How isolated are guest networks in the ASUS RT-AC57U V3 router?

[onion]

I have a single ASUS RT-AC57U V3 router with stock, up-to-date firmware. My router is running in wireless router mode.

I currently have a single 2.4Ghz main network and two 2.4Ghz guest networks (slots #1 and #2). Guest networks cannot access the intranet. AP isolation is disabled.

What I want to achieve is to use my main network for my personal devices (phone, laptop, etc), use #1 guest network for guests and #2 guest network for work laptop. I want all of these networks to be isolated from each other.

Is my current setup enough for this? Is my work laptop on guest network #2 isolated from devices in guest network #1 and my main network? If yes, what kind of isolation is it?

 

[bennor]

Is my current setup enough for this? Is my work laptop on guest network #2 isolated from devices in guest network #1 and my main network? If yes, what kind of isolation is it?

Yes your current configuration of enabled guest networks should be isolated from the main LAN, provided you have Access Intranet disabled on the Asus router Guest Network settings page. Having multiple Guest Networks should be isolated from each other as well.

[Wireless Router] How to set up Guest Network on ASUS Router? | Official Support | ASUS Global

 

[onion]

Yes your current configuration of enabled guest networks should be isolated from the main LAN, provided you have Access Intranet disabled on the Asus router Guest Network settings page. Having multiple Guest Networks should be isolated from each other as well.

[Wireless Router] How to set up Guest Network on ASUS Router? | Official Support | ASUS Global

Thank you for a swift response.

I find it a bit confusing that even though there are three networks (main, guest #1 and guest #2) there are only two subnets. How is isolation implemented if, for example, guest network #2 and the main network share the same subnet? How can I test this? Is a simple ping sufficient?

 

[bennor]

Isolation is likely done through the use of IPTables within the router firmware. In any case you can test a variety of ways including simply trying to ping the clients. Note that some clients will reject ping requests so you need to ensure they'll respond to pings. Or use a network or IP scanner to scan the local network for clients to see what responds.

 

[onion]

I wonder just how stringent those rules are.

Let’s say you have a guest A on guest network #1 and a guest B on guest network #2. Assume that guest B has some internal network interfaces and some services that are bound to those internal IP addresses (172…).

Can guest A create a routing rule that routes packets intended for 172… addresses over guest B as a gateway? Can firewall rules that isolate guest networks #1 and #2 prevent it?