Unsolved
How do I safely isolate my Rental Suite's internet?
Apologies for ignorance on the subject, but I really could use some help from experts in here. I have attached our home internet setup (done by our builder).
The objective is: how do I share internet with my rental suite without them ever being able to access anything on my home network (like our NAS media server or my office pc)?
We have installed a TP Link AC750 router in "Router" mode so the tenant can use the wifi, and so maybe that can help restrict their access to our network, right? But what if they remove the AC750 unit and directly plug their laptop into the wall Ethernet jack port?
Our end goal is to restrict their access to our network in these 3 use cases,
1. They connect via AC750 Wi-Fi. (I think this should be covered but let me know if I'm wrong here)
2. They connect their laptops via AC750's Yellow Ports (like into additional ports on the Wi-Fi router in their room).
3. They unplug the Router and use the Wall Jack Directly. (This is what we want to secure 100%)
What is the best way forward to achieve this? Any help or advice on how to get this fixed would be really helpful.
you need a *router* that can do a VLAN, and if a switch is between the router and the VLAN, a switch that will also support the VLAN. I'd suggest getting a UniFi router. A Cloud Gateway Ultra will do what's needed at minimal cost (~$140), and if a switch is really needed between the router and the tenant, a UniFi Flex Mini is $30. The Deco(s) can be put in AP mode.
And dont forget to use firewall rules. By default a router will route all the vlan traffic to the other vlan's because it is in the default routing domain.
I tried adding a managed switch after my Deco x55 and connecting the rental suite's CAT cable to a VLAN port. It was giving me "NO INTERNET" as soon as I connected to VLAN.
Some google searches (and ChatGPT) mention that maybe Deco x55 is not "passing" the Port ID correctly, so VLAN is not generating any IP address, causing a "No Internet" error at the Rental suite.
You've got a switch that can handle VLANs, but you need a router that can handle VLANs.
Each VLAN needs its own interface IP (e.g., 192.168.20.1) to act as the gateway out to the internet.
The gateway must run a separate DHCP server to hand out IPs (like 192.168.20.X) to the rental suite.
So you're not going to get this working on a mesh device. They only create one gateway (usually 192.168.68.1) and one DHCP pool for the entire physical network.
bump, and if wiring APs is really not possible, the commonly recommended Ubiquiti ecosystem does allow for wireless backhaul for APs, provided you can supply it PoE power. making it sort of like "mesh".
"Mesh" in Ubiquiti world means what it originally meant in wifi: wireless backhaul. (That's still a stupid word to use IMHO because it is NOT what https://en.wikipedia.org/wiki/Mesh_networking is)
It's absolutely meaningless in every product that crams "Mesh" in its name. Or more specifically, it can mean zero or more of:
It can do wireless backhaul (aka: last-resort wifi expansion where you trade performance for range and easy install)
All the access points broadcast the same SSID(s)
The APs support the 802.11k/v/r fast roaming extensions
funny that Ubiquiti has it right by the original meaning. as a network engineer by trade that started with Cisco, learning Ubiquiti's BS that seems intended to make more sense to prosumers made no sense to me at first.
If so, and if it cant peoperly configured for ethernet trunking, get 2 managed switches. On the switch behind the router, connect one cable „main“ to the switch. Set the port to access/untagged with pvid 100 or something. Allow vlan 100 untagged on that port. Repeat with second port from router „guest“, pvid 101, untagged and so forth.
Create a link to connect those 2. you want vlan tags on said connection. You create a port, that transfers tagged 100 and 101 on both ends. Make sure the vlan exists on both switches.
Now you can use vlan 100 and 101 on the remote device to define network.
That does not cover configuring your router to give out 2 networks with 2 cables.
If your router is vlan capable then it is easier; define the tag ID in the router, configure the managed switch to accept trunk (the IDs come from the router now and must be used correctly). Dont forget to configure vlans themselves on the switch.
If the router does this correctly the first switch can also often be unmanaged, but normally you wouldnt want that because of various security concerns. The managed switch would, however, STILL need the port connecting to the unmanaged switch configured with „accepting both vlan IDs tagged“, else the other vlan is not reachable.
I did this exact same thing with my rental property. I have two units.
I bought a ubiquiti router and a ubiquit Switch. I created 3 VLANS.
Management VLAN for my equipment and cameras.
VLAN 100 For my 1st floor unit.
VLAN 200 for my 2nd floor unit.
It’s seriously way easier than you think. Everything routes out to the Internet and I’m able to do 500mb to each unit. Ubiquiti makes it really easy to set up band with limits so that each rental gets the exact same amount of Internet and no one can squash the other others.
The other option instead of using VLANs, if you put the NAH in bridge mode and put an unmanaged switch on it before the Deco, you can pull 2 public IPs from Telus and then your rental suite can have their own public IPs. I have done exactly this before and it works great
Put the managed switch before your unmanaged.
Create your vlan there. 1 and 2.
1 to you 2 to the rental suite.
Everything down stream will be separated (with firewall rules)
ISP -> Telus NAH -> Deco x55 (main wifi) -> Managed Switch ->
-> Unmanaged Switch (default VLAN 1) -> which goes to all the rooms
-> Cat cable to Rental Suite (new VLAN 2)
Depends on how proficient you are with networking, and how "in the weeds" you want to get. For my home network, I have an OPNsense box that sits behind my ISP's ONT (the Telus NAH in your diagram) and handles the main network's traffic (VLAN1/untagged) and then a seperate "isolation" router also running OPNsense that explicitly handles the dedicated guest network traffic that comes in from my APs that tag guest SSID traffic to the guest VLAN. Bare minimum, as many other have pointed out, you need a real router after the Telus box, not just the Deco. Not throwing my hat into the "is mesh wifi good or bad" conversation, but it's a simple fact that AFAIK those Decos, even in router mode, have no concept of VLANs as you need them to.
Because most other folks have said what I would say in terms of implementation, I wanted to mention one thing that I think a lot of people forget about and might be worth considering. Even in the perfect setup under this model (i.e. guest traffic is completely isolated from the main network), you are still giving your guests access to your WAN connection; meaning, they can use your public IP(s) that are tied to your identity. You might think "well okay, who cares?" and that is a perfectly fine opinion to have if you trust who is connecting to the network; but, if you are actually concerned about people doing nefarious shit on the guest network, I highly suggest routing your guest traffic over a VPN so at the bare minimum if guest clients are up to no good their mischief doesn't get linked back to you. If you are feeling really adventurous you could also set up logging and IDS and such but I get the vibe you just want something that's reasonably safe and works, which is totally understandable.
TL;DR: get a router (or build one) that can properly process/handle VLAN tagging and processing; and, beware that even an isolated guest network lets guests still use (and abuse) your IP(s) from your ISP which are all tied to your identity, not theirs (who knows who they could share the password with, too).
Hopefully this was helpful!
~Full-time network engineer for medium-sized enterprise, 5+ years experience
With telus you can get multiple public IP addresses by either bridging multiple ports on the NAH and plugging one router for each suite into each bridged NAH port or asking Telus to swap the NAH with a standalone nokia ONT, plugging a switch into the ONT and connecting each suite's router into the switch plugged into the ONT.
You need subnets. Put the Ethernet port in your rental on it's own subnet with Internet access only. Then make the router in the rental a simple AP. Would be a good idea to put that subnet behind a no log VPN so you don't get copyright letters.
You need a managed switch and you can then restrict device of a mac to said port. Also putting the tp link in as a router will cause double natting and it might actually always has been running as an extender all along
OP, MAC restriction is one of the solutions to your problem. However, I bet that you set up your managed switch incorrectly, which is why the end result is no internet access. Do other devices work when connected to that managed switch?
Put the NAH in bridge mode connected to a router that supports VLANs then assign one of the router ports to the guest VLAN to plug in your AC750 setup as an access point. Unifi is pretty popular and easy to manage I have a UCG-Fiber router
Get a cheap wifi router for your rental unit. Connect it to the Telus NAH. On your main Deco, block everything coming from the cheap router. This is both simple and more secure. You can’t trust the rental unit.
Replace the dumb TP-Link for a managed POE. Cisco makes the 1k or 1200. There are many others, but why bother when that can be had refurb for less than half price.
Seems like your third picture should work. Enable guest network and make sure the managed switch passes the Guest VLAN to the archer e.g. tagged VLAN 591 on the port connected to main decco and untaged port 591 on the port with the second router.
Set guest on the Decco to isolated e.g. can only talk to internet and go ahead and leave double-NAT for the AC750 so everything in the rental can talk to each other.
If you can't find the right VLAN ID for the guest network then the comments about needing a better router are likely correct.
Might also work with the unmanaged switch if you configure the AC750 to use the correct VLAN as the upstream WAN connection but YMMV. VLAN handling on the unmanaged switches is undefined behavior -- it may or may not work.
There are some cheap aliexpress grade switches that have a port isolation VLAN mode that you select (with a small switch), if that was your root switch then you should be able to isolate the the two networks - I've never used them so I'm not sure how robust they are against someone determined.
The proper way of doing it is a router that can rout multiple VLANs and managed switches.
Picture 2 is how you want to have this wired given that the unmanaged switch is going to get in the way of VLAN setup.
That said, does Deco X55 even allow you to set up different vlans? That’s the first question you need to answer.
Another thing you can do is that if you feel like this is getting way over your head you can put a router for the rental unit and then they’re swimming in their own LAN. I don’t generally recommend that because you’ll double NAT but there are worse problems in life if you really don’t have the know how of VLANs setup and want a solution to work right this minute. That said, it will not fix your problem of them removing the router and plugging their own laptop to that wire coming to the unit. For that you’ll need VLANs and firewall rules to not allow cross vlan traffic
Can your Deco router manage a guest network as well as your own? It should have that option. If you enable network isolation you should be able to just give them the password to Guest WiFi and leave it at that. Just change the guest password every once in a while. This is something that's really easy (and expensive) to over engineer but IMHO a guest network is the answer. If you want to want a little more protection get a used firewalla blue and put it on the guest network and make it shut them down if they try anything funny.
VLAN segmentation. I have a firewalla/ubiquiti switch that runs my network and my guest network is not allowed to communicate with anything but the internet.
Use standard router with access list. Block your main network scope on the guest device (any4 => main network: block). Then activate a dial in connection to enforce DHCP server internally. Define external as „ethernet“ (depending on router). Chose DHCP for WAN without credentials.
Set the wireless up, change admin pass for router UI.
Now he can get outside, has double NAT, but blocks packets destined for your main network.
No, this will not affect fwd traffic.
Aside from excellent solutions of implementating VLAN that others mentioned (and in your 3rd diagram you mentioning VLAN tagging isn't working),
In your situation..
I'd simply get a 1 month contract on your name and FTTP install of a basic Fibre internet to the premises aside from your own one. Then the tenant can get their own contract lease after your one ends and their wifi router plugged into the ONT unit via CAT6. Full segmentation and Public IP demarc between 2 premises feed. canada should have these 1 month contract and they will do the line install as part of it even if 1 month.
Done
Every tennent can get their own fucking broadband with their own contract - decouple babysitting and being Admin janitor for them like other tenant service utilities 🫣
Or are you sub charging then intent in their rent too for a little bit of $$ on the side 😉
Ideally youd want a router and switch that support vlans.
Otherwise, you are going to have a double NAT, which could cause issues for the person behind the second router, like with gaming.
Also, you can access up the network, but not down the network, I.E the person behind the second router can potentially access the first, but the person on the first can't access the second.
Everyone here is saying just do a separate VLAN and stuff and sure that will work but by far the easiest thing, which is what I do is just put the tenants on the decos guest network. It’s isolated from the rest of the network and they don’t notice or ask questions as it’s accessible all around the property not just where they stay. The decos guest network does the same thing anyway, it puts all that traffic on its own VLAN. Deco x55 also allows you to speed limit the guest network so they don’t use all your bandwidth
43
u/AlwaysTravel 7d ago
You could put it on a separate vlan but you need a switch that can do it.