cisco router because it has WAN ports and I was hoping it is compatible with BT Infinity Fibre optic as it comes with BT OpenReach modem (this modem plugs into the phone line and the router plugs into the modem - there is no local private network on the modem as it is passes public IP address directly to the main router).
The reason why I mentioned Cisco is that I trust it more than TP-link. I assumed the following:
1.  I could replace main router with Cisco router doing VLANs so the local network would be separated from the LAN4 port on Cisco router which would have WNR2200 router with public wireless. I was thinking of Cisco RV215W model.
2. I could use current DGN2200 as main router - just reconfigure network id. Then get tp-link I mentioned earlier to be my private local subnet which used to be on DGN2200, this would be plugged into the main router. WNR would also plug into the main router.
0
Fred MarshallPrincipalCommented:
Yes.  VLANs should work.
0
Tom SkowyrskiAuthor Commented:
I have ordered both Cisco and TP-link as I have this problematic configuration for 2 customers. Will let you know once I tested it and then I will assign the points. However, I may not be able to do it for the next two weeks (not sure if that's allowed).
0
Tom SkowyrskiAuthor Commented:
Will do VLAN for one of the customers and TP-link for other two as it is cheaper and the wifi for customers is not used much.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.