AllMostTreadingWater's profile

New Poster

 • 

3 Messages

Wed, Jun 22, 2022 1:00 AM

Network Isolation - VLAN, Guest Network, Dual Routers

Presently utilizing a rented Arris TG1682G Router/Modem with Voice.  I need to be able to add Network Isolation (Segmentation) in my home network so that my WiFi enabled devices are separated from my main home network devices.  The best solution would be to setup a Virtual Local Area Network (VLAN) but that is not an option with my present Arris model.  Another approach that some Router/Modem combos offer is an option to turn on a Guest Network.  However, that isn’t an option on the rented unit either.  I understand another approach would be to use two routers, where you connect the WAN/Internet port of the inner router to a LAN port of the outer router.  Unfortunately, again the Arris modem doesn’t have WAN/Internet port.  What options do I have?

  • Is there Comcast Business Router/Modem combo that offers the ability to setup VLANs that could be utilized on a Consumer Account?
  • Is there another Router/Modem combo that offers a Guest Network instead of the Wifi Hotspot?
  • If I purchased the Xfinity recommended SVG2482AC modem would that offer a Guest Network instead of the Wifi Hotspot?
  • If I went the two router approach is there a router/modem combo that has the WAN/Internet port that you would recommend.
  • Any other suggestions would be most helpful

Contributor

 • 

40 Messages

4 d ago

I just did something like this over the last couple months.  Your typical home router won't do VLANs, but it's a normal feature on business class equipment -- including the small business/prosumer stuff.  There are a lot of small business/prosumer options that aren't too expensive at all, especially if you don't mind limiting speed to 1Gbps.

The guest network approach has one messy problem.  If it's done right it's Internet only and blocks all the devices on the guest network from talking to each other.  Now you can't use the setup app on a phone to configure your new gizmo.  Most consumer WiFi routers and combo cable modem WiFi routers support a guest network.

Using 2 consumer routers results in a double NAT situation which can be kind of annoying but generally does work.  It'll probably also break IPv6 behind the second one.  With this sort of setup one of your segments is going to be able to connect to anything on the other one.  If you're trying to protect your main network devices from the WiFi stuff they'll have to be behind the second router, so double NAT and IPv6 doesn't work.  IPv6 breaks because NAT isn't normally used with IPv6 and consumer routers normally don't know how to hint for more than a /64 prefix in a DHCPv6 request or assign prefixes to downstream routers.

If you think you have the technical chops for it I'd look into a cable modem + wired router + WiFi access point(s) and maybe some managed switches.  Depending on exactly what you want you can often just segment the network by assigning different LAN ports on the router to different subnets and using the firewall to control what passes between them, so you might not need to use VLANs at all.  If you do set up VLANs commercial access points will typically let you extend them onto the wireless network.  They usually allow multiple SSIDs and can map them to different VLANs.  I have 4 SSIDs running.  Computers & printers, phones & other gizmos, guest, and one just for my very naughty weather station that lets anyone on its subnet update its firmware with a phone app without a password.

As far as what to use goes... I'm not sure what to recommend.  You'll likely get better advice asking on a more tech-oriented forum.

I'm running a mix of MikroTik, TP-Link and Netgear equipment.  I have 1200/35 service feeding into a Netgear CM2050V modem.  The modem connects to a MikroTik RB5009UG+S+IN router over 2.5Gb ethernet.  The RB5009 connects to a MikroTik CRS326-24S+2Q+RM 10Gb switch over both 10Gb and 1Gb fiber, and everything else plugs into the CRS326 somehow.  I have a couple of 1Gb dumb switches, a 1Gb Netgear PoE switch feeding my TP-Link EAP610 access points, a few 10Gb hosts, laptop with a 2.5Gb USB ethernet adapter, etc.  The reason for the double connection between the switch and router is a pesky bug in the RB5009 router.  It totally clobbers internet speed down to about 250Mb for <=1Gb devices connected over the 10Gb SFP+ port if you have >1Gb Internet, so I had to use 2 cables and do some silly things with VLANs to let the 2.5Gb and faster devices get full speed.  The 1Gb stuff is still limited to ~850Mb.

If I were building a 1Gb network I'd likely just use all TP-Link Omada SDN stuff except for the modem and unmanaged switches.  $60 for a wired gigabit router, $100 for a controller, a couple access points (EAP610s for $100 each), and (optionally) some sort of PoE switch to power the APs over the ethernet cables.  The controller is optional but nice to have if you use more than one access point since you need it for fast roaming.  There's also a free software controller (but that means leaving a computer on all the time) and a cloud controller.  I only have the APs, but this stuff is easier to manage than RouterOS with everything being controlled by a slick web GUI.  I'm using the software controller since I have a Linux server I leave on all the time.

Netgear has a good reputation but they're not in the business/prosumer wired router space AFAIK.  The Netgear Orbi Pro mesh system supports VLANs over wired connections and multiple SSIDs over WiFi.  It's basically a prosumer setup.  It might be your best bet if you just want to segment your network without adding too much setup complexity.  The catch is it uses some sort of cloud thing for setup and management.  That also makes me want to run away.

Ubiquiti gear is pretty popular in the prosumer space.  It'll also do VLANs, etc.  I haven't used any of their stuff, but it's slick, not too expensive, and unfortunately tangled up with the cloud which again makes me want to run away.

The MikroTik stuff is feature rich for it's price, but it's also complicated, quirky and sometimes buggy.  I'm a software engineer who writes network applications for a living, and this stuff kept me up late a few times getting it set up.  I really wouldn't recommend it unless you understand routing, firewall rules, DHCP, IPv6 (manual setup on this one), etc. and how to use WireShark.  The up side is you get a near enterprise level of control even on cheap devices.  Like they'll sell you a WiFi router with VLAN support, 2.4Ghz WiFi 4/802.11b/g/n, four 10/100 ethernet ports and all the complexity of MikroTik RouterOS for $25.  I bought the RB5009 since at $220 it was easily the cheapest router I could find that had a 2.5Gb RJ45 and a 10Gb SFP+ port.  If you're brave enough to go this route or just happen to be a network engineer one quirk you should know about is that there's a firewall accept rule on the IPv6 input chain that only accepts DHCPv6 replies from a link local address.  Comcast sends them from a routable address in some service areas, so you may need to fix that rule and probably ought to fix it even if you don't need to since I've seen reports of Comcast switching from link local to routable.

That's just the stuff I've played with, plus Ubiquiti since so many people seem to like it.  There's lots of other stuff out there and I ignored a lot of good equipment when I was looking because it didn't have the right port setup or it cost a lot more than the MikroTik I bought.

flatlander3

Contributor

 • 

323 Messages

3 d ago

Another possible way, If you've got a box with at least 3 network interfaces, you can do that by turning a dedicated box into a firewall.  The Telephony makes it a bit more goofy, so I don't think you can just set it to bridge mode and have voice still work.  If there's a DMZ option in the firmware, you could try setting that.  Xfinity stuff has really bad documentation so I don't know if that's an option on your device.

Internet <--> Voice TG1682G direct

                 |

                 <--> Data DMZ <---> Firewall Wan Interface <--> Subnet/VLAN 1

                                                                                                     <--> Subnet/VLAN 2 (multiple configuration possible)

                                                                                                     <--> .....Additional Interfaces for more Subnets.....

Firewall can be anything.  Ubuntu box.  pFsense/opnsense makes it easy.  Firewall Appliance you buy.  Your internal subnets can be isolated, or you can create rules for routing traffic between them, but that kind of defeats the purpose.  Then you just need a cheap unmanaged switch for each of your Subnet/VLANs and you put whatever you want on them.  WiFi Access points or not.  Your call.  They're isolated.

Is it a 'double nat'?  Yeah, pretty much.  Traffic that doesn't match VoIP hits firewall interface.  Should work fine.

Contributor

 • 

40 Messages

3 d ago

I have voice service and I doubt it'll be any trouble.  I haven't tried it on a rented modem but I used an Arris SVG2482AC cable WiFi router in bridge mode for a while and voice worked fine.  I've since switched to a voice-enabled cable modem.  I don't know exactly how they do it, but I'm betting the VoIP part has a separate IP address.  For those of you who haven't used Comcast residential voice service or checked the specs, it's only VoIP to the modem or cable router.  The phone jacks on the router or modem are plan old RJ11 analog jacks.

DIY is always an option for a router, though I have a hard time suggesting using a dedicated PC for one unless you have a fast connection.  If you've got an always on Linux server machine you could pile another task on that's a different story.  But I have no idea what AllMostTreadingWater has so ????

flatlander3

Contributor

 • 

323 Messages

@zandor60657​ pFsense/opnsense is BSD distribution with a kernel optimized to be a firewall/router.  Graphical/Web internal interface, sort of kiosk mode but with ssh if you want change anything manually.  Doesn't take much horsepower to run it.   Very small 40G SSD (mlc/slc, not flash) for a hard drive works, doesn't need much space.

The connection is Ethernet port from the modem/gateway, so your speed is just what you have for a speed tier.  Latency add is <1ms.  You could do it with two network interfaces, then assign up to 8 vlans to the internal interface and there is 'priority tagging', but it's cleaner with firewall rules if you just use multiple interfaces and independent subnets. 

As for bridge mode with telephony, I've never used one.  You can always set bridge mode, then instead of using a DMZ, firewall WAN gets the external IP address and it's not a 'double nat'.  See if the phone still works. I don't know how the connection works for it on Xfinity gateways.

(edited)

New Poster

 • 

3 Messages

3 d ago

Thank you zandor60657 and flatlander3 for your prompt responses!  I have a couple pressing items to finish up during the week and will be back with some responses/questions shortly.

Contributor

 • 

40 Messages

3 d ago

Fair enough.  I'll be around, though not necessarily right when you're ready to talk.  Standard forum rules... we'll be here when we feel like it.  I hope you can get your problem sorted out with or without me and flatlander3.

forum icon

New to the Community?

Start Here