DMZ recommendations for Guest house

[Brother D]

Hi,

I'm not that familiar with the retail/consumer router market, and basically I don't want anyone in the Guest House to access anything on the Main House network.

I can't put the Guest House router on a DMZ from the main house router because it doesn't support vlans so can't trunk thru a DMZ to GH WAN port.

Any suggestions how to prevent clients in the Guest house accessing devices in the main house (can't put main house devices on their own DMZ because PC in the office hanging off the switch needs to contact PCs in the main house)?

OR any suggestions on a router that can be configured with outbound rules to explicitly prevent access to the main house subnet (and rule to allow access to the main house default gateway)?

TIA

Edited by Brother D on Monday 30th November 18:53

[jeremyc]

Many routers allow the establishment of a 'guest' wifi network.

Would this not work for you if devices in the guest house only have access to the guest network?

[Mr Pointy]

The standard answer of Draytek will allow you to create a guest network & wireless connection.

[CharlesElliott]

Or Unifi will let you do this, no problem.

[Brother D]

jeremyc said:

Many routers allow the establishment of a 'guest' wifi network.

Would this not work for you if devices in the guest house only have access to the guest network?

Guests will have access to the LAN ports.

[CharlesElliott]

On Unifi - with a Unifi switch - you could either block those ports, or force assign those ports to the guest network so they would have access, but only to the guest network (or any other network you choose to create).

[Brother D]

CharlesElliott said:

On Unifi - with a Unifi switch - you could either block those ports, or force assign those ports to the guest network so they would have access, but only to the guest network (or any other network you choose to create).

Wouldn't that require a USG and switches?

[Slackline]

Brother D said:

jeremyc said:

Many routers allow the establishment of a 'guest' wifi network.

Would this not work for you if devices in the guest house only have access to the guest network?

Guests will have access to the LAN ports.

Put the access point where they can't get to it. Ceiling mounted with the cable going up should be fine, or put it in the loft.

There's always the chance that someone will book a room and bring a set of steps so that they can climb up, remove the AP, fish out the cable, use an extender, plug in the long patch cable they brought with them and link up to your network, but I would say it's a fairly slim chance.

[Brother D]

Slackline said:

Put the access point where they can't get to it. Ceiling mounted with the cable going up should be fine, or put it in the loft.

There's always the chance that someone will book a room and bring a set of steps so that they can climb up, remove the AP, fish out the cable, use an extender, plug in the long patch cable they brought with them and link up to your network, but I would say it's a fairly slim chance.

It's a router. Not an access point because of the need for ethernet ports

[Mr Pointy]

I guess you know about VLANs anyway but a Draytek router will allow you to configure port & tage based VLANs:

https://www.draytek.co.uk/information/our-technolo...

[buggalugs]

Wouldn't cost too much to replace the 16 port switch with one that supports vlans,

assume the router will also support vlans, on Drayteks you can assign a different vlan to different lan ports, and enable or disable routing between them, for doing exactly what you're trying to. Or you can get cheap MikroTIK units that will do anything you can think of but they're harder to configure.

[CharlesElliott]

Yes, it would require a USG and a Unifi switch. But switches start at £40 and a USG is around £110. It's a worthwhile investment!

[camel_landy]

Have a look at the MikroTik range... Loads of features at a minimal cost.

M

[320d is all you need]

DmZ is not really the correct terminology here.


You can use a Guest Network option. Nearly all home routers have this.

Or use a VLAN switch to replace the existing switch (cheap). Old used Cisco or HP stuff on Ebay is easy to find.

[petrolbloke]

320d is all you need said:

You can use a Guest Network option. Nearly all home routers have this.

Normally just a separate WiFi SSID though, won't affect the physical ports.

Also, these 'security' features of home routers are not always all they're cracked up to be. My work laptop connected to my router's guest network can still access my NAS (which is connected to the router via Ethernet).

[shtu]

Personally, I would simply not offer LAN port access, wifi only.

It's more than fast enough these days and solves the problem at a stroke.

[320d is all you need]

shtu said:

Personally, I would simply not offer LAN port access, wifi only.

It's more than fast enough these days and solves the problem at a stroke.

.

That's also true

I can't remember the last time I used a LAN cable.. Maybe 5 years ago??

[ninepoint2]

shtu said:

Personally, I would simply not offer LAN port access, wifi only.

It's more than fast enough these days and solves the problem at a stroke.

This ^^^

[Mattt]

CharlesElliott said:

Yes, it would require a USG and a Unifi switch. But switches start at £40 and a USG is around £110. It's a worthwhile investment!

USG is pretty much end of line, wouldn’t be buying new but 2nd hand ok.