SearchSuomeksi. Lue tämä sivu suomeksi
Menu
Independent publication. Nothing to sell.What to do if you shared information or already made a payment.

Second router

A second router puts computers and phones inside its own firewall. Smart devices remain on the first router's network, outside the new router.

It is still worth trying a guest network first. It is free and it does the same thing for most people.

Network design diagram

Internet
First router
Outer device networkCamera, bulb and television
Second router and firewall
Home networkComputer and phone
  • AllowedBoth networks can start connections to the internet.
  • AllowedThe home network can start a connection to the outer device network.
  • BlockedThe device network cannot start a new connection to the inner home network.
The second router’s stateful firewall protects the inner home network. The boundary works only in router mode.

How the boundary between two routers works

Router mode gives devices on the inside private IPv4 addresses and uses NAT for their traffic. Source Address translation alone is not the whole protection.

For IPv6 traffic, a stateful firewall creates the boundary: replies to connections started inside are allowed, while new connections from outside are blocked. Source Confirm the same principle in both the IPv4 and IPv6 settings.

A computer may start a connection to the outer device network when local control requires it. A smart device must not be able to start a new connection to the inner home network.

What to get

Choose a router that still receives updates and has a separate internet port. A brand name or a high price does not replace either requirement.

Ask the seller the same question you would ask about any device: how long is this updated for?

Connect the second router

Setup progress

0 / 5 done

  1. Power on the new router and open its admin page

    Do not connect it to the old router yet. Connect one computer or phone to the new router’s default network, then open the admin page as its instructions describe.

    It may also be called: Hallinta (management), Admin, Setup

    The admin address and first password are usually on the router label or in its instructions.

  2. Set the operating mode to router

    Select router mode and confirm that the firewall is active for both IPv4 and IPv6 traffic. Do not use access-point or bridge mode because they do not separate the two networks.

    It may also be called: Reititintila (router mode), Router mode, NAT mode

    If there is no such setting, check whether the device works as a router by default.

  3. Give the new router a different address range

    If the first router's LAN address is 192.168.1.1, set the second one's LAN address to 192.168.20.1 for instance. It should give devices addresses beginning with 192.168.20.

    It may also be called: LAN-asetukset (LAN settings), Reitittimen IP-osoite (router IP address), DHCP-alue (DHCP range)

    The symptom of the wrong setting: devices get a network connection, but some pages will not open, or the connection drops for no reason.

  4. Give the new home network its own name and password, then save

    Give the first router’s device network and the new router’s home network different names and passwords. Save the settings before connecting the two routers.

    It may also be called: SSID, Verkon nimi (network name)

  5. Connect the routers, then move computers and phones

    Connect a numbered LAN port on the first router to the new router's internet port. Connect computers and phones to the new network. Cameras, bulbs and other smart devices stay on the first network.

    It may also be called: WAN, Internet, Ulkoverkko (external network)

    If the new device has no separate internet port, check whether its instructions say it can work as a router.

Test the boundary from both sides

Check the address range and operating mode

The routers must use different address ranges. The second device must also work as a router, not as an access point or bridge.

Symptom: devices get a network connection, but some pages will not open, the connection drops at random, or the router admin page opens on the wrong device.

Fix: change the second router's address range to a different start. If the first one is 192.168.1.1, set the second to 192.168.20.1 for instance.

What this does not protect against

It does not stop a device from sending data to the internet. Outbound traffic from the device network still passes through.

It does not fix the device's own faults. An unpatched camera is an unpatched camera on its own network too.

It does not isolate the networks in access-point or bridge mode. The second device's firewall applies only in router mode.

It does not isolate smart devices from one another on the outer network. Use client isolation on the first router only when those devices do not need to communicate.

Checked