We are looking at renting out the basement suit in our home and want to offer internet as part of the package. I however do not want the downstairs tennent to have access to our network (home office = private data).

We currently have a pfsense firewall as our gateway and a Windows Server 2003 box is doing our primary DHCP ( and DNS. Here's what I'd like to do...

I'd like to setup another subnet on the DHCP server (, and hook in another wireless router (as access point only) and address it as from there the router will hook into our primary switch and then out through the firewall.

Will Server 2003 (If I add a 192.168.1.x/24 IP to the nic) serve DHCP to the devices that connect to the new router, and will it isolate that from our network?

Thanks in advance... I'm very new to multiple subnets.

3 Answers 3


In order to prevent the downstairs tenants from accessing your network, you can't have two subnets on the same physical network (i.e., you want to connect the access point to your primary switch). You either need to purchase a switch that supports VLANs, so you can have two logical networks via the one physical switch, or you need to have two separate switches. The two separate switches are then connected to the firewall on separate NICs, but the firewall doesn't route between the two subnets - only between the subnets and the Internet.

With respect to DHCP, does the firewall or router/access point provide a DHCP server? If not, you can add a second NIC to your Server 2003 box, connect it to the basement switch/basement VLAN, add 192.168.1.x/24 as a new scope, and then ensure that DHCP is bound to the second NIC in addition to the first. However, your Server 2003 box is then accessible from the basement subnet, so it needs to be secured sufficiently.

Your firewall may support DHCP Relay, which could forward DHCP requests originating from the basement to the Server 2003 box and proxy those back, so that clients on the basement subnet cannot access the Server 2003 box.

  • The firewall supports VLans. But unfortunately it only has 2 nics (1 WAN and 1 LAN). Anyways.. this sounds way to complicated for a home install. I "could" just harden everything and give them access to the same subnet... that way I can limit their bandwidth through pfsense (instead of giving them their own router right off of the modem). Apr 17, 2010 at 22:10
  • it looks as thought my switch (D-LINK DGS-1016D) does not support VLAN Apr 17, 2010 at 22:12
  • Yes, it's a bit complicated but the only way to sufficiently segregate them. Pity your firewall doesn't have another NIC, otherwise you could simply throw another switch at it. Easiest solution then is to add a second NIC to Server 2003 box. You could always install a software firewall on it that would allow you to limit access to certain ports on the basement NIC (that is, only the DHCP and DNS ports - 67/udp and possibly 68/udp, and 53/udp and tcp, respectively).
    – josh
    Apr 17, 2010 at 22:16
  • so by throwing another nic in the server, I should be able to do everything I want through the firewall still (bandwidth throttling and such)? Apr 17, 2010 at 22:24
  • The firewall is set as the gateway? Actually, what IP address does the LAN NIC have on the firewall?
    – josh
    Apr 17, 2010 at 22:28

The best solution would be to add another NIC on the firewall. You can then put the network on that and configure the firewall to not allow traffic between the two internal networks.

pfsense can provide DNS and DHCP for the tenant's network.


You could just cascade two routers (pfSense and another Linksys or whatever):

modem -> pfsense -> switch -> linksys

pfsense: WAN, to modem, as normal. LAN for your tenants machines, running DHCP, and for your WAN interface of the Linksys.

switch: to give you enough ports to do all this.


WAN: to a port on the switch, getting an IP from the pfSense

LAN: your home office machines, with DHCP disabled (Win2003 server does DHCP I'm assuming).

The Linksys by default will drop everything from the "WAN" side, which would be their network; you, however, can NAT out to the tenant network, and double-NAT out to the Internet.

Keep in mind, this is a pain for allowing incoming Internet services to your network. But if you're not running Exchange or any inbound server services, applications, etc. this will work fine.

The other option (I prefer this) would be to get a Netgear Layer 2 switch (less than 100 bucks at NewEgg), setup a couple of VLANs -- one for you, one for your tenants, pfSense doing DHCP for both (or one, and your Win2003 server can do DHCP for you), and setup VLANs on the LAN interface and plug it into a trunk port on your managed switch; this way you can add firewall rules to drop/allow packets between the two networks as required. This topology is called router-on-a-stick and is well-supported by pfSense.

Not the answer you're looking for? Browse other questions tagged or ask your own question.