Wireless Access Point: Security from LAN?

[Trey C]

I have an old DLink router. If I set it up on my home WiFi network as an access point with WPA2 security, will that protect me from other LAN hosts from sending requests to my devices? Is there a way to create a separate LAN (which would run through the same gateway modem) that would isolate my devices from other devices which have access to my home WiFi network?

I use a VPN for security from devices outside my home nework.

 

[Gabriel Pike]

So you are trying to block access to your PC from others on your LAN. Yes. You can connect another router through it's WAN port to your existing network and provide a level of segmentation on the LAN. However to avoid conflicts make sure your second router is on a different IP scheme than the first. eg. if first LAN is 192.168.1.0/24 change second router to 192.168.2.0/24. Also make sure that the wireless SSID and password are different than the first router. This should give you what you are looking for. Be aware though that this will not fix any backdoors that could have been installed on your system before segmenting the network.

 

[DelJo63]

Well Done Gabriel !! Each router will be isolated from the other - - meaning sharing will not cross subnet boundaries. Even then it CAN be made to work, but that kills the isolation you are looking for.

As always, for both routers:

• be sure to use the latest firmware
  
• change the default admin password
• disable port 8080

 

[Trey C]

Thanks for the help! I set up my router but it wouldn't let me change the IP scheme.

 

[Gabriel Pike]

As long as it works you should be good. I have seen occasions where IP conflicts can happen but it the router can handle it then it does not matter.

 

[DelJo63]

The router IP is in the WAN side setup. Typically we use AUTO, but in your case you want Manual IP as noted above.

 

[Trey C]

I suppose then that my router doesn't support this functionality. It's pretty old. It's a DLink DIR-628. If I were to google for a device that does support this functionality what would I search for? LAN-WAN router??

 

[DelJo63]

Pg 22 shows setup
(Remember, connect only Router to PC LAN side and nothing else)

1. change My Internet Connection: Dynamic IP to Manual
2. set router address 192.168.2.1
3. Mask to 255.255.255.0
4. set DNS 8.8.8.8 & 8.8.4.4
5. (I assume you've set a new admin pwd and disabled remote admin already)
6. (and the wifi is also setup)
   
7. save settings

Now you can wire the primary router into the WAN slot on the new router

You can not PING 192.168.2.1, you can 192.168.1.1 and you can connect to the WIFI

The wifi connected device can access google.com/

 

[Trey C]

Pg 22 shows setup
(Remember, connect only Router to PC LAN side and nothing else)

1. change My Internet Connection: Dynamic IP to Manual
2. set router address 192.168.2.1
3. Mask to 255.255.255.0
4. set DNS 8.8.8.8 & 8.8.4.4
5. (I assume you've set a new admin pwd and disabled remote admin already)
6. (and the wifi is also setup)
   
7. save settings

Now you can wire the primary router into the WAN slot on the new router

You can not PING 192.168.2.1, you can 192.168.1.1 and you can connect to the WIFI

The wifi connected device can access google.com/

My Internet Connection refers to the router set up and not my PC IPv4 properties, right?

 

[Trey C]

The error dialogue box I'm getting when I do the above is

WAN Gateway IP 192.168.1.254 must be within WAN Subnet

 

[DelJo63]

My Internet Connection refers to the router set up and not my PC IPv4 properties, right?

Yes - - you're logged into the router

WAN Gateway IP 192.168.1.254 must be within WAN Subnet

I thought you were using 192.168.2.1 for the new router??

 

[Trey C]

Yes - - you're logged into the router

I thought you were using 192.168.2.1 for the new router??

the .254 IP is the modem

 

[DelJo63]

Hmm; IMO, we are both confused on the layout

Use http://www.advanced-ip-scanner.com/link.php?lng=en&ver=2-4-2526&beta=n&page=about
to map the devices on the primary router

• (scan 192.168.1.1-192.168.1.254)
• the Save As Network.cvs.

You can then add .txt after .cvs to allow uploading

When there are separate boxes for the ISP Modem and the Lan Router, the modem is configured to be in BRIDGE MODE, which hands control to the router.