Separate Networks for MTR/STR Guests - WiFi + LAN Protection and Internet Security

[Pierre E.]

This is both to share what I have found so far, and ask for additional ideas/feedback.  Basically trying to figure out the best way to have two completely separate internet networks on a property including the wired ethernet networks.

SCENARIO: Why look into this? 
Good internet service is important for STR and especially MTR guests, including not just wireless but wired ethernet LAN access for some remote workers. Wired is faster, more reliable, more secure and sometimes required and may be an added bonus, but harder to create two SSIDs for.

At the OTHER end, when renting to STR /MTR guests, there may be devices that either provide security, safety, functionality to your furnished rental that you don't want guests accidentally or intentionally disabling or damaging or using,  ie IoT devices, cameras, etc.   Also, there have been reports of guests using internet for not so good activity (1) ie piracy, copyrighted material etc, and there may be other reasons as well ie if you have a duplex,  etc to have separate total LAN. 

One other thing, is if you actually still live on the property, this becomes even MORE important for you. 

       How to Create Two Completely Separate Walled of Networks?    .
(and not just two wireless network ID's)


So far this is all I have come across

A) - Use a second router (Double NAT issue), set up a second router with its own network ID, and connect wireless and ethernet devices through this.  -  Upside:  fastest, less expensive way to do this.  Downside: Double NAT (2) will likely occur, which can be a problem for some guests esp gamers or remote workers that will have specific internet issues with port forwarding.  - One way to avoid this is to put your maintenance/general devices on the second router since they are less likely to care about double NAT than a guest.  Bridge mode is an option but kinda defeats the purpose of creating a separate network 

B) Create subnets (Advanced Method) -  There's a way to actually create subnets (3) , I dont fully understand it, but its not impossible even for a non IT pro... but this probably takes some time, and not sure if that is something that would need to be redone over time or if network resets are needed. Goal to maximize customer experience, minimize calls for internet issues, and optimize security and device separation so not sure if this would make fixing internet issues less streamlined and more of a headache

C)  Purchase another internet account -  (Simple Costly Method)-  ask your ISP to run another service line into the house and provide another ISP public address and line that you connect a second router to. All of these above methods will involve additional routers but depends on how those routers are used.  This method prevents double NAT and network interference, but allows separate ethernet wired networks to exist to isolate the property devices from the guests. It just happens to cost more. May or may not be worth it depending on your guest type, cashflow, and personal needs (ie if you also live on the property). 

Any other ideas, suggestions or comments?  I hope this helped someone, I have seen a few searches on this, but not a lot of clear answers on options and issues.  I also hope someone can help me if there are other options, or someone has experience with this???

1) - This is how I have Wifi set up for guests  Answered!   ‎26-12-2018 07:51 AM  - https://community.withairbnb.c...
2) - What is Double NAT?  Toasty Answers  - Youtube   (Good explanation)
3) -  let’s subnet your home network // You SUCK at subnetting // EP 6  - NetworkChuck - Youtube

[Ken Boone]

So for an STR, this is typically too much effort for the typical person. I am an IT consultant by trade and have been for decades and I don't go through this with my STRs. You have to weigh the risk/benefit ratio and to me there is not enough risk for me to provide network separation between the guest using internet and my wifi thermostat, ring camera, streaming TVs. They are all password protected and I just don't feel like there is a huge risk with the guest jacking something up through the network. Keep it simple. They would have to figure out my password and most people just are not gonna be able to do that. Again, I said MOST.

Now having said all that, if my STR was attached to my house where I lived, I would absolutely have firewall separation where there would be no way they could reach my house network from the network at the STR. Too much to protect at my personal house from a network perspective. Not so much with my stand alone STRs.

Also, just adding subnets does not help unless there is firewall separation between the subnets.