Isolating a wired and wireless network

[dkrumlauf]

I want to add a wireless network in a way that will not allow wireless users to access my wired network. My thought is to put a hub or switch behind the cable modem then connect both routers to the hub. Each router would pull an IP from my ISP and this should totally isolate them. Does anyone see a problem with doing it this way? Would it be effectively the same if I plugged the wireless router into the main router but used a different IP range and subnet? Both routers need to be dhcp.

Thanks!

 

[jmwills]

One ISP means one DHCP connection from the ISP. You will need multiple accoutns to configure it the way you want. But honestly, what youwant to do is very doable within one combined network by locking down the wireless side with MAC filtering, complex passwords, etc.

 

[JohnWill]

The easy way to do this is configure the two routers in a different manner.

Connect the wireless router directly to the broadband modem. Configure the secondary wired router with a static WAN address outside the range of the DHCP server in the wireless router, but in the same subnet. Change the base address of the wired router to a different subnet than the wireless router. For port forwarding, you can put the wired router in the DMZ of the wireless router as well.

This isolates the entire wired network behind the router's NAT firewall, and should solve your problem with only one public IP address.

 

[JohnWill]

One ISP means one DHCP connection from the ISP. You will need multiple accoutns to configure it the way you want. But honestly, what youwant to do is very doable within one combined network by locking down the wireless side with MAC filtering, complex passwords, etc.

I'm not sure I agree that the best way to do this is with MAC filtering, etc. I'd much rather see an active barrier that doesn't require constant reconfiguration, and it's far more foolproof to simply stick the second router in the mix.

 

[dkrumlauf]

Thanks for all the great advice. I'll probably just put a switch behind the modem and pay the extra $5/mo. to have another IP. I need a static on the wired side for some remote access that I'd do with port forwarding. I might get a static for the wireless side too so I can remotely access that router. I'm very impressed with the speed and knowledge of your responses. I just found this site today and plan to stay with it. It's AWESOME!

 

[cwwozniak]

You can do it all with a single fixed IP address if you want. The following thread describes how I isolated a WEP wireless network from our wired LAN (that also has WPA protected access). We also have remote PCanywhere access to a couple of wired desktops.

http://forums.techguy.org/networking/568284-solved-mixing-wireless-wep-wpa.html

EDIT: The thread is just a more detailed version of JohnWill's information in post #3.