wired router replacement and LAN configuration suggestions

[db9]

Some background.. over the years I have run a simple home LAN using Tomato and now Merlin on my router behind the ISP supplied unit that I have put into bridged mode.
My current configuration has a RT-N16 (Merlin - WiFi turned off), connected to a switch that supplies hard line connections and connects to a AC-66U B1 (Merlin) that I use for 2.4 and 5 Hz WiFi (guest turned off)

As the number and type of devices that we now have in the home has dramatically increased (adult children back at home for the short term) I'm looking for suggestions..

First while I am reasonably technically competent I am not a network "expert" by any means so my terminology may be incorrect.. But not afraid to learn.

We are on a 300 Mbps service

The RT-N16 (Merlin)..

1) I like its form factor (rectangular box with aerials removed) and currently only serves as the DHCP server and use of its network ports. Based upon what is suggested for LAN configuration can this unit continue as the front end for the foreseeable future?
2) In the case of a hardware failure what would be a suitable selection?

LAN structure..

Connected devices..

5 cell phones (Samsung & iPhone)
2 smart TV's
1 X-Box
3 Macbook's
1 iPAD
2 Synology NAS box's (Data backup) one online and the second used as an off line backup
1 RPi
1 printer
2 Amazon Firesticks
1 workstation #1 - gaming PC
1 workstation #2 - my personal CAD/Maker workstation
1 workstation #3 - connected to the office via VPN for my day job, this unit is admin'd by work IT. It gets a IP from my RT-N16 only.

All of this is currently connected as a mashup of wire and WiFi connected devices back to the RT-N16.

Suggestions to what should be isolated from each other and best to accomplish?

In my own mind I would want..

1) The laptops, workstations #1&2 to see the printer and occasionally I do print from my iPhone.
2) The cell phones connect to the WiFi when at home with 3 out of the 5 cell phones are always connected and used for browsing and I'm not always knowing how secure their connections are. Is there a risk of something coming back into my LAN if they connect to the local coffee shop etc.
3) I currently connect and admin the routers and the NAS boxes using my Laptop (the remaining 2 laptops are used by our children)
4) I would think that the Smart TV's, Firesticks & X-Box would just go to the "world"

Can I accomplish anything using the hardware that I have?
Should I add any specific network hardware?
Would a VLAN be suggested as a way of creating isolation (though I have never looked at using VLAN's and would need to learn how to setup)

Thank you..

 

[CaptainSTX]

Without seeing a diagram of how your network is laid out it is difficult for me at least to make a recommendations.

I don't understand why you are using two routers. Is the AC66 double NATed or is it being used as an AP? If not double NATed why two routers?

The N16's firmware may be old and not currently being upgraded so it is probably time to replace it in order to patch any security issues.

If you want to add VLANs you may need to replace your existing switch with a Smart switch if your current switch isn't smart. That will allow both port based or 802.1Q vlans.

 

[db9]

Captain,

The RT-N16 runs Merlin LTS fork (374.43_52E3j9527)

The switch is not managed and most of the ports are used to feed CAT5 connected devices at various locations within the home.

The AC66 is set as a AP running Merlin 386.3_2 - it sits within the home away from the ISP interface (ISP interface is in the basement, home is a 60's build with plaster and mesh walls) to give WiFi to devices.

I'll do my best with a sketch..

 

[CaptainSTX]

If you are satisfied with the performance of the RT N16 and you are not overly concerned with if the security is up to date, then continue to use it.

Depending on how you want to configure your VLANs you need either one smart switch or two smart switches which you then can use to configure 802.1Q VLANS.

If you go with the single smart switch and the switch is close enough to your current switch route the MOCA by connecting it to one port LAN port on the switch which could be a VLAN10 to feed WS1. Using two or more additional ports on the switch which are also set as VLAN10 connect up your WS2, WS3, NAS and printer. Then using another port setup VLAN20 to feed your AC66 and the devices attached to it. The only problem is if you need to print using the Laptop or even the cell phones they won't be able to do so when connected to the AC66s either by Ethernet or WiFi.

To be more flexible you could buy two smart switches and setup 802.1Q VLANs. The advantage is you can run multiple VLANs over a single cable between the two switches. If this is the way you decide to go you would be in a better position to segregate your more secure devices from less secure devices.

*The VLAN numbers I used were just to help clarify the setup. With a five port smart switch you could have up to four VLANs of either type. With an eight port switch up to seven VLANs. The VLAN numbers assigned would be up to you.

 

[db9]

Captain,

Thank you for your response..
I will look into setting up VLANS as well as sourcing a smart switch or 2.
I could isolate some of the WiFi traffic by utilizing the "guest" function (?)
Suggestions for a update for the RT-N16? Just run a more current router (probably another Asus) or would a good route be something like a MikroTik?

Cheers..

 

[CaptainSTX]

A guest network will give you some isolation running on the N16 or other router connected directly to the WWW. If you set it up on what is just an AP it doesn't work as the primary router has no idea if the connected device is on the regular of guest SSID. Guest networks can be propagated to APs if you are running in a MESH setup. Not sure if the AC66 can be setup as a mesh node.

As for a router I like the AC1900P. It is built on the trusty rock solid AC68 platform with a souped up processor. I have been running an AC68 as an AP for seven years with no issues. I have my son on an AC1900P and he has no complaints. The AC68 is very popular model so probably it will be supported for a few more years. If you have any AX wifi clients look at an AX58. Lots of people on the forum seem to like this router but I have no experience with it. No experience either with a MikroTik.

 

[Tech9]

As for a router I like the AC1900P

This router I like the most in my Asus routers collection. It just works always.

If you have any AX wifi clients look at an AX58.

This router is the worst in my Asus routers collection. It works only when it wants to.

Tech9

www.snbforums.com

@db9 AC66U router must be AC66U B1 model, if it runs Asuswrt-Merlin 386.3_2. Similar to AC68U hardware. If he likes the performance, one more AC66U B1 for under $100 is perhaps what is needed. Wired AiMesh with identical routers is stable, except Guest Network quirks.