Recommend a VLAN switch

[Sonic007]

Im needing to split my home network in to two sections that cant see each other.

 

I'm behind a standard Sky router. Can anyone recommend a managed switch that will let me configure say ports 2-4 on one vlan and ports 5 to 8 on another, without them being able to communicate.

They would need to both be able to have web access via the Sky router.

 

I'm thinking that this may not work as the Sky router will allow the two vlans to communicate?

 

Will a vlan switch even work?

 

Anyone done something similar?

 

There is no option to put the Sky router into Modem only mode so cant do that.

 

What are my options?

 

Many thanks for your help.

[howartp]

Do both sides need to see within each other, or would guest mode on one side work?

[Sonic007]

Do both sides need to see within each other, or would guest mode on one side work?

 

 

Guest mode would work but I have only found Guest Mode to work for Wifi connections only.

[howartp]

Guest mode would work but I have only found Guest Mode to work for Wifi connections only.

 

Ah, fair point.

[Norphy]

I think the easiest way to achieve this is to use something like this: https://www.draytek.co.uk/products/soho/vigor-2762-series-adsl-vdsl-router

 

Alternatively, if you want to be a bit more adventurous, you could buy a L3 switch of some description and set up three VLANS:

 

Data 1

Data 2

WAN

 

Put the Sky router onto a port with the WAN VLAN. Set up ACLs on the other two which block traffic from one another and set up a static route on the L3 to point at the IP address of the Sky router. It wouldn't be cheap but it'd work. The cheapest switch that I'd feel comfortable doing this with would be an HP 2930F which is a snip at a mere £500. It might also work with their OfficeConnect line, the 1920S is about £130 but it doesn't have the same level of features. However, it would probably have enough with up to 32 VLANs, static routes and ACL support.

Edited January 16, 2019 by Norphy

[Sonic007]

I wondered if this would do it:

 

https://www.amazon.co.uk/dp/B00GZNAHOA/ref=cm_sw_r_sms_awdb_t1_sz3pCbMD8N6WK

[Norphy]

No because it’s only L2. If you want to keep your sky router, whatever switch you use will have to do some kind of routing as well so you need L3.

 

If you want Netgear, looking at their website the M4100 series might do the job.

[Sonic007]

No because it’s only L2. If you want to keep your sky router, whatever switch you use will have to do some kind of routing as well so you need L3.

 

If you want Netgear, looking at their website the M4100 series might do the job.

 

So it HAS to be layer 3?

A layer2 with Layer 3-based prioritization, Layer three static routing wouldn't work?

[msi_school]

Get a Edgerouter X ~£50 or Unifi security gateway ~£100 and set up a two network solution via the setup wizard you will be doubled NATed if your sky router will not do modem mode but this is a security plus.

[Sonic007]

Get a Edgerouter X ~£50 or Unifi security gateway ~£100 and set up a two network solution via the setup wizard you will be doubled NATed if your sky router will not do modem mode but this is a security plus.

 

The Unifi Security Gateway sounds like a good idea

[Sonic007]

Could I still use the Sky QHub for Wifi, plug the Unifi Gateway into the Sky QHubs Lan port, turn off DHCP on the Unifi Gateway so that it gets it's address directly from the Sky QHub.

Would the Unifi Gateway then still manage DHCP for it's own LAN ports?

 

Thankyou for your help.

[msi_school]

You will have three separate networks segregated by ACLs on the gateway.

 

1st network every thing attached to the sky router DCHPed by the sky router

2nd network every thing in LAN one on the Unfi gate way DHCPed by the gateway

3rd network every thing in LAN two on the Unifi gateway DHCPed byt he gateway

 

You can use the sky router for WiFi but it will not be able to communicate with the other 2 networks

[Sonic007]

You will have three separate networks segregated by ACLs on the gateway.

 

1st network every thing attached to the sky router DCHPed by the sky router

2nd network every thing in LAN one on the Unfi gate way DHCPed by the gateway

3rd network every thing in LAN two on the Unifi gateway DHCPed byt he gateway

 

You can use the sky router for WiFi but it will not be able to communicate with the other 2 networks

 

 

That sounds fine. Fits my situation perfectly. Thankyou.

[Sonic007]

I thought I'd ressurect this as I've been thinking about it.

 

If I get a Ubuiquiti Security Gateway to split into 2 lans, Im going to have to add additional switches to each port as there arent enough ports.

 

What is the best menthod to use? Actually using seperate LANs as above or would a switch with vlan capability be better so I can have more ports, and instead of keeping the ports separated by separate LANS, having separate (cant see eachother) VLAN's on the switch all in all giving me more ports.

Edited March 8, 2019 by Sonic007

[Prevention]

I'd recommend getting yourself a little MirkoTik Router they are cheap and you have really unlimited options with them.

[msi_school]

Get a couple of cheap switches and use one for each VLAN it is not an elegant solution but it is much cheaper than VLAN aware switches

[Sonic007]

So Im about to purchase one of these...

 

Which would you go for?

 

- Ubiquiti Networks Security Gateway that has two lan ports.

 

- UBIQUITI Networks EdgeRouter 5 Ports

 

Im wondering which one would be best.

 

Thankyou.

[msi_school]

I use a Edgerouter X which I have set up following Mike Pott's guide. This is a more complex set up with one port for WAN, two for trusted devices one for untrusted devices and one which is a seperate internet connection, I don't have a USG so I have no first hand experience but its spec sheet says it can do VLANS.

 

I went for the edgerouter because its was cheaper.

[Sonic007]

I use a Edgerouter X which I have set up following Mike Pott's guide. This is a more complex set up with one port for WAN, two for trusted devices one for untrusted devices and one which is a seperate internet connection, I don't have a USG so I have no first hand experience but its spec sheet says it can do VLANS.

 

I went for the edgerouter because its was cheaper.

 

Thankyou for your reply.

I'm being swayed to the Edgerouter too.Cheaper and has more or less the same software running on it.

And you get more ports.

[mavhc]

EdgeOS is based on VyOS, which is open source

[BroganOs]

I bought a USG because it worked with the unifi controller and it looked really easy flexible. But I replaced it with an edgerouter X within a week.

 

The edgerouter is much more configurable using both the GUI and the command line. Whereas with the usg you have to edit json files if you want to go beyond what’s on the GUI.

[Mr_Jiminy]

Don't forget Sky Broadband uses MPoA not PPPoE, so you might need to do some work in the Unifi custom JSON (if you procure the USG that is). Edited April 4, 2019 by Mr_Jiminy