An IOT Network on an Asus RT-AX88U Pro Router

There is a theory that moving all Smart Devices in the house onto a Separate LAN to those used by the devices that are used for internet Banking may be good practice.

ie. An Internet of Things Network (an IOT Network) for all Smart Devices, Smart TVs, Hive System, etc. in the home.


In theory, my router, an Asus RT-AX88U Pro which has a IOT menu option can be used to easily set up what it calls a IOT Network so I used that menu feature.

It seemed setup OK on WIFI so I added it as a VLAN to on one of the Ethernet Ports so that all of the Ethernet Smart Devices in the house could be on this separate IOT Network.

The Asus Routers Home LAN IP Address was 192.168.50.*, the WIFI Guest Network IP was on IP 192.168.52* and the IOT Network was on 192.168.53.*

However, I then could not login to my router as doing this seemed to make the RT-AX88U Pro Router GUI inaccessible and in order to regain access to my own router I needed to carry out a Router Factory Reset to recover it.

Upon google this could be a known issue with high end Asus Routers when the IOT Network feature is created.

I fairly sure that could use two routers or managed ethernet switches to create a separate IOT Network LAN and it may be a way forward if I don't give up on the separate IOT LAN Network idea altogether but that would not be my preferred solution as the two routers that I presently have are the BT SH2 and the Asus RT-AX88U Pro and with BT FTTP the SH2 will need to be connect to the ONT to be in control with most of the features of the the RT- AX88U Pro being mute.

Can the Asus RT-AX 88U Pro be set up to use an Ethernet IOT LAN that is separate/isolated from the Home LAN but where the devices on the separate IOT Network LAN are able to safely communicate with the other devices on the separate IOT Network LAN?

Depends what your devices use to communicate. My smart devices are on the Apple Home system and use Thread and bluetooth, and if I try and put things on a separate network/VLAN then they fail to work. Not all the security advice is accurate for all technologies.

(Steve Gibson from Security Now is pretty good, but he obviously has no enterprise experience, and he doesn’t use any Apple or Google Home devices, or even Amazon Alexa’s ecosystem).

i wouldn't call Amazon's alexa systems as an iot unit, but integration device that needs an active network to work in and see other devices such as your phone or other devices. To me Iot devices are simple switches or cameras etc.

In reply to a post by Taras:

i wouldn't call Amazon's alexa systems as an iot unit, but integration device that needs an active network to work in and see other devices such as your phone or other devices. To me Iot devices are simple switches or cameras etc.

My OP on this thread is about separate IOT LAN Networks on an Asus RT-AX88U Router and how to get them to work properly.

Regarding alexa: personally I would never use Amazon alexa and I hate the fact that most TVs and some other devices have microphones in them and maybe they also have cameras, (who knows if there are cameras but why have microphones that you can opt out of using to instruct the TV but that you cannot unplug or turn off).

There is a lot to think about as having one Home LAN for WiFI and Ethernet and a separate WIFI Guest Network for the most part has been OK and it works seamlessly so a one router solution to separate IOT LAN Networks would be easier if it worked properly but I can see the benefits of a three router solution as was put forward by Steve Gibson in the link in my post below from the security forum.

In reply to a post by Fido:

While all we wait patiently for helpful solutions from the security experts from amongst us who know what not to do; it may be useful to consider if there is a potential issue with having Smart Devices on the Home LAN Network or not.

I have just discovered this webcast from Steve Gibson who I have always considered understands internet security much better than I do and it may be worth checking this video out:

Here is the link;

https://www.google.com/search?q=steve+gibson+IoT+net...


It seems that Steve Gibson had come to the same conclusion as I have in that it may be useful if we had at least one separate Home LAN Network for Smart Devices.

To me separate WIFI Networks are much easier to achieve than separate Ethernet Networks but most of my Smart Devices use Ethernet.

Separate ethernet networks can be achieved by using an additional third party router (a type of slave router for the IoT LAN Network), but I am still presently exploring if it can be achieved by my just using my Asus RT-AX88U Pro Router but I suspect I will end up with another device.

Yet more googling has revealed Steve Gibson's Three Router Solution to IoT Security;

https://pcper.com/2016/08/steve-gibsons-three-router...

There is a lot to think about as having one Home LAN for WiFI and Ethernet and a separate WIFI Guest Network for the most part has been OK and it works seamlessly so a one router solution would be easier if it worked properly but I can see the benefits of a three router solution.

Everyone; please feel free to let us know, (on this thread), how to create a separate ethernet LAN on an Asus RT-AX88U Pro Router and, (on the security thread), the reason why a separate IOT LAN Network is not needed.

Thanks.

you don't need a "three router sololution".

The main asus dhcp pool sits on 192.168.1.*

The main wifi dhcp ppol also sits on that range

ethernet vlan is on (merlin based)

http://192.168.1.1:80/Advanced_VLAN_Switch_Content.asp
or
https://192.168.1.1:8443/Advanced_VLAN_Switch_Content.asp

Guest networks sit on vlan 52 onwards

Both the dhcp pool and vlan id can be changed in the advanced settings on the guest network pro area.

The only thing you many need is a vlan aware switch.

My AX88U is not the Pro version and even with Merlin's firmware has no VLAN support as its the older hardware platform. I have unmanaged separate switch (2.5GbE). I guess if I ever upgrade to WiFi 7 then I'll investigate.

In reply to a post by Taras:

you don't need a "three router sololution".

The main asus dhcp pool sits on 192.168.1.*

The main wifi dhcp ppol also sits on that range

ethernet vlan is on (merlin based)

http://192.168.1.1:80/Advanced_VLAN_Switch_Content.asp
or
https://192.168.1.1:8443/Advanced_VLAN_Switch_Content.asp

Guest networks sit on vlan 52 onwards

Both the dhcp pool and vlan id can be changed in the advanced settings on the guest network pro area.

The only thing you many need is a vlan aware switch.

Hello Taras,

Thank you for this information.

I have always felt more comfortable with hardware solutions than software but since a VLAN system is the modern way of doing things and it is supposed to be available within my router menu I tried to set it up but it locked me out of the GUI for the router and I had to Factory Reset the router in order to regain access to it.

Regarding the IP address for my Asus Router: at one time the Asus Routers Home LAN Login IP was 192.168.1.1 but after a firmware upgrade, (a few years ago, that changed to 192.168.50.1 for my Asus RT-AX88U Pro Router.

When I set up the VLAN, via the Asus Menu Options: The Asus Routers Home LAN IP Address was 192.168.50.1, the WIFI Guest Network devices were on IP 192.168.52* (called 52 in the VLAN) and the new IOT Network was on 192.168.53.* (called 53 in the VLAN).

I added the the WIFI Guest Network as a VLAN on Ethernet Port 4

I added the New IOT Network to Ethernet Port 5.

As I understand it setting which Ethernet Port operates with which network does away with the need for an additional managed switch. - Is that correct ?

After it was set up, (as above), the router reset and then the internet was off and the router was inaccessible.

ie. I could no longer login to my own router as it did not recognize 192.168.50.1 as being a login IP and the internet was off.

Upon googling others seem to have experienced similar issues so it could be an issue with the Asus firmware or perhaps my method was wrong. - I do not know as using a VLAN is new to me.

I have considered trying Merlin Firmware, (which has an excellent reputation), but I am reluctant to use a third party firmware on such an important device but I have read that it is better for VLANs. - I do not know if that is true.

My plan original plan was/is;

(1). To leave the Home LAN as it is.

(2). To use the WIFI associated the Home LAN as my main WIFI.

(3). To leave the Home LAN Ethernet Ports unused or rarely used.

(4). To keep the same Guest WIFI Network that I have used for years just as guest WIFI.

(5). To create a VLAN ethernet port for the guest WIFI but not use it as an ethernet port.

(6). To create a IOT LAN Network which seems to need a WIFI setup that i do not want and will not use it for WIFI.

(7). To create a VLAN ethernet port for the IOT LAN Network and connect that ethernet port to the CAT6A ethernet wiring to the whole house. - From near to the router the CAT6A cable travels to an unmanaged ethernet switch that is the distributed to 4 areas, at each of the four areas is an unmanaged ethernet switch and each area is located next to a TV, sky box, xbox, VOIP, Hive System, etc. all connected via ethernet.

So the new IOT LAN Network will connect to all ethernet devices in the house but all browsing devices will be on the separate Home LAN WIFI.

Is is important that the ethernet devices on the IOT LAN Network can communicate with each other and with the wider internet.

Does this VLAN Plan sound feasible.

If so I may try it with Merlin Firmware but if it cannot work in this way or it creates security flaws I will need to rethink.

In reply to a post by jchamier:

My AX88U is not the Pro version and even with Merlin's firmware has no VLAN support as its the older hardware platform. I have unmanaged separate switch (2.5GbE). I guess if I ever upgrade to WiFi 7 then I'll investigate.

are you on 0.6.x branch

In reply to a post by jchamier:

My AX88U is not the Pro version and even with Merlin's firmware has no VLAN support as its the older hardware platform. I have unmanaged separate switch (2.5GbE). I guess if I ever upgrade to WiFi 7 then I'll investigate.

Thank you for that.

It seems that you have a very similar setup to me as I too use unmanaged ethernet switches that are located near to each TV area and before the Asus AX88U Pro my main router router was the AX88U.

I like Asus Routers but have never used Merlin Firmware.

On the AX88U Pro I wanted good WIFI in the garden so I kept the AX88U in the living room connected via ethernet and I set it up as an access point using the same wifi as the AX88U Pro but not meshed. - (In my sons bedroom, (which is next to the kitchen), the builders seem to have lined the plasterboard walls with tin foil to effectively create a Faraday Cage in his room, (which was almost a WIFI dead zone), so he has his own Asus AX82U Router which is connected via ethernet and which I set up as an access point with his own separate WIFI. - When we just had the AX88U and his AX82U and we tried to mesh them together it was hit and miss and setting it up as an access point worked well so that is why we do not bother with the Asus mesh system.

The present set up as it works well and even gives us good WIFI while sitting in the garden. - We do not use WIFI 7 and if the AX88U Pro had not been available cheap from the EU on an Amazon Deal I would not have bothered but it is better. - (Brexit was a joke as all of the good things came from the EU and all of the rubbish came from Westminster but that is a separate issue).

Perhaps, I will look again at Merlin Firmware as it has a very good reputation but I was concerned that it was third party.

theses two links may help on vlan mapping

https://www.snbforums.com/threads/help-wanted-mappin...

jksmurf on that thread near the bottom shows the vlan page thats on the ax88u pro though.

mervlan may be the solution for any missing features that do exist on the higher end devices

https://www.snbforums.com/threads/mervlan-v0-52-91-s...

In reply to a post by Taras:

Regarding the IP address for my Asus Router: at one time the Asus Routers Home LAN Login IP was 192.168.1.1 but after a firmware upgrade, (a few years ago, that changed to 192.168.50.1 for my Asus RT-AX88U Pro Router.

192.168.50.1 is the default address for Asus routers

192.168.1.1 or with some its 192.168.50.1
https://www.asus.com/uk/support/faq/1011245/

In reply to a post by Taras:

are you on 0.6.x branch

No, its obviously the older chipset. Versions on here https://www.asuswrt-merlin.net/

In reply to a post by Taras:

theses two links may help on vlan mapping

https://www.snbforums.com/threads/help-wanted-mappin...

jksmurf on that thread near the bottom shows the vlan page thats on the ax88u pro though.

mervlan may be the solution for any missing features that do exist on the higher end devices

https://www.snbforums.com/threads/mervlan-v0-52-91-s...

Thank you for these links; very helpful.

The standard Asus Firmware certainly does not manage the VLAN but there serms to be a lot more features in the Merlin VLAN Firmware so it is not surprising that so many use it.

I always worry about downloading third party firmware but I have read about development co-operation links between Asus and Merlin so perhaps I should just bite the bullet and give Merlin a try.

merlin is fine.

Its a shame that asus hasn't hired him and expand what they do.

In reply to a post by jchamier:

In reply to a post by Taras:

are you on 0.6.x branch

No, its obviously the older chipset. Versions on here https://www.asuswrt-merlin.net/

Ahh thats a shame, the x.6.x branch is quite nice

In reply to a post by Taras:

Ahh thats a shame, the x.6.x branch is quite nice

I'd upgrade/replace router if I could get a WiFi 7 that had 3 bands, or a 10GbE connection to my switch. Still hoping there may be an upgrade to the BE88U maybe a BE88U_Pro in the next year...