Most modern routers support creating a "Guest" Wifi network to give Internet access to guests, while isolating them from the rest of the network, however the same is not possible for wired clients.

What would be the approach to achieve the same on a "per-(cable)port" basis? Let's say my router has 4 LAN ports, 3-4 are connected to Access Points that give Internet access to guests, how could I set this up so that those guests will be isolated away from the rest of the Windows Network? (LAN ports 1-2 + Wifi from the main router = Windows Network, Wifi from the APs connected to ports 3-4 should be isolated)


This can be done with a router/firewall that supports separate security zones. You are then able to configure firewall rules that control exactly what traffic, if any, is permitted between the various zones.

In your case you would assign your trusted ports and the router's internal wireless to the LAN zone and your untrusted ports (3 & 4) to the DMZ zone. Then you would configure the firewall rules to allow the DMZ zone to have access to only the WAN zone (the Internet). Without any rules allowing traffic between the LAN and DMZ zones, they would be fully isolated from each other, but both would still have access to the Internet.

Dell SonicWall is an example product line that supports this capability.

  • Sounds like some expensive routers. I guess nothing doable on consumer products like Asus routers on dd-wrt? – hikari May 13 '17 at 7:52
  • @hikari you can get a SonicWall router for a few hundred USD. I have no idea if consumer devices can do this. This question should be on Super User if you're not asking about a professionally managed environment. – I say Reinstate Monica May 13 '17 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.