Public and private wifi network security when private is upstream from public

Question

Disclaimer: I'm pretty sure the terminology I'm using is mistaken, please advise what terms are more suitable/correct.

I have two questions, both about the same situation, right at the bottom.

Background

The most simplified view of my network is as follows:-

Modem (fibre-optic) -> OfficeRouter -> PublicRouter

That is to say, the LAN cable from the modem goes to the WAN slot in my OfficeRouter, and the PublicRouter is connected to one of the LAN slots in my OfficeRouter.

Both OfficeRouter and PublicRouter broadcast their own SSIDs, called privatessid and publicssid. Additionally, up to a dozen PCs are connected to OfficeRouter via LAN (through switches).

Limitations

Physical placement constraints mean I cannot change the relative ordering of my routers.

Current networking setup

Each router runs its own DHCP service, so all clients connecting to OfficeRouter (via privatessid or LAN) get something on 192.168.0.* and all clients connecting via PublicRouter get something on 192.168.1.*

Security question

How can I 'mask' or prevent access to machines connected to OfficeRouter from machines connected to PublicRouter? One of the byproducts of my unfortunate physical arrangement of routers is that all the office machines are directly accessible by anyone connected to publicssid.

Networking question

Is it possible to handle more than 255 connections to publicssid? Do I just have to change the subnet mask for that to work, or is there something I'm missing. The routers in question are fairly basic, are there practical considerations for handling that many connections at once?

Answer 1

This is almost impossible to do on a consumer grade router - you are, in effect, making your Office network insecure by allowing guest access to traverse it - and worse, you are probably using NAT which will further obfusicate and make tracking issues worse.

If you can use OpenWRT or another Linux variant you could set up separate VLANS for 2 of the Interfaces on your office router for your Office and for the guest router. You would then need to set each up seperately, and use firewalling to control the routing between the devices. You would need to use VLANS to ensure that traffic is always routed through the router (or use EBTables which would be even messier) AFAIK this is not something you can do through the web Interface, and requires a lot of work at the command line (but its doable, I've done something very similar)