What is the best way to enable my two routers (total of five Wi-Fi networks)?

puppychumful

I live in in a big house in an isolated rural location. I have a TP Link AC4000 (two guest networks one @ 2.4 GHz & one @ 5Hz) and a Asus RT-AC68U (one guest network @ either 2.4GHz or 5GHz). That should give me a total of five separate SSID's, right?

As of now, I am only using my Asus RT-AC68U, with one of networks dedicated to my me and my wife, and the other for my basement suite tenant. Everything works really well and has for some years, and AFAICT there are no security, bandwidth, interference issues. I want to add some home security Wi-Fi cameras (and maybe smart plugs) and I want to further isolate my computers from my wife and tenant for increased Internet security. Here is how I was thinking of doing it:

Asus RT-AC68U
1. Basement suite tenant: main network
2. Wi-Fi cameras (and maybe smart plugs): guest network

TP Link AC4000
1. My computers: main network
2. Wife's computers: guest network #1
3. Business computers: guest network #2

Is this the best way to configure everything, will I have interference between the two routers, what should I set the GHz at for each of the five networks, can I place the two routers close to each other, will I even be able to use 5GHz or is everything likely to run at 2.5 GHz only, etc?

Much obliged, and if you guys are not overly knowledgeable about router configurations, then I apologize for the intrusion, but I suspect there lurks router-ologists in theses here parts!

Liquidmantis

First, I’m assuming since you said rural that you don’t have to worry about neighbor conflicts and have the luxury of picking any channels you want.

First, Don’t use multiple SSIDs for the same networks, just use the same with different channels and you get the benefit of access point roaming, just use the same SSID and PSK on both devices. For efficiency, you also want to minimize the number of SSIDs you have on an access points due to time spent broadcasting each SSID and getting responses.

For channel planning, on your 2.4 GHz networks, just stick with 1, 6, and 11 so you don’t have overlaps.

5 GHz you don’t have to worry about channel,overlap, although they are in 20 MHz blocks, so you might want to space them in case you want to bond channels for 40/80 MHz. In my experience 5 GHz self manages though.

Although, I’m not sure how you plan to integrate two different routers with the same WAN, assuming I understand your intent. The SSID network isolation is only at the router, unless you can use VLANs for network segregation, and have the ability to assign SSIDs to VLANs.

Caveat: I wear a Networking hat often, but I’m not a WiFi guy.

[Deleted User]

@puppychumful given that you are isolated without any other WiFi signals in your area you’ll be able to run a few 2.4 GHz signals without too many issues. Positioning of the routers is going to depend on the coverage you require. 5Ghz doesn’t travel as far or as smoothly as 2.4G, but it has a better bandwidth for data so it comes down to a bit of trial and error as to what works regarding signal strength. Different building materials will have an effect especially going from inside to outside.
You have 11 bands to work with in 2.4G and if you are manually selecting them allow at least 3 bands of space between them eg 1,4,7,11. Modern WiFi Access Points are usually pretty good at setting themselves up to find a clear channel.
You’ll probably want to run the cameras on a 2.4G network depending on the distance from the router.
Overall, I would be looking at how you can minimise the number of WiFi signals you have running rather than adding to the soup, but that’s just me. IMHO cables are better, but phones don’t like cables so I understand where that becomes an issue.
I hope this gives you something to start with.

puppychumful

Hi guys,

I did not think about how I might run both the TP Link AC4000 and Asus RT-AC68U from one cable modem. Maybe I can't? My main concern is maximizing security (thus my reasoning for wanting as many SSID's as possible (or am I wrong on this?).

For example, I want there to be no chance whatsoever that my tenant (I supply the Wi-Fi for my tenant as I mentioned) could ever access my Wi-Fi SSID. I want zero chance that my tenant could ever hack into my Wi-Fi internet connection, even though we both use the same W-Fi router (I supply it).

For example, I want there to be no chance whatsoever that Wi-Fi cameras could ever be hacked to access any other my Wi-Fi SSID's. Read here that this can happen https://www.tomsguide.com/news/hackable-security-cameras

Remember, I supply Wi-Fi internet access for not only my wife and my myself, but also for the tenant. There is only one cable modem and only one Wi-Fi router the way things are set up now. My tenant will not be supplying her own Wi-Fi or internet access in any way, and I want to maximize (as much as possible) security between each of the following user conditions (as mentioned) but using only one cable modem and only one ISP account (which I pay for and administer).

Asus RT-AC68U
1. Basement suite tenant: main network
2. Wi-Fi cameras (and maybe smart plugs): guest network

TP Link AC4000
1. My computers: main network
2. Wife's computers: guest network #1
3. Business computers: guest network #2

Liquidmantis

Sounds like maybe despite name overlap, you want 5 segregated networks, not to be conflated with SSIDs. If that’s the case, since the routers are providing the security boundary, you’d need a router in front of your routers, or see about getting a second public IP for the secondary router in order to totally isolate the networks.

[Deleted User]

You would cable the tenant router off your main router. I think the TP link should be able to allow you to isolate that pretty easily from the rest of the network. Then it will be doing it's own thing. Running the cameras off the tenant router is where you are potentially going to have issues from a security and access point of view. It depends what you can configure inside the tenant router as far as VLAN and device separation goes. If you can run separate DHCP servers for each WiFi connection then this shouldn't be too difficult. I'll have a look at the manuals for those routers and let you know what I think.
IT support is my other hat....

puppychumful

Oops, please excuse my ignorance in terms of the name overlap. I idealy I’d like 5 segregated networks using existing hardware if possible and without additional IPS costs. I do not really need five segregated networks though, because things are OK with one router (Asus RT-AC68U) and two SSID’s as the tenant cannot access my computers, correct?

If by "cable the tenant..." you mean hard-wire to the tenant I can't do that easily, alas. Why would I have security issues if I use the cameras and the tenant on the Asus RT-AC68U? They use different SSID's, is that not enough? I am not even sure what a VLAN is let alone if the Asus RT-AC68U supports this, alas. Also I do not know what DHCP is sadly. I'm hoping I do not have to get too heavy into all this just to maximize security and minimize costs!

Basically, I am looking for maximum isolation such that with my existing two routers (or just using the TP Link AC4000 which has three SSID's) I can have at least three (channels? SSID’s? whatever you call them) that are safely separate enough:
The tenant
The wife and me and business
Cameras etc

I truly look forward to your thoughtful advice and much obliged!

Remember, I supply Wi-Fi internet access for everyone and everything with one cable modem and one ISP account. My tenant will not be supplying her own Wi-Fi or internet access.

[Deleted User]

OK. So had a very quick look at the manuals....with the TP Link you can have 3 guest networks, but they are band specific...so, 1 guest network for the 2.4 Ghz band and then 1 for each of the 5Ghz bands.

The easiest and most effective way to have this set up for what you are trying to achieve is to have yourself, your wife and your business on the main SSID on the Tp-link. Set up the guest network off this for your tenant. This will keep you and your tenant separated and will give you enough power to give your tenant a nice strong signal.
I would then set up the Asus as an Access Point for the cameras. The Asus would be connected to the TP-Link via an Ethernet cable (can be a short link ie next to each other). This way you would have access to your cameras and other IoT on the same network as yourself and keep your guest/tenant isolated from your main network.

Feel free to throw any questions about this. I think this would give you the easiest set up to achieve what you're trying to do.

-I'm assuming you would like easy access to your cameras from your main network.
If you wanted to isolate them further you could run them off the guest network of your ASUS AP. (You actually have 3 guest networks you can use on the Asus).

puppychumful

I am most appreciative arktek and I do have a few quick question please:

1. You mention I have 3 guest networks I can use on the Asus AP, I thought there was just one guest network @ either 2.4 GHz or 5 GHz (I guess I'll have to read the manual more carefully)?

2. I understand that the TP Link guest networks are band specific, but I thought there was just two guest networks one @ 2.4 GHz & one @ 5 GHz (I guess I'll have to read the manual more carefully)?

3. OK I'll put me, my wife and my business on the main SSID on the TP Link, and I'll set up one of the guest networks on the TP Link for my tenant, should I set it @ 2.4 GHz for best range?

4. OK, I will set up the Asus as an Access Point for the cameras, but how do I do that exactly (is it in the manual)? I understand that the Asus would be connected to the TP Link via an Ethernet cable, and yes I would like easy access to my cameras from my main network, but if the Asus is acting as an AP, how is that accomplished, and why would I not simply run the camera off the TP Link using a different SSID, given that if it’s good enough to separate the tenant, then wouldn’t it be good enough to separate the cameras?

5. If I did want to isolate the cameras further, and I ran them off the guest network of my ASUS AP, would I then be unable to access them from my main network, and thus would have to login separately each time I wanted to view them?

6. I gather the TP Link and the Asus AP can be physically fairly close together without undue concern?

Much Obliged,

The Pup

[Deleted User]

1) Asus mention in their literature and info that you can set up to 3 separate guest networks on their router - actually looks like a nice router all round.

2) You can set up 3 different SSIDs for the guest access on the TP-Link. One for each transmitter (2.4, 5 and 5) which allows you various setup configurations. You then make a separate selection over whether guests have access to the main network or just have access to the Internet. This selection looks like a blanket one for all of the guest network side.

3) I would try setting up with the 2.4Ghz network for the tenant first and see how they go. If you feel like experimenting you could try combining the 5Ghz one as well for more bandwidth by making one or both of the 5G Guest bands the same SSID as the 2.4Ghz SSID. This is a bit of a trial and error thing - depends on materials and distances etc.

4) It's pretty straight forward to set the Asus up as an Access Point. If you reset the device and set it up from scratch there is usually a set up wizard that you use and it asks you what you want to do. I would check the manual, but it should be pretty straight forward. You have the choice of Router or Access Point. Think of the Access Point as an additional transmitter for your TP-Link Router that's connected to it by and an Ethernet cable.
You should be able to make the switch up directly in the configuration page under the WAN options.

The unit will then act as an extension of your main network and the devices connected to it will be visible to you so you will be able to access the cameras directly.
I suspect you are going to need the 2.4Ghz band for the cameras so that you have adequate site coverage.

From the set up above the guest network for your tenant will already be using the 2.4Ghz band so hence why setting the Asus up for the cameras.

5) Yes, correct. You would have to log into the Guest network that the cameras were on.

6) The two of them should be OK near each other as long as they are operating on different frequency bands.

puppychumful

You have have been most kind and I thank you for your insights! One last question if I may:

You mention you like the Asus (so do I and it's been flawless for some years now). I assume you still consider the TP-Link to be the generally superior unit such that it makes the most sense for me to have the Asus as the AP and the TP-Link as the main unit?

Wish me luck when I make the changeover as I'll have to reset the Asus plus configure the TP-Link, and I'll be Internet-less during the process. I'll have to make sure all parties are not in mission critical mode so it might be a while before I do all this.

[Deleted User]

Yes, I would go with the TP-Link as your main router. It has bit of power in that beast. Hopefully it should be a quick changeover. Set up the TP-Link first before clearing the Asus. You can do all of the configuration of the TP-Link with it plugged into the Asus via Ethernet. So, everyone can still do what they're doing with minimal interruption. You can then test it and make sure it's doing what you want before the changeover. So, you won't be without Internet and can still access it for questions etc. and the changeover should have minimal impact on people's usage. Of course, if everything is working really well right now you could set the Tp-Link as an Access Point for the cameras, but that seems like a bit of a waste for the potential extra bandwidth of the TP-Link.

puppychumful

I must say you have learned your craft extremely well, and I am appreciative. Out of curiosity, why does using an AP plugged into the main router, provide more protection (from hackers etc.) as apposed to simply having the cameras access the main router via a dedicated SSID?

[Deleted User]

If you want to isolate the cameras completely from your main network you are going to have to put them on the Guest network of the Asus. The reason for using the Asus as the AP for the cameras is for the 2.4Ghz network. You mentioned you live in a large house so this band would provide better coverage.
The security problem I see with the cameras is if they are opened up for remote access via the web. How do you see yourself using the cameras? On site or remotely? If they’re just accessed from within the home network then there won’t be any issue with security. If they are going to be accessed from an app outside the property via the Internet using a dyndns or something similar then stick them on the Guest network because once they’re up and running you can use whatever app it is to access them wherever you are and they don’t need to be accessible from within the main network.

puppychumful

Thanks so much again arktek!

1. Given that the Asus will be used as an AP only, and will talk to the cameras only, why would it make any difference if I use the Asus' main network as opposed to one of the Asus' guest networks, in terms of the level of security? After all, the Asus serves no other purpose than to talk to the cameras (and perhaps some IoT).

2. Given I do not plan to regularly access the cameras remotely, and thus will be accessing them via Wi-Fi at home, wouldn't I still need to switch SSID's (at the least) in order to view the camera signal? Thus wouldn't it be about the same level of fiddling / inconvenience to have the cameras on the Asus AP main network, as opposed to having the cameras on the Asus AP guest network?

3. Correct me if I am wrong, but when I setup the Asus AP I should force it (if possible?) to sense only 2.4 GHz and not 5 GHz?

4. You mention that the reason for using the Asus as the AP for the cameras is for the 2.4 GHz network. OK so I assume then the TP Link will be busy doing other things and thus could not provide the 2.4 GHz, but is there not additional security inherent in using the Asus as an AP dedicated to the cameras?

5. I gotta ask, how did you get so wizardy with all this stuff? I know you do it for a living but even still, damn you got your shit together; impressive!

[Deleted User]

All cool. It’s always good exercise for the synapses to problem solve network set ups.
I’ve spent a lot of time doing this and like to see these work properly and every set up has something a little unique.

So, to try and answer your questions without going through a mass of bullet points...

With the TP Link your 2 available 2.4 GHz networks are being used for yourself and for your tenant. Using the guest network here for your tenant keeps the separation you require. This is why the Asus has been tasked with camera duty.

Since you are only accessing the cameras from inside your network then putting them on the main 2.4Ghz channel of the ASUS will work great.

When the Asus is being used as an AP it becomes an extension of your network. It is essentially the same as if you connected a computer to your router via an Ethernet cable. Everything that connects to it will be visible to you on your main TP-Link network.

Because of this you will be able to see the cameras from your computer and they will show up as devices with IP addresses in the TP-Link router because the TP-Link is managing the entire network.

Just because they are connecting via a different SSID doesn’t necessarily mean that they are separated from the network. They are still utilising the same network server, but the main thing is that their data transmission will not be affecting your other WiFi networks so keeping your WiFi bandwidth free for your own uses.
I guess from a security point of view if anything weird does happen then you can simply unplug the ASUS from your network and your main network is not compromised and still functional.

Keep in mind too that if, for example, your business computers are within close range of the ASUS that you could always use one of the guest networks off that to connect them if you want the separation. Just keep in mind that they won’t be easily accessible from your main network.

When you set up the ASUS you decide which transmitters you want to have operational and what their SSIDs are during set up or in the LAN tab of the admin page.

I hope that manages to answer your questions.

🙂

puppychumful

Hi artek my friend,

Thank you very much for your thoughtful reply! I really do not know enough about such things so your input is truly appreciated. I forgot to mention I may install a NAS, but anything I put on the NAS will not be things that I care about in terms of security, simply books and music. Where should I put that, just hardwire it to the TP Link? Note that I do not have any one computer ever talk to any other computer at any time, and should I want to transfer files etc. from one computer to another, I always do so via email or copy / paste via an external drive, never through the network. I do not expect any one of my computers or my tenants to ever attack any others (I do not have file sharing etc turned on). I live in in a big house in an isolated rural location, so I do not expect Wi-Fi internet sniffing (although it could happen I guess and I am not sure I am using the right term here).

I asked this same question on Tom's Hardware (I did not know at the time who would respond and when and I have not responded back to bill001g as I do not understand it all). I got a thorough response from bill001g, in which he painted a much more dire picture of my intentions (see following). What is your view?

"Buy business grade routers that have the ability to run multiple actual networks. Having different SSID is only part of the solution. You need the different SSID assigned to different vlans especially if you plan to have multiple boxes. The traffic must be kept isolated when it flows between the devices. Then you need the main router to be able to assign different subnets to these different vlans. It also needs some form of firewall to restrict traffic between the vlans and to the internet.

I would avoid any form of wifi cameras. Cameras in general have a very bad history of security exposures. Wifi adds the ability to remotely attack them as well as jam them. Since you have to get power to the cameras anyway you might as well use PoE ethernet power cameras. Although ethernet all the way back to a central location would be better you could use the outlet you were going to plug a wifi camera with a powerline network device. This would give you network as well as a place to plug in a the PoE power injector for the camera.

You have a very serious problem if you are concerned about different machines in your house attacking each other and need to separate them. Since the any router that is separating them is also on the network it could also be attacked and could be used to then attack the other network anyway.

I guess you can let your tenant use a guest network to provide isolation but they are still sharing the internet connection bandwidth as well as the IP address so if they do something bad it still comes back to you. Unless you security cameras actually need access to the internet I would manually assign them IP addresses and leave the gateway IP blank or put in some invlaid value. This way they cameras do not know how to get out of your network so they can not communicate with anything outside your local lan.

If you really want all the different networks look at more commercial devices, ubiquiti tends to be brand that sells stuff with more commercial features without the cost of say cisco or hp equipment. You could also consider loading third party firmware like dd-wrt or tomato but these are complex to use and setup. This though does not magically create more wifi bandwidth everything will still compete with each other and all your neighbors for the wifi bandwidth."

[Deleted User]

Hi @puppychumful I would keep things as simple as possible. You've obviously got a decent relationship going with your tenant and have been sharing the same connection for some time without issues. I understand what that individual is saying, but I don't think you need to overthink it too hard.
Yes, the NAS would sit on the TP-Link, it could just plug into the ASUS as well and it would give you the same result.

bill001g's discussion of VLANs is correct if you feel you really need to seperate everyone from everyone else. It can potentially help with traffic management too. This would require you to completely change out the routers you are using or change the firmware which is something you only want to do if you feel comfortable working at that level. As I mentioned previously different SSIDs don't necessarily correspond to different networks, but the Guest network will stay separate from your main network and it looks like this is what your main requirement is.
Personally I would cable everything, but that's just me and I understand that this would be a lot of work and maybe impractical as well.

While we're on the subject - how are you planning to power the cameras and what is the purpose of having them?
I don't like those powerlines network devices, IMHO they're not as reliable in real world use as one would prefer and they are dependant on how your house wiring is set up. I think that setting up the cameras to not be able to access the Internet is a good idea.

puppychumful

Obliged as always arktek, and from what I can glean of bill001g's perspectives, he's certainly not wrong-headed (quite the contrary in fact!) but likely more than I am able to pursue with any ease (as you mention).

I am planning to power the cameras via the closest 120 V duplex receptacle using the included AC adapters. The purpose of having the cameras is to distribute them throughout the house, so that at any time I can view my studio, shop, office, etc. should my dog alert me to intruders. Possibly to do so remotely if I am holidays, but you've mentioned the risks in doing so. There have been a number of break-ins in my area despite (or maybe because of) the isolation, and the cameras could help keep me and my wife and my tenant safer.

I have no experience with power line network devices, but I can comment on how my house wiring is set up (properly according to the Canadian Electrical Code). I already have have four Wi-Fi cameras (TRENDnet TV-IP751WIC) so I'm not likely to want any more. On the other hand, those cameras are getting pretty old I guess, and new ones are not expensive and might do more and be more secure.

[Deleted User]

I just realised that the power line network devices might be a little impractical anyway because they usually work in pairs which would mean you would need a huge amount of power points at the router to even have half a chance to get them working. So, yep it looks like WIFi for the cameras is the way for you to go - as long as the firmware for those cameras is up to date. I had a look at the company website and I noticed that they don't make WiFi cameras anymore, they're all POE and that the cloud service that the cameras you have use for remote access has been discontinued as of Dec 31. So, that might be something to think about too.

puppychumful

Excuse my ignorance arktek!

1. Do you mean to suggest that if the firmware is not current on the cameras, that they would be less secure, even if I was to use them in-house only?

2. If I want to use the cameras remotely, can I not run the Asus AP as a VPN with equivalent security as if I was in-house?

3. Or does viewing the cameras removing via VPN always mean a decreased level of security?

4. And if it does mean a decreased level of security to view the cameras remotely, what could be the results of this decreased level of security using the ASUS AP as a VPN, or whatever would be best way (maybe it’s no big deal to me)?

5. The Wyze Cam 3 is just out, and it looks like a very promising choice, if my old cameras are likely to be less secure, maybe?

[Deleted User]

The firmware was last updated in 2017 which is reasonably current, but I don't know personally if they have or had any issues security wise - that's all.
In general if your WiFi encryption standards are good (WPA2 etc) it should be OK. If you're planning to use your own VPN access into the network then that's even better. Using VPN opens a port or two on the network, but if you're using solid VPN standards this isn't too much of an issue. You are not using any 3rd party cloud servers and apps which is much more preferable.
Security wise you should be OK with that kind of set up.

puppychumful

You have answered all my queries and I am of course I’m in your debt. I wish you fair sailing as we navigate the dangerous shoals of future conflicts!

SilenaAdams

Although the discussion may be a bit dated, let's dive into your router setup plan. Your idea of using the Asus RT-AC68U and TP-Link AC4000 to create separate networks for different users and purposes sounds solid.
To minimize potential interference, it's generally advisable to place the routers a reasonable distance apart. This can help reduce any signal overlap and ensure smooth network performance.
By the way, if you're concerned about potential electromagnetic fields (EMF) in your home, you might want to consider using the Safe and Sound Pro 2 EMF meter. It can help you measure and monitor electromagnetic radiation levels for added peace of mind.

puppychumful

Hi SilenaAdams,

Thanks so much for responding! I have a few questions please:

Will there be additional monthly fees from my ISP?
Will I need two separate ISP accounts?
Will I need two separate cable modems?
Will there be potential Wi-Fi interference between the Asus RT-AC68U and PT-Link AC4000, especially considering they would be in the same Wi-Fi cabinet?

It certainly would be nice to have my internet access as separate and secure as possible from my basement suite tenant’s internet access, but if there are increased monthly costs in doing so, I’d prefer to just use my tri-band TP Link AC4000 by itself, for everything, i.e. one Wi-Fi SSID for tenant network and two Wi-Fi SSID networks for me.

Unless there is no way to ensure that my computers can be reasonably secure from my tenant’s computers by using my tri-band TP Link AC4000 by itself?