In reply to a post by MrSaffron:

No, just answer the question.

I have, several times. You don't accept my answer, so either ask Linksys or get a router from Linksys and find out yourself.

From my past experiences, I thought typically these sort of routers created a second NAT?

Therefore mitigating any concerns that the guests can route traffic to the private network?

Shoot me down if I'm wrong

Second NAT yes thats normall

WAN range ---- ROUTER --- GUEST LAN 10.0.0.x for example
                     |
                     -----WORK LAN 172.17.17.x cannot see each other

But both can see everything on the WAN side of the router

Switch from code to pre tag

Edited by MrSaffron (Tue 29-Mar-11 12:26:14)

It appears that Batboy is right,

http://www.linksysbycisco.com/UK/en/products/E3000?l...

http://downloads.linksysbycisco.com/downloads/usergu...

...refer to �Simultaneous Networks� on page
9. The Guest Access features allows you to provide Internet
access to guests visiting your home without granting
them access to your local network.

Wireless Configuration (Manual)
Your Linksys E3000 can run two networks at the same time, one network using the 5 GHz radio frequency band and the other network using the 2.4 GHz radio frequency band. This allows you to isolate higher-priority traffic, such as video and voice applications, on the 5 GHz network, which is less prone to interference.

The computers and devices running your video and voice applications can use the 5 GHz network, while your guest access and computers that are only browsing the web can use the 2.4 GHz network.

It doesn't quite state (from what I can see) that the two LANs are specifically firewalled from each other, but it suggests that is what happens.


If you didn't know how to explain it, you could have just said so.

To imply that the "Linksys by Cisco" products are somehow in the same league as the Cisco gear is wrong. One is a range of domestic and small-business grade budget kit, the other isn't. To use an analogy, VAG own both Skoda and Bugatti, it doesn't mean a Fabia is the same as a Veyron.

In reply to a post by shtu:

To use an analogy, VAG own both Skoda and Bugatti, it doesn't mean a Fabia is the same as a Veyron.

You'd be surprised at what VAG do actually share in terms of components between it's lower cost products (VW/Skoda/Seat) and it's super car brands such as Porsche and Lamborghini! Ha!

Batboy is right in that if the two networks are on the LAN side of the Cisco then they can be kept seperate, I've never disagreed with this.

I am being beligerent because the original poster was talking of the following setting

ADSL modem/router ----SHOPNETWORK----CISCO ROUTER WITH WIRELESS GUEST NETWORK

Thus the guest network traffic has to cover the shop network to reach the outside world. Have posted suggestions for setups that would avoid this.

Perhaps I am not explaining myself correctly, but have come across this situation on peoples networks and face to face they have understood me.

Indeed I don't think there's any problem with your explanation, as much as is possible in a forum without embedded images.

It does sound like the kind of setup best discussed sat in front of a network diagram showing where the data goes, and being limited to ASCII art makes this tricky to clarify.

Even if there is an ADSL version of a router that provides guest Wi-Fi access, I'm not sure that is the best answer for this location. For a router located in a staff area of the shop, the OP can't even assume that this will give a reliable Wi-Fi signal in the flat.

The OP has not said if there is a good reason why the flat cannot have its own independent broadband connection. If budget is an issue, an old PC could run install Smoothwall Express or pfSense.

Granted there is a bit more one-off work involved (adding 1 or 2 network cards), but both of the above can install from a bootable CD and provide proper separation of the networks. The latter could do a captive portal (for the flat or for the shop) and traffic shaping.

A problem I've seen when visiting other setups is that, if the internet works, people assume it's all ok and stop thinking about whether the setup is secure enough.

Whatever route the OP goes down they need to allow for the possibility of needed to run CAT5 to an access point in the flat.

Also, OP should not worry about replacing the "ISP router" with something better suited to the requirements as long as they have a note of the ADSL settings - no reasonable ISP can insist you use their supplied router (though they might get sniffy about answering support questions).

We use to have a setup which consisted of a main wireless router, a second wireless router to cover a dead spot in the house and a third wireless router for guest access. The second and third router had DHCP disabled with ip adresses within the main router range. The guest router also had the "AP Isolation" setting set to enabled . This would prevent the clients connected to the wireless guest AP to have access to other clients or network devices. The guset router had full internet access.. The second and third router were connected by the lan ports and not WAN. Once the "AP Isolation" was set this also prevented access to set up the router by wireless. Further access to settings on the guest router could only be done by a Lan connection.

Most wireless routers now days have the "AP isolation"
This may work for the op

OK wow! What have I started? This is all Great Input! Really big thanks!

Some of my thoughts when reading all your posts! In no particular order:

General comments:

I have confirmed that I �should� be able to replace the ISP�s modem/router with one of my own choice! Currently it�s a Thomson LiveBox supplied by Orange. One DSL/WAN port and 2 (yes 2!) LAN ports, and wireless G

I have read reports that the Linksys E-series are not very good at letting you change the �guest� SSID and password! It apparently gets messed up and you end up having to reset the whole thing!

prlzx - Yes given the shop and flat construction, I had considered that I may need to run some Cat5 up to the flat and then it would make sense just to use an AP. How though do I prevent the 'flat guests' disconnecting the wired connection to the AP and attaching their devices to the protected LAN. Any AP's you'd recomend?

BP1 - With ref to above Is this the 'AP isolation' you talk of. If fairly sure the current router does not have the 'AP isolation' feature.

shtu - Ok was aware that the Linksys was dual band. But If I understand you correctly if I created a trusted wireless LAN for the shop and a Guest wireless LAN for the flat. Then one would have to run on 2.4Ghz and the other on 5Ghz? Which would be a bummer as it's unlikely that any kit either in the shop or flat will be 5Ghz capable!

BatBoy � Quick Look at the Fon Router and other such devices/services. Not sure? This service is open to the public and then chargeable?

The idea is that we give the �flat guest� the Linksys guest password on arrival. They could then access the web/mail etc during their stay. When they check out we�d change the �guest network� password. Don�t want the guest network to be open, or a chargeable service! Don�t want the guest network to be a WEP/WAP

MrSaffron � Ref your post

In reply to a post by MrSaffron:

Batboy is right in that if the two networks are on the LAN side of the Cisco then they can be kept seperate, I've never disagreed with this.

I am being beligerent because the original poster was talking of the following setting

ADSL modem/router ----SHOPNETWORK----CISCO ROUTER WITH WIRELESS GUEST NETWORK

Thus the guest network traffic has to cover the shop network to reach the outside world. Have posted suggestions for setups that would avoid this.

Perhaps I am not explaining myself correctly, but have come across this situation on peoples networks and face to face they have understood me.

The reason for the original post was that the Linksys E-series are cable routers only. So just to clarify I could do this?

Use the orange router. With WIFI and DHCP disabled. Effectively as a ADSL modem.
Connect the Linksys or suchlike to one of the orange routers LAN ports. The shop LAN and Guest LAN both on the Linksys. With WIFI and DHCP enabled. Yes as you say double NAT�s, but would I if this was a LAN-LAN port connection?

Alternatively:

Use the orange router. With WIFI disabled. And attach a separate switch/AP for the shop to one LAN port and a separate AP for the Flat to the other LAN port? Don�t know what the implications are here!

Finally (for now!) when I started looking into this I did look at Belkin Playmax range of routers. These are ADSL and have the guest facility. But get very bad reviews! Any comments please?

The FON thing was just a response to the naysayers who doubted you could achieve what you wanted simply and cheaply. The FON router would not be what you want.