1

I am trying to configure two separte networks on one router, but I am struggling with the configuration of both routers

Picture of the setup I want: Picture of the setup I want

I do not want either network to connect to eachother. But I am unsure if I have

Router one - ASUS RT-AC66U

Default configurations

IP adresse: 192.168.1.1

Subnet mask: 255.255.255.0

DHCP: Enabled

I am unsure if I need to configure something, and if so, what to configure to make this into an "isolated" network. I think the subnetmask is okay, but I am unsure if the asigning of IP adresses up to 254 would crash with the configuration of router 2. Though this is the DHCP server for both (I believe. Confused about the DHCP settings described bellow).

Router two - LINKSYS WRT54G

Internet connection type: Static IP

Internet IP address: 192.168.1.254

Subnet mask: 255.255.255.0

gateway: 192.168.1.1 (router 1)

Network setup:

Router Local IP addresse: 192.168.2.1

Subnetmask: 255.255.255.128

DHCP: Enabled

starting IP addresse: 192.168.2.2

I am unsure if I need the network DHCP to be enabled on router 2, and I am confused with with the option to have "internet DHCP" as internet connection type, but also network setup.

Does this configuration work? Do I need additional configuration to make router 1 use the lower part of the IP range, and router 2 to use the upper part, or does this happen automatically? Also, would the 192.168.2.1 for router 2, and 192.168.2.X for other devices work?

Thanks

1
  • 1
    LAN-to-WAN will already assure the sub-network is completely isolated. Every sub-network needs a DHCP server.
    – harrymc
    Commented Jul 21, 2019 at 14:36

1 Answer 1

2

Router one [...] I am unsure if I need to configure something, and if so, what to configure to make this into an "isolated" network.

The firewall.

Your diagram connects router 2 through router 1's LAN, therefore it will be able to access anything that's on router 1's LAN.

From router1's perspective, router2 has the exact same access to router 1's LAN1.x as any other device; it does not get an isolated path to the Internet just because it's a router.

From router2's perspective, LAN1.x simply looks like a part of router2's "WAN". By default, router2 will deny "WAN→LAN" (i.e. LAN1.x→LAN2.x) connections, but it will allow LAN2.x→LAN1.x because it thinks that's just "LAN→WAN". (So harrymc's comment is 50% correct here.)

Changing netmasks will have no effect. The only ways to avoid this are:

  • For most situations: Add a firewall rule on router 2 to deny access from its LAN to router 1's LAN. For example:

    1.   from 192.168.2.0/24   to 192.168.1.0/24   deny
    2.   from any              to any              allow
    

    Most likely, router 2 already has firewall entries denying access in the opposite direction – it thinks that's part of the "WAN", and pretty much all home routers on the market deny WAN→LAN access by default.

  • For higher-end routers: Make router 1 have two LANs, one for regular devices, one for downlink to router 2 only. Then router 1's firewall will be able to block cross-LAN traffic between the two, while still allowing Internet access. This is slightly more complex, and only needed if router 2 itself is untrusted.

I think the subnetmask is okay, but I am unsure if the asigning of IP adresses up to 254 would crash with the configuration of router 2.

No. They both have different network prefixes (192.168.1.0/255.255.255.0 and 192.168.2.0/255.255.255.??). Why would they conflict?

Though this is the DHCP server for both (I believe. Confused about the DHCP settings described bellow).

No it's not. DHCP requests only go as far as the nearest router; they don't cross subnet boundaries. (One would have to explicitly set up DHCP 'relay' to make that happen.)

(I mean, if you're trying to isolate network A from network B, why would DHCP requests be bypassing that isolation?)

Router two [...] Subnetmask: 255.255.255.128

That works, but it seems unnecessarily small (only gives you addresses 0–127). It would be fine to use the usual 255.255.255.0 (/24) – it won't conflict with router 1.

I am unsure if I need the network DHCP to be enabled on router 2,

If you want router2 LAN devices to be able to use DHCP, then yes, router2 needs to provide DHCP. As mentioned above, DHCP requests do not cross network boundaries.

and I am confused with with the option to have "internet DHCP" as internet connection type, but also network setup.

The internet connection type defines the WAN interface's behavior: if you choose it, that interface will act as a DHCP client to obtain the router's own WAN-side address. In your case, that's optional, either static or DHCP will work.

This is completely separate from LAN interface setup, which usually configures a DHCP server that provides IP addresses to other devices connected to it.

Does this configuration work? Do I need additional configuration to make router 1 use the lower part of the IP range, and router 2 to use the upper part, or does this happen automatically?

"The" IP range? They're not sharing an IP range. You have two independent IP ranges, 192.168.1.0–192.168.1.255 for router 1, and 192.168.2.0–192.168.2.127 for router 2. That's already good enough and you don't need to do any "lower part/upper part" stuff.

Also, would the 192.168.2.1 for router 2, and 192.168.2.X for other devices work?

Yes, it would work.

(Note that the "X" is currently limited up to 126 because of your chosen netmask 255.255.255.128 – but you can safely change it back to 255.255.255.0 to solve that.)

1
  • I don't know why no one has given you upvotes. Your explanation has been very clear for clearing up the OP's confusion!
    – bobjoe
    Commented Feb 23, 2021 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .