Create physically isolated network at home (not virtual)

gnestor

Commendable
Feb 13, 2017
2
0
1,510
Background:
I have two RG6 cables run to every room in my house, but currently only one is used and connected (cbl1) to my ISP and cable provider. I have two routers and currently have my main router (rtr1) connected to the ISP via DHCP. The second router (rtr2) has COAX WAN disabled and I have it bridged to the home network and acting as a DHCP relay (so that devices connected to it get their IP from rtr1).

I'd like to use the untouched RG6 (cbl2) to create a physically isolated network, and then connect them with WAN-LAN ethernet so that everything on rtr2 (cbl2) network will talk internally without traffic on cbl1, but still get everything outside (internet) via gateway to rtr1 (and ISP).

Here's what I think I need to do to accomplish this:

rtr1 configuration (Network1):
WAN (broadband coax) IP: (from ISP)
WAN DNS: (from ISP)
WAN IP Distro: Disabled
rtr1 IP (LAN or Home Network): 192.168.1.1
rtr1 subnet: 255.255.255.0
rtr1 DHCP Server: Yes (192.168.1.10 - 192.168.1.50)
rtr1 DNS: 0.0.0.0

rtr2 config (Network2):
WAN rtr2 IP: 192.168.1.2 (Network1 IP address)
WAN subnet: 255.255.255.0 (?)
WAN gateway: 192.168.1.1 (rtr1 IP address)
WAN DNS: 0.0.0.0
rtr2 IP(Home Network): 192.168.2.1
rtr2 subnet: 255.255.255.0
rtr2 DCHP server: Yes (192.168.2.10 - 192.168.2.50) (DIFFERENT subnet than rtr1)
rtr2 DNS: 0.0.0.0 (so will use gateway DNS I think)
Firewall: OFF (because rtr1 firewall ON and this router can only talk to "outside" through router1)

With this config rtr2 WAN should see internet access and serve all connected devices on the .2.x network I think.

Couple questions:
1) Subnet in particular, but does this configuration for both routers look like it would work?

2) Will this config work to isolate all internal network traffic by devices connected to router 2 (rtr2), so that say copying files from device 1 to device 2 (connected to rtr2) would only show up on cable 2 (cbl2) and not be passed over to router 1/cable 1/ISP?

3) Is this worth the effort? It seems to me that having a cable with no other signals (analog and/or digital) would make the network much quicker, and having all the traffic off the ISP connected line would make it more secure. That said, I'm not sure if it will do what I intend.

4) Will this cause any subtle problems (gaming/streaming/etc) with internet access on the isolated network (192.168.2.x)?
 
Your plan would have worked if "rtr2" was normal "cable router" and not combo modem/router. There is no (easy, cheap) way to convert coax WAN port on rtr2 to Ethernet so that you can daisychain it to rtr1, and it lacks WAN Ethernet interface which would be needed to accomplish the separation you're looking for.
 

gnestor

Commendable
Feb 13, 2017
2
0
1,510


Verizon routers allow both WAN and LAN communication on coax, so rtr1 is using ISP (cbl1) coax for WAN traffic, and rtr2 (and 3 & 4 throughout the house) on cbl2 are using the coax for LAN (tcp/ip) traffic. (And these routers also have both coax and ether WAN connections, so I connected rtr1 LAN ether to rtr2 WAN ether)

So this worked, but now it appears that I'm having an issue with multiple NATs on the network.

There are a couple more things I plan to try, but wondering about the router's mode, which can be "Route", "NAT", or "NAPT" <default>. I think the double NAT problem I'm having is because both rtr1 & rtr2 are in NAPT mode. I think only one should serve as the NAT router, but not sure which one. I'm trying rtr1 first.

Another setting I'm wondering about (currently set to "DHCP relay" on various routers on the cbl2 network) is whether these should be DHCP relay or just DISABLED. Both configuration seem to work, but it seems that devices have trouble seeing other devices outside the router they are connected to in the DISABLED mode (however both modes internet works fine, it's all being sent back through rtr2 gateway to rtr1 to ISP).

If anyone has advice on: Routing mode, Device metric, and firewall (on/off) settings for the two routers in this configuration it would be very much appreciated.
 

TRENDING THREADS