CAUTION: Orbi's Wifi Guest Network does not really isolate guests from main network

[Mr-Wednesday]

No, the issue still exists when in Router mode too.

[MarinJim]

That's a shame.  After all this time, I'd assumed that Netgear would have been able to fix this and totally isolate the Guest network, as they've done on the last several Netgear routers I've used.

It's a deal breaker for me. A secure, isolated Guest network is critical.  I was just doing my final research before running out to Costco to buy the RBK50 with two satellites to set up this weekend. Now I'll have to reassess.

[Mr-Wednesday]

To be fair, the devices in my guest network sit in the same IP range as my regular network.  However, I would still expect them not to be able to see the devices in my regular network.

Or maybe I'm doing it wrong?

[appierro]

Will a Netgear engineer pick this issue up?  This is an issue that is across many threads and affects many users and seems to not have been resolved for some time.  Guest Network is essentially rendered useless.

[DarrenM]

Our support team would like to troubleshoot this issue with you if you would like to work with them please send me a PM with your name, email, and phone number.

DarrenM

[schumaku]

---

wrote:

Our support team would like to troubleshoot this issue with you...

---

This is a design failure. Nothing the customer support can fix.

Business and advanced home users expect correct isolation of the work and the guest network. VLANs are not introduced since yesterday, and are not rocket science. And again for the records, this is nothing new with Orbi for Business, with Orbi, ... the issue exists as long Netgear does offer this highly questionable "design" on earlier routers, Nighthawks inclusive.

Very sad.

[MarinJim]

@DarrenM -- thanks for the post and for the interest in resolving this. If you read back through the posts, you will see what the issue is, so I am not sure I could add to it by directly communicating with you via PM or phone.  If I am mistaken, however, and if you would like to contact me by PM, please PM me and I will respond with my phone number and email address to discuss the problem with you. I'd like to see this issue resolved in a firmware update.  As it is now, I (and others) see this as a critical flaw that must be corrected.

[JoeM845]

Any help is welcome. I opened a support case on this in March, shortly after I bought the unit. I have been informed from time to time that engineering is working on it. I did not return the RBK50 on that assurance.

[BIG9MM]

1. Unfortunately, I'm experiencing the same thing with the guest network seeing everything on my local network. I understand if you uncheck the option about the guest network not accessing each other they are supposed to not have access, but still is there a way if you're logged in to the guest network be able to ping devices on the local network? If so that's a security vulnerability.

2. My girl brings her law office laptop home and it is connected to the local network, I don't want the guest network to be able to have any access to her work computer or really even to see it...  I can put in front of the ORBI my other router Asus rt-ac88u which I just need a little help understanding how to set it up that way and I greatly appreciate if you guys can explain if there's a workaround if I implement my Asus rt-ac88u in front of the ORBI.

[DarrenM]

I have raised this concern to engineering about the guest network. @BIG9MM if you want to use another router in front of the orbi system you would just need to set orbi in ap mode.

https://kb.netgear.com/31218/How-do-I-configure-my-Orbi-router-to-act-as-an-access-point

DarrenM

[schumaku]

Can Orbi and Orbit Pro in AP mode support a proper VLAN set-up with multiple SSIDs mapped accordingly, with both the wired and the wireless backhaul?

Considering Insight 4 is supposed to support these devices soon: How will Orbi and Orbi Pro APs be integrated with a capable Insight/Smart Managed Pro VLAN switches and the low cost WAC505/510 access point VLAN infrastructure offering correct network isolation then please?

What routers does Netgear suggest for such environments - considering all Orbi, Orbi Pro and Nighthawk are suffering from these problems - and still (after years and years of customer requests!!!) not support industry standard tagged VLAN?

Insight does make it possible to set-up, manage and expand such an environment with ease. Netgear has everything required to fulfill this very basic requirement - except of routers.

Deploying a different router without VLAN-SSID mapping on Orbi does not solve the issue. The KB entry is ok for flat networks only and does in my opinion not apply to an environment requiring proper isolation.

Netgear has all design and engineering capabilities for switching and wireless access in home, SOHO, and SMB - including a nice Insight management system. Just the Nighthawk and Orbi/Orbi Pro are still stuck on the first home router design limitations from 25+ years when Netgear introduced the first ZyNOS based router to the market. Worth noting: That router had capable IPsec VPN capabilities for a VPN server and a VPN client. And it had the ability to add WAN-LAN firewall filtering rules. Capabilities silently lost since. And the community is full with requests for these features. It's just that the people in charge apparently don't care about real world requirements.

Just like the broken (and impossible to achieve) pure Layer 2 guest network isolation. Should Netgear be interested in a product line manager - I'm available.

[rhester72]

As much as I too would like to see features like this, they are definitely focused more on the 'prosumer', whereas Netgear's products are clearly and squarely aimed at the "set it and forget it" consumer market.  I'd very seriously doubt you will ever see things like VLAN splitting (outside of that required for WAN support in select European markets) included in the product.  Just my $0.02.

[schumaku]

---

wrote:

As much as I too would like to see features like this, they are definitely focused more on the 'prosumer', whereas Netgear's products are clearly and squarely aimed at the "set it and forget it" consumer market..

---

Fact is that Netgear customers are complaining about this incomplete and unfinished guest network and isolation. Not only in this thread. Subject are Nighthawk routers, Orbi and Orbi Pro systems. The majority of users would never see there is a VLAN implementation in place. Different, users who want to seamlessly extend thier single point router by adding wireless Negear APs, by adding Netgear Smart Managed switches, could directly take an advantage out of it. Some assistance built into the router firmware, and adding additional switches and WiFi APs would be a snap, by adding a seamless extension option. Click and run. And people would automatically have the same SSIDs on the router and the APs, the same guest network on the router and the APs. It could not be easier.

And while Talking Orbi - the Orbi Pro is undoubted made for small business environments. Business is mentioned at least half a dozen times on the marketing page. And with the "business" competition in the market offering capable routers (no WiFi built in of course) for much less than 100 US$, offering a unified management environment - instead of a many year old "Genie" full of inconsistencies and design limitations. 

And everything would be plug and run.

Netgear could do much better and become the preferred vendor for SOHO, small businesses, easily. They have everything required: Except of routers.

[appierro]

Darren,  thank you for being a champion for us in regards to feedback to Netgear engineers, however I found a thread with the same issue / complaint and you raised it to engineers back in December of 2016.  Have there been any updates or communication with you since that time regarding this issue?  At this point, we all know that Netgear either doesn't have a fix, plan on fixing, or doesn't take this community seriously.

Thanks again

[Mr-Wednesday]

I think at this point all we are getting is lip service with no action if this was raised a year and a half ago and still nothing has been done about it.

[radamo]

I too need to see this feature "finished" and really working.  No reason to even have a GUEST mode if it does not isolate that device from accessing the rest of the network resources.  

NETGEAR this needs to be addressed.  It is not a PRO feature.  It is needed by everyone!!!

[Vandergraff]

I recently enable a gGest Network which I assumed would isolate Guests from my Network (box unchecked for "Allow guests to see each other and my local network")

Just to check I connected to my Guest Network and ran Net Analyser on my iPhone - and was very surprised to that I could see all the devices on my main network......

I then saw this thread - so I see it is a known issue. 

Any updates when it may get fixed?

I think I will do as others and run a guest network on 2.4 GHz on an Asus RT-AC68 running Merlin software and use the Orbi as an access point with no guest network.

[Miles267]

When will this issue be fixed? Unacceptable for any router or access point.

[Omniver]

Wow, was literally about to go and buy this system. Glad I read this, I’ll be looking elsewhere - guest and IOT devices should have *no* capacity to communicate with my trusted systems

[Aspenthedon]

I think when it's in router mode it does NOT properly segment network I will be checking because I am in process of setting up iot devices and this would really skew me

[FURRYe38]

The first wave to be released are only for the RBR50 and RBS50, which is used in the RBK50 and RBK53 (Costco) kits.

New beta FW avaialble. Get it while its hot of the press:

https://community.netgear.com/t5/Orbi/Orbi-MR-2-1-Update-3-23-18/m-p/1533584#M26234

Might fix this issue...

[Vandergraff]

What do you mean 'Might fix this issue...'

Nothing in release notes suggests it would?

[Aspenthedon]

Right I feel like that statement can be deceiving either it addresses the issue that's been questioned for a very long time or it don't.? Is it fixed in the FW or not? I don't get why this issue keep getting avoided. Make no sense and in my eyes is kinda unprofessional for the issue to not be taken care if yet with no updates as to what type of progress is being made to fix this concerning issue. There is literally a option to not show guest network the devices and it completely counterdicts that option. Would love a valid responce or explanation or even some status update. Thanks

[EcoFuelEngineer]

We have purchased several of the "Pro" routers and satellites. We have been struggling with this issue for several days - until we came across this thread. Clearly the Orbi does NOT support the functionality claimed and more worryingly seems to have zero commitment to addressing it or getting it fixed. This is not acceptable as a "business" product - we will be moving away from Netgear completely based on this issue - I tried to contact Netgear for support (even before I saw this thread) which went so far and then my call was disconnected by the support representitive. We have had similar issues with other purportedly enterprise solutions which arent enterprise - ReadyData 5200 - Layer 3 switches M6000 chassis and this is the final straw.

[schumaku]

---

@EcoFuelEngineerwrote:

We have purchased several of the "Pro" routers and satellites. We have been struggling with this issue for several days - until we came across this thread. Clearly the Orbi does NOT support the functionality claimed and more worryingly seems to have zero commitment to addressing it or getting it fixed. This is not acceptable as a "business" product - we will be moving away from Netgear completely based on this issue - I tried to contact Netgear for support (even before I saw this thread) which went so far and then my call was disconnected by the support representative. We have had similar issues with other purportedly enterprise solutions which aren't enterprise - ReadyData 5200 - Layer 3 switches M6000 chassis and this is the final straw.

---

You might bring to to the Business GM attention by adding a post on the Connect With The SMB GM forum. I would hope @johngm can join this discussion. Certainly not what he does expect to read from the loyal Netgear customer base.