Network Segregation for Privacy

Question

Basically I currently have a very simple network setup. Internet from my ISP connects to a modem, the modem connects to a wireless router. All devices throughout the house connect to this router whether thru a wireless or wired connection. My question is, since I have an office within my house, how can I segregate my office devices from the rest of the network? This is to prevent other devices outside the office from being able to print to the office printer and also to make sure the files stay private and inaccessible to other non-office devices. But, I also have a laptop which I'd like to wirelessly print to and access my files, but only if I'm connected to the "office" network.

Ideally, I'd like to have two routers, one for the office and the other for the rest. But, how can I ensure that both routers are unaware of each other while utilizing only one modem. Do I need something like a switch or a hub? If so, what kind of setup would I need to do thru the firmware?

Answer 1

Depending on your hardware there are multiple ways of solving the problem. The easiest one works along the lines you hinted at in your email - 2 routers. I'd look at a solution as follows:

    ISP / Internet Cloud
    |
    |
   ROUTER 1
       |
       |-------- Home PC 1
       | 
       |-------- Home PC 2
       | 
       |-------- Home PC X
       |
       |-------(  Home WIFI connection for laptop(s) )
       |
     ROUTER 2
       |
       |--------  Office PC 1
       |
       |--------  Office PC 2
       |
       --(  Office WIFI connection for Laptop)

To implement this you would plug the WAN port from ROUTER 2 into a LAN port in ROUTER 1. (ROUTER 1 is your current router).

There are a few things you need to make sure of -

1. The Network used for ROUTER 2 must be different to Network 1. (You will probably find Network 1 uses 192.168.1.x for IP's - you need to change
   ROUTER 2 to issue IP's in another range, for example 172.16.1.x)

2. The ACCESS Point names for ROUTER 1 and ROUTER 2 must be different - and you probably want to use different frequencies as well. You would also want different WPA keys.

3. ROUTER 2 is an ETHERNET and WIRELESS ROUTER (you may find ROUTER 1 is an ADSL router or Cable router, meaning the "WAN" port is not an ETHERNET PORT. That is OK)

Other bits -

1. You won't need a switch (or a hub, which is like a switch, but obsolete technology) if you have enough "LAN" ports on each of your routers. If you have a shortage of ports on ROUTER 1 you could plug one of the LAN ports into a switch, and then feed ROUTER 2 and some of the home PC's of ROUTER 1.

2. In this solution, the routers are both aware of each other and will play well together.

3. This solution uses "DOUBLE NAT", which works fine (most cellphone carriers use it), but is not technically ideal. It will limit your ability to run externally accessible servers on your office network.

4. While it in some cases it is possible to have both ROUTER 1 and ROUTER 2 connecting to a common router. This is a technically better way of doing things but is a more complex setup, and requires either multiple addresses from your ISP or intelligence not accessible in most "off-the-shelf" routers.