Separating a network (rented house)

[JABB]

I am renting a house in a small ex farm yard. The wifi here comes in fibre to an openreach white wall hub and onto the BT router. From there I have a TP Deco mesh to cover the house and I connect my apple TV direct to the router. The barn opposite has a satellite link over the yard which comes out of the router to a POE and then over the yard. I don’t know what they have that side, but I guess a switch and then another mesh for their own wifi network. Is there any way I can split so they are not part of my network? As it stands, I guess they can access all my smart controls / switches. I know the router has a guest network but I think that is just wifi?
Latest BT home hub router.
Any advise please? Thank you

[sgrimshaw]

Are they paying you for "their" connection?

[JABB]

We are sharing the cost. There is no fibre line to that building

[bitchstewie]

Simplest would be a separate VLAN for each house - you might be able to do that with what you've already got but I'd be surprised if it's consumer grade kit.

Fun part is that how to do that isn't really a 5 minute on a Sunday morning thing if you've never heard of a VLAN

[Mr E]

As above. VLANs are what you need.

TP link easy smart switches support VLAN. The router supplied with your broadband probably doesn’t.

Edited by Mr E on Sunday 11th August 08:52

[egomeister]

Apologies for jumping into your thread OP but it's the same topic really.

I'd quite like to separate off my smart home stuff from my main network (mainly down to an increasing amount of cheap Chinese items of dubious quality), so VLAN seems to be the way to go. Does anyone have some good background reading or idiots guides for setting this kind of thing up?

[quinny100]

VLAN’s alone won’t get you to where you need to be.

What you really need is a Layer 3 device capable of terminating 2 separate networks and allowing you to block or explicitly permit traffic between them. You don’t actually need VLAN’s because the remote network is physically separate anyway across the “satellite link” which I suspect would be more accurately described as a wireless bridge or P2P radio link.

Starting with a clean sheet I’d use something like a FortiGate 40F and terminate the BT FTTP connection on it directly (so bin off the smart hub). Configure separate interfaces on the FG for each network, making the FG the default gateway for each network. Provided you don’t configure any policy to allow traffic between the networks, the networks won’t be able to talk to each other. You will need a policy to allow Internet access from each network with the appropriate NAT config. Less than an hour to get that in and working if you know what you’re doing, and you’d be looking at a few hundred quid for the hardware.

There’s probably consumer routers that could achieve similar results but I stick to proper enterprise kit.

[Mr Pointy]

Most of the Draytek routers allow you to isolate the LAN ports from each other - in fact by default they are isolated. If you can remove the BT router in then many of the Draytek models have a gigabit WAN interface:

https://www.draytek.com/products/router-matrix

Try asking Draytek support what you need to replace the BT router - you'll pay £200-£250 new but there are plenty on ebay as well.

[OldGermanHeaps]

I would use tp link omada kit, or unifi ux express and a basic unifi switch. Both are very easy for a beginner to setup and manage for multiple vlans
Draytek will do what you want, but setup definitely isnt for the inexperienced.

[Mr Pointy]

OldGermanHeaps said:

I would use tp link omada kit, or unifi ux express and a basic unifi switch. Both are very easy for a beginner to setup and manage for multiple vlans
Draytek will do what you want, but setup definitely isnt for the inexperienced.

I agree that there are a lot of options in the Draytek setup but for basic home use I managed to get through it & I'm not an expert. It has the advantage that it's s physical connect/disconnect & doesn't rely on understanding VLANs.

[ffc]

As others have said a firewall will do this. You'll need three ports. One for the ISP connection, one for your network and one for the other side of the yard.

Then a permit rule and NAT from your network to the internet and also the yard network to the internet and they're isolated from each other.

If your port is VLAN enabled you can have separate VLAN's for each function you want to isolate and create appropriate security policy between them.

Something like this https://www.itandgeneral.com/pfsense-uk/netgate-11... will do the job.

Edited by ffc on Sunday 11th August 18:23

[JABB]

Thank you chaps. Much reading required

[shtu]

One small detail - dhcp..

It's quite likely the BT router is issuing IP addresses for everything as-is, so ideally you want each network to have it's own dhcp server. There's a fair chance some of the kit mentioned can do that for you.

[.:ian:.]

Something like a nanopi r5s running openwrt would fit the bill.

https://www.friendlyelec.com/index.php?route=produ...

A lot cheaper than some of the suggestions

Two vlans and one wan connection.

Even cheaper, cheesy option, if the remote end are not too fussy, you could isolate them from your side by double natting them with a second cheap router. Their lan side to the lan port on the router, wan side plugged into your lan.

The wan set for plain old ethernet dhcp, it will pick up an address from your dhcp and route traffic to the gateway on your lan.

Firewall rules on both routers limiting access to the others vlan should be enough. Though the Nat will block all access up from you to them.