Mesh Solution with working Guest Network

[absolutepitch828]

I think it's abit confusing but here's what I understand.

AP Isolation Feature turned on = everything connected to wifi on AP is not able to access main network (asus one can separately choose 2.4ghz or 5ghz to isolate).

Guest Network = only devices on guest SSID cannot access main network.

they are separate features to me (well at least on my Asus APs, they are separate features i can choose. of which both also don't work for me. hahaha).

So far there some clarity as below.

Can do guest network properly in both (Router + Satellite Mode) & AP mode:
Deco M4
Lyra Trio (well, confidence level not very high that this is fact. but nobody complains its broken)

Router + Satellite mesh devices that can do guest network properly:
Orbi Pro
Orbi normal (some say can some say cannot)

 

[xiaofan]

I think it's abit confusing but here's what I understand.

AP Isolation Feature turned on = everything connected to wifi on AP is not able to access main network (asus one can separately choose 2.4ghz or 5ghz to isolate).

Guest Network = only devices on guest SSID cannot access main network.

they are separate features to me (well at least on my Asus APs, they are separate features i can choose. of which both also don't work for me. hahaha).

So far there some clarity as below.

Can do guest network properly in both (Router + Satellite Mode) & AP mode:
Deco M4
Lyra Trio (well, confidence level not very high that this is fact. but nobody complains its broken)

Router + Satellite mesh devices that can do guest network properly:
Orbi Pro
Orbi normal (some say can some say cannot)

Good summary.

Guest Network = only devices on guest SSID cannot access main network.

I think consumer routers usually can do guest network.

Linksys definition of AP Isolation
https://www.linksys.com/us/support-article?articleNum=135098

The AP Isolation is a feature of wireless routers that enables you to create a separate virtual network for each wireless client that is connected to a network name or SSID. When this feature is enabled, all wireless devices in the network will not be able to communicate with each other, preventing unwanted hacking.

Enabling the AP Isolation is advisable if you have many guests who frequently connect to your wireless network. To know how to enable this feature, follow the steps below.

 

[xiaofan]

Linksys definition of AP Isolation
https://www.linksys.com/us/support-article?articleNum=135098

The AP Isolation is a feature of wireless routers that enables you to create a separate virtual network for each wireless client that is connected to a network name or SSID. When this feature is enabled, all wireless devices in the network will not be able to communicate with each other, preventing unwanted hacking.

Enabling the AP Isolation is advisable if you have many guests who frequently connect to your wireless network. To know how to enable this feature, follow the steps below.

Interestingly, I just got to know from Google that my six year old Linksys WRT1900AC main router can do AP Isolation.

The page is not exposed. But change home.html to advanced-wireless.html and the settings will be exposed. I can either isolate 2.4GHz wireless or 5GHz wireless. Interesting.

It can do guest network with a separate SSID as well.

Ref: Linksys hidden page for AP Isolation and many other advanced wireless features.

https://community.linksys.com/t5/Wireless-Routers/WRT1900AC-and-Chromecast/m-p/1018593

 

[xiaofan]

So far there some clarity as below.

Can do guest network properly in both (Router + Satellite Mode) & AP mode:
Deco M4
Lyra Trio (well, confidence level not very high that this is fact. but nobody complains its broken)

Router + Satellite mesh devices that can do guest network properly:
Orbi Pro
Orbi normal (some say can some say cannot)

From what I read, Orbi Guest Network also works in AP mode, even though some FW versions may have isolation problem.

https://community.netgear.com/t5/Orbi/Guest-network-in-AP-Mode/td-p/1592645

Same for Linksys Velop which should work but again some FW version may mess it up.

Asus Lyra should work as well but not in AIMesh mode.

All in all, all these major vendor's dedicated consumer Mesh solution will have working Guest Network features, but here and there they may mess up the isolation with some FW versions. And the level of isolation and security may not be as good as the AP Isolation feature of business grade routers.

 

[Apparatus]

Re

From what I read, Orbi Guest Network also works in AP mode, even though some FW versions may have isolation problem.

https://community.netgear.com/t5/Orbi/Guest-network-in-AP-Mode/td-p/1592645

Same for Linksys Velop which should work but again some FW version may mess it up.

Asus Lyra should work as well but not in AIMesh mode.

All in all, all these major vendor's dedicated consumer Mesh solution will have working Guest Network features, but here and there they may mess up the isolation with some FW versions. And the level of isolation and security may not be as good as the AP Isolation feature of business grade routers.

Common sense mah. How can consumer routers be better than the more expensive enterprise routers.

 

[xiaofan]

Common sense mah. How can consumer routers be better than the more expensive enterprise routers.

Haha, you are of course right.

Edit to add: but then some consumer grade routers do support AP isolation as mentioned in the following article quoted before. My Linksys WRT1900AC supports it. Linksys EA9500 also supports it. Some routers from Netgear also support AP isolation.
https://www.howtogeek.com/179089/lo...-with-your-routers-wireless-isolation-option/

Then again, you are still correct, I believe the AP isolation support in these consumer routers will not be as robust or as feature rich as those higher end business routers.

 

[xiaofan]

Some learnings from what I read and tested.

Guest network: separate SSID. Devices connected will not be able to access the wired device or the main SSID. Devices connected to the same guest network can communicate with each other. And you may be able to use ipscanner to scan the main network (I tried using nmap on my phone). Good enough for home use but less secured.

AP Isolation: device connected to the AP can not communicate to the main network. Device connected to this AP can not even communicate with each other. Only downstream or upstream activities are allowed (eg: internet access). This provides an extra layer of security. AP isolation may prevent devices like Google Chromecast from working.

In the home environment, I think guest network is good enough. Why some consumer grade routers also provide AP isolation feature? Because they could be used for small business as well.

Ref:
https://www.microcenter.com/tech_ce...t-does-the-ap-isolation-setting-on-routers-do

 

[Apparatus]

RE

Some learnings from what I read and tested.

Guest network: separate SSID. Devices connected will not be able to access the wired device or the main SSID. Devices connected to the same guest network can communicate with each other. And you may be able to use ipscanner to scan the main network (I tried using nmap on my phone). Good enough for home use but less secured.

AP Isolation: device connected to the AP can not communicate to the main network. Device connected to this AP can not even communicate with each other. Only downstream or upstream activities are allowed (eg: internet access). This provides an extra layer of security. AP isolation may prevent devices like Google Chromecast from working.

In the home environment, I think guest network is good enough. Why some consumer grade routers also provide AP isolation feature? Because they could be used for small business as well.

Ref:
https://www.microcenter.com/tech_ce...t-does-the-ap-isolation-setting-on-routers-do

More on Guest Network

Guest can/cannot see each other on the Guest network depends on whether such a feature is available.

Guest can/cannot access the main wifi network also depends on whether such a feature is available. The XT8 by ASUS only has this feature known as "Access Intranet" ie. if enabled it allows the guest to access your main wifi network or private LAN

Read more here

https://www.computerworld.com/artic...-to-share-a-look-at-guest-wi-fi-networks.html

 

[xiaofan]

More on Guest Network

Guest can/cannot see each other on the Guest network depends on whether such a feature is available.

Guest can/cannot access the main wifi network also depends on whether such a feature is available. The XT8 by ASUS only has this feature known as "Access Intranet" ie. if enabled it allows the guest to access your main wifi network or private LAN

Read more here

https://www.computerworld.com/artic...-to-share-a-look-at-guest-wi-fi-networks.html

I see. Thanks a lot for the add-on. Looks like there are many different implementation and naming convention for these kind of options.

I just googled a bit and certain router like Google can actually specify which device on the main network to share to the guest.

Then I read there are hacks to the guest network so it is better to enable guest network when needed and then disable the feature after use.

https://www.hardwarezone.com.sg/tech-news-guest-networks-routers-are-not-safe

 

[Apparatus]

Re

I see. Thanks a lot for the add-on. Looks like there are many different implementation and naming convention for these kind of options.

I just googled a bit and certain router like Google can actually specify which device on the main network to share to the guest.

Then I read there are hacks to the guest network so it is better to enable guest network when needed and then disable the feature after use.

https://www.hardwarezone.com.sg/tech-news-guest-networks-routers-are-not-safe

According to the article it's best to set Guest network on a separate router which means you need to own another line from the ISP. Pay for an additional line and you get it lor

Guest network in ASUS XT8 comes with authentication security protocol. Just set to WPA-2 Personal with AES should be safe enough.

 

[absolutepitch828]

According to the article it's best to set Guest network on a separate router which means you need to own another line from the ISP. Pay for an additional line and you get it lor

Guest network in ASUS XT8 comes with authentication security protocol. Just set to WPA-2 Personal with AES should be safe enough.

While one might argue that full AP Isolation is an "Enterprise Feature".

It does not explain why there are APs that still have a "Guest Network" feature page that doesn't work as intended. Turn the entire page off! don't false advertise! ALL ASUS APs ARE LIKE THAT.

I found out the hard way one day when one of my guests chromecasted onto my screen right infront of me. I was like WTF.

Some of the user horror stories are quite interesting. Small biz with deployment in 30 locations discovering their network is compromised etc:
https://community.netgear.com/t5/Or...k-does-not-really-isolate-guests/td-p/1221867

 

[Apparatus]

Re

While one might argue that full AP Isolation is an "Enterprise Feature".

It does not explain why there are APs that still have a "Guest Network" feature page that doesn't work as intended. Turn the entire page off! don't false advertise! ALL ASUS APs ARE LIKE THAT.

I found out the hard way one day when one of my guests chromecasted onto my screen right infront of me. I was like WTF.

Some of the user horror stories are quite interesting. Small biz with deployment in 30 locations discovering their network is compromised etc:
https://community.netgear.com/t5/Or...k-does-not-really-isolate-guests/td-p/1221867

It's nothing unusal. Issues will be discussed on forums, message boards etc

All devices have their features. Just thst some features may not be properly implemented. Feedback to the vendor and, hopefully, wait for a new firmware update.

 

[absolutepitch828]

It's nothing unusal. Issues will be discussed on forums, message boards etc

All devices have their features. Just thst some features may not be properly implemented. Feedback to the vendor and, hopefully, wait for a new firmware update.

ah yes, that's why I'll probably never ever buy another asus router.
I do like their AIMesh idea though. quite brilliant.