How would you do this? (Isolated Secondary Network - diagram in post)

[dp2k]

Hi SNB,

I am looking for advice how to correctly create a secondary network that allows internet access, but denies access to the primary network IP's. Ideally the guest network would allow it to also see only it's own devices, so files can be shared etc. The secondary network needs both WiFi and network ports so the Asus WiFi guest Network option is not useful in this case.

I'm sure this is common, and through the forums, see details of VPN's etc, but also conflicting views about whether that is correct. If this is correct, I would appreciate advice on how to do it, as I ran into problems trying! ISP doesn't allow multiple PPPOE and I need to use VID=10 in the IPTV page if that has any bearing on the solution.

Main router is AC68U and the rest are AC66U's. They are stock FW but I can flash Merlin if needed to do this.

All advice welcome and thanks for reading.

 

[ColinTaylor]

This is fairly straight forward. Put the guest router is in "router mode" to create a separate subnet. Then use the Network Services Filter on it to block access to the 10.0.0.x network (only clients on the guest subnet are blocked, not the guest router itself).

 

[dp2k]

Worked perfectly! Thanks for the great help Colin.

 

[fisherman]

I'm interested to try this myself, but am confused as to what the filter looks like. Can you provide a screenshot of your filter dp2k???