I have two routers in my home. One is connected directly to the cable modem and provides the DHCP. The other is connected to the first via an ethernet cable (with DHCP turned off) so that I can get WiFi signal at the other end of my home.

Is there any way to configure my routers so that I have two entirely separate subnets that cannot communicate with each other? I'd like to be able to freely give out the password to one of the routers (call it welcome) but I don't want to expose my private network (call it keepout) with my precious workstation and various insecure appliances to any malicious folks who might connect to the welcome network.

Can this be done with off-the-shelf consumer routers? I installed dd-wrt on the main router.

I have a Belkin that offers a guest "network" that is isolated from the rest of my 192.168 subnet. Anyone can connect but require a password to be connected to the internet - don't know how they do it, never used it, but it's there "out-of-the-box".

My Belkin also offers a separate guest network. I think it's a fairly common option on many home routers these days.

This should help: http://www.tomshardware.com/answers/...m-routers.html

This article offers some pointers on what to look for and what to avoid in routers with "guest modes": http://www.howtogeek.com/219808/warn...80%99t-secure/

1 members found this post helpful.

Sort of wondering what 'guest network' means in more detail. It also occurs to me that I'm unsure how computers' response to network topology might affect security. E.g., If a single network operating DHCP delegates 192.168.1.3 to my computer and 192.168.0.23 to some other computer, what sort of visibility do these two machines have to each other? My guess is that they might obviously communicate with each other using their ip addresses, regardless of what IP address they might have -- or maybe not...maybe the Bcast and Mask settings preclude this communication? I realize this could be an extensive discussion so let me express that my goal is to utterly isolate the two networks to prevent any communication at all between them..

I read this article and it does not describe the setup I'm after. It describes the setup I have now:
Router #1 is connected to the cable modem, operating DHCP
Router #2 is connected via LAN port with a long cable to Router #1. Router #2 has its DHCP function turned off.

The result is that all computers on the network can connect and share files. Windows computers "see" each other. Macs see the apple TV and vice-versa. The devices are not isolated.

Reading this article. Looks pretty good.