Having separated network without router mode

[snueffel]

Dear Community,

since I have already received some very helpful tips via this forum, I hope that you can also help me with a solution.

I am currently running my new Orbi set (RBK753) behind a router (Fritz!Box).Since the Orbi router in AccessPoint mode seems to allow communication between devices in the guest network (cf. this post), router mode is currently still active. This results in two IP address ranges and does the job.

Current
However, since I will be getting another Internet connection soon, I would like to connect more devices to the router in the basement. In order to allow devices connected to the router to access the Orbi address range, I will probably have to put the Orbi into AP mode.

Desired

Is it possible to prevent communication between the participants in the guest network anyway, e.g. via another NAT router with higher capabilities instead of the Fritz!Box?I am thinking of a solution where unknown devices are generally assigned to an address range of a more restrictive network.

If not, what could be an alternative setup?

Thanks a lot!

[CrimpOn]

I believe you are correct that Guest network is not supported when the Orbi is in Access Point (AP) mode:

https://kb.netgear.com/000061277/Which-features-are-disabled-on-my-Orbi-router-when-it-is-set-to-AP-... 

Is the Fritzbox present because it is a combination modem/router device?

Does ths "new internet connection" replace the existing internet connection, or does it result in two simultaneous internet connections?

My intuition is that the desired network diagram is incorrect.  With the Orbi in AP mode, all devices connected to the network will receive IP assignments from the Fritzbox, including those connected directly to the Fritzbox, all of the Orbi components, and everything connected to the Orbi (ethernet and WiFi).  Everything will be in 192.168.178.x  There will be no 192.168.179.x network at all.

I suspect the only way to separate Guest WiFi from the rest of the network is to have the Orbi as the primary router.

[snueffel]

Hey @CrimpOn ,

thanks so far!

Is the Fritzbox present because it is a combination modem/router device?

• Yes indeed, currently it is used as modem, only.

Does ths "new internet connection" replace the existing internet connection, or does it result in two simultaneous internet connections?

• It will replace the existing internet connection. However, I would like to have a router at this special point since I can distribute the network from here. 

My intuition is that the desired network diagram is incorrect.  With the Orbi in AP mode, all devices connected to the network will receive IP assignments from the Fritzbox, including those connected directly to the Fritzbox, all of the Orbi components, and everything connected to the Orbi (ethernet and WiFi).  Everything will be in 192.168.178.x  There will be no 192.168.179.x network at all.

• Yes right, I forgot to adapt the IP of the Orbi. It would be in the 192.168.178.x area.

I suspect the only way to separate Guest WiFi from the rest of the network is to have the Orbi as the primary router.

• I thought about this, too, but, the point where the Fritz!Box is installed now is a very bad place for WiFi. So installing the Orbi router here would make the WiFi of it completely useless...

[snueffel]

BTW, the site you linked says:

The following features are not available (grayed out) when your Orbi router is in AP mode:

• Guest Network

But the Guest network is available. The communication between the WiFi devices is simply not blocked.

[CrimpOn]

---

@snueffel wrote:

I suspect the only way to separate Guest WiFi from the rest of the network is to have the Orbi as the primary router.

• I thought about this, too, but, the point where the Fritz!Box is installed now is a very bad place for WiFi. So installing the Orbi router here would make the WiFi of it completely useless...

---

I agree. Basements are not usually a good place for WiFi access points.

Is it correct to assume that there is an ethernet cable from the Fritzbox location in the basement to the Orbi location on the floor above?

If the new ISP is bringing in new media (for example, fiber instead of coax) they could install to the Orbi location and that ethernet cable could be used to connect a dumb switch in the basement.

If the new ISP wants to install to the same basement location, the ethernet cable could be used to extend from the new modem ethernet jack to the Orbi.  If there is only a single cable between those locations, there are two ways to manage this: (1) install a second ethernet cable, or (2) deploy two switches with VLAN capability to make "double use" of the single cable, as this user did:

https://community.netgear.com/t5/user/viewprofilepage/user-id/504451 

[snueffel]

Is it correct to assume that there is an ethernet cable from the Fritzbox location in the basement to the Orbi location on the floor above?

---

Yes, that is correct.

If the new ISP is bringing in new media (for example, fiber instead of coax) they could install to the Orbi location and that ethernet cable could be used to connect a dumb switch in the basement.

If the new ISP wants to install to the same basement location, the ethernet cable could be used to extend from the new modem ethernet jack to the Orbi.  If there is only a single cable between those locations, there are two ways to manage this: (1) install a second ethernet cable, or (2) deploy two switches with VLAN capability to make "double use" of the single cable, as this user did:

https://community.netgear.com/t5/user/viewprofilepage/user-id/504451 

---

Also an idea I thought of, at least using two cables. Since I have no way to install a second cable, the solution using 2 VLAN switches is worth considering. But wouldn't that cut the bandwidth in half? And is it sufficiently secure to have a switch attached to the Internet that connects directly to the Internet and the internal LAN, even if the networks are separated via VLANs?

[CrimpOn]

---

@snueffel wrote:

Also an idea I thought of, at least using two cables. Since I have no way to install a second cable, the solution using 2 VLAN switches is worth considering. But wouldn't that cut the bandwidth in half? And is it sufficiently secure to have a switch attached to the Internet that connects directly to the Internet and the internal LAN, even if the networks are separated via VLANs?

---

If you use Gigabit switches, the connection between switches would be 1000M/Full Duplex, the same as between the ISP modem and the Orbi when using only an ethernet cable.  The bandwidth reduction would come from traffic that goes from the Orbi to devices in the basement. For example, if a device in the basement was constantly streaming 100mb/sec, then the bandwidth left for internet access would be 900.