Setup 2 seperate Vlans with 1 TL-SG3424 managed switch

i have 1 TL-SG3424 managed switch & want to setup 2 seperate networks. network A cant see network B & vice versa. I have a basic vodafone HG658c efiber router which has no static route option. Any simple instructions on how to set this up please?
And is it possible with this hardware? Do we need a 2nd switch & another router?

vodafone router is
tp link switch is

i would like a separate network (192.168.2.x) which can still access the web
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

If vodafone HG658c is not VLAN capable - that cannot be done with that equipment.

You need second router or VLAN capable router (or more expensive solution L3 switch). Either of those can be solution.
crangle22Author Commented:
I have a 2005 model zyxel zywall firewall.
Would that work?
You can improvise, and can work since zyxel have DHCP and NAT...

But... since you can't create static routes interVLAN communication won't be possible.... At least not from VLAN 1 to VLAN 2.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

crangle22Author Commented:
Any advise on how best to configure the router and firewall?
Eg Does the router have to be in bridge mode?
Do you have any links that might help?
An idiots guide!
Router - standard config. (Let's say network since it is default), no need to reconfigure anything.
Firewall -WAN gets IP from router - network need to be different from VLAN1 -  (default is

So WAN address will be 192.168.0.x. To router any packet from network will look like everything comes from 192.168.0.x address.

Zyxel manual

You don't create VLANs anywhere except on switch. Vodafone router don't need any special config,
Cable for VLAN1 goes from Vodafone router to any access port of VLAN1 on switch.
Cable from Vodafone router goes to WAN port of Zyxel firewall.
Cable for VLAN2 goes from firewall LAN port to any access VLAN2 access port.
On firewall you need to configure DHCP and NAT.
NAT and WAN should be OK by default - manual page 83 -  Configuring WAN Setup.
DHCP and network - manual page 75 - Configuring LAN - also should be OK by default.
crangle22Author Commented:
not having much joy!
the switches default ip is
vodafone router is 1.1
zyxel firewall is 1.2
can i change the switch to so i can easily access it & set the gateway to 1.1?

i setup 2 static routes on the firewall - (called it vlan2) & 6.1 (vlan3)
on the switch i created vlan2 & set it to port 2 on the switch (thinking if i connected a pc to it, it would be in the range 5.1) didnt work!
i also thought that by calling them vlan2 on both the firewall & switch that they could communicate??
i know it must be easy if i just get the settings right!
i can send you all the screenshots later?
tearing my hair out!
With this equipment you can have just two working VLANs on switch. You can change switch IP address to 1.3 switch should be in the same network as router for maintenance.
Static routes on firewall will do you no good since all traffic goes to default route. Static routes should be set on Vodafone router. If Zyxel WAN port IP address is 1.2 it is OK, if LAN IP is 1.2 it is not good.

Point here is that you have two separate networks, each behind NAT, and each network need to be in different IP range. All traffic from VLAN behind firewall will be sent to Vodafone router from WAN's IP address and  Vodafone router have no idea that other network exists. So if you need to communicate - you need static route there to point to network behind firewall.
If WAN IP address is and network behind firewall is static route should be
ip route

Be free to attach screeshots - you know what thay say "one picture is worth a thousand words".
crangle22Author Commented:
Predrag! Here they are!!
I was using the zywall because there is no static route option on the vodafone router.

I cant seem to change the ip of the switch. it always defaults back to
I know this is all very messy!
Sorry for delay...

Since your Vodafone router is network, Zyxel needs to be some other network, otherwise firewall will not get IP on WAN from Vodafone router (you can set Zyxell LAN anything other than and turn on DHCP on firewall so network devices get IP address from the same range. Delete static routes on Firewall - you don't need those, all traffic for networks other than local network will be forwarded to Vodafone router.
Gateway address is always address in the same network range (Zyxell6) if network is default gateway must be from the same range 192.168.0.x (that should be address of Firewall itself in this scenario) - your gateway for network is - impossible scenario). You don't need to create any VLAN on Firewall.

I am not familiar with Zyxell firewalls, there is possibility that firewall can route between VLANs, and in that case configuration should be completely different (and much better). But that would be even harder to configure then this.
crangle22Author Commented:
thanks Predrag.
I will do my best to follow this!
It's all a bit complicated!
there must be an easier way to isolate the networks?
crangle22Author Commented:
any easy ways?
i just need to split the 2 networks (network a cant ping network b) but both need internet access.
Believe it or not.... this is simple and easy.

1. Create two VLANs on switch - with all ports as access ports
2. No need to reconfigure Vodafone router
3. Configure LAN on Zyxell with any other network than Vodafone router network (configure NAT and DHCP)
4. No need to configure any VLANs on Zyxell
5. No need to any static routes on Zyxell except default route
6. Connect Vodafone router and one of ports of switch VLANs
7. Connect Vodafone router with WAN port of Zyxell
8. Connect Zyxell LAN port with other VLAN created on switch

VLAN behind Zyxell will be able to access to other VLAN , but opposite direction is not possible without static route on Vodafone router.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
crangle22Author Commented:
i gave up in the end!
Predrag was very helpful thanks.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.