How create network with separate domotica/multimedia internetaccess

[bhennink]

I currently have a ziggo modem and a Asus AC86 router with intranet , guest wireless and Domotica wireless access. For most of the things this works, but I would like access to devices from my intranet PC to some of the domotica devices. (Not the other way around)
I found out that this is not possible. with this config, this seems to be by design.

Now I am thinking of re-arranging the network with extra routers

I have quite some devices in the network and I do not want to allow all device acess to the intranet.
Also I need to access my Smartlight bridges from the intra net and that is where I fail with the current guest network setup.
So I am now thingking of something like this, configuration.

Can I make this work such that:
The PC's can reach devices in the guest network and the storate on router1
And also that all the devices can reach internet and the shared strorage, but non of the devices on router2
I This there will be 3 network adres ranges like,
Router1 is connected to the modem via 192.168.1.0
192.168.1.x for the devices on router1
192.168.2.x for the devices on router3
192.168.3.x for the devices on router3
could I still play the music that I have on myy PC via the chromecast devices?

 

[L&LD]

Image is not showing.

 

[bhennink]

@L&LD Hmm I hope now, In my preview I could see the image:S

 

[L&LD]

@L&LD Hmm I hope now, In my preview I could see the image:S

No, still not showing.

 

[bhennink]

@L&LD
Sorry I need to find an other way to add the image:S
I thought I could share from google drive but although I see the image it gets lost for others. I will try tomorrow.
but at least I try it in text.
I think of this setup as the easiest I hope:
Ihave my cable modem and connected to this a router1
At port1 of the router1 a 2nd router2 which will form the protected intranet (and here I can use a VPN for all internet traffic)
At port 2 of the router1 there could be a switch for all those domotica/iot stuff
At port3 of router1 my home alarm
At port4 of router1 there could be some storage for multimedia stuff which would be available to anyone?

1. Will this work? and how do I prevent dual NAT in such a setup?
2. Would there be isolation from the IOT devices to the intranet?
3. Am I correct that the intranet devices can reacht the IOT devices?
4. would it be possible to allow only 1 or a few devices (Example chromecast) from the IOT part acces to only on PC on the intranet . What should I configure for this?

I hope this is clear?

I could do this without any cost as I have a spare router available

 

[bhennink]

I was on vacation.
Now I am back I would like to get this working properly.
For some reason I do not get the image visible.
So now I added the link https://mrbert.stackstorage.com/s/veQovYLyO2Ur3uY
I hope this will work

Is the above confuguration a good solutionorshoul I use a 3 router solution?
How could I avoid double NAT probems in this arrangement?