Separate Networks for MTR/STR Guests - WiFi + LAN Protection and Internet Security

Separate Networks for MTR/STR Guests - WiFi + LAN Protection and Internet Security

Pierre E.Pro Member
Washington, DC · Member since 2016 · 123 posts · 42 votes

This is both to share what I have found so far, and ask for additional ideas/feedback.  Basically trying to figure out the best way to have two completely separate internet networks on a property including the wired ethernet networks.

SCENARIO: Why look into this? 
Good internet service is important for STR and especially MTR guests, including not just wireless but wired ethernet LAN access for some remote workers. Wired is faster, more reliable, more secure and sometimes required and may be an added bonus, but harder to create two SSIDs for.

At the OTHER end, when renting to STR /MTR guests, there may be devices that either provide security, safety, functionality to your furnished rental that you don't want guests accidentally or intentionally disabling or damaging or using,  ie IoT devices, cameras, etc.   Also, there have been reports of guests using internet for not so good activity (1) ie piracy, copyrighted material etc, and there may be other reasons as well ie if you have a duplex,  etc to have separate total LAN. 

One other thing, is if you actually still live on the property, this becomes even MORE important for you. 


       How to Create Two Completely Separate Walled of Networks?    .
(and not just two wireless network ID's)


So far this is all I have come across

A) - Use a second router (Double NAT issue), set up a second router with its own network ID, and connect wireless and ethernet devices through this.  -  Upside:  fastest, less expensive way to do this.  Downside: Double NAT (2) will likely occur, which can be a problem for some guests esp gamers or remote workers that will have specific internet issues with port forwarding.  - One way to avoid this is to put your maintenance/general devices on the second router since they are less likely to care about double NAT than a guest.  Bridge mode is an option but kinda defeats the purpose of creating a separate network 

B) Create subnets (Advanced Method) -  There's a way to actually create subnets (3) , I dont fully understand it, but its not impossible even for a non IT pro... but this probably takes some time, and not sure if that is something that would need to be redone over time or if network resets are needed. Goal to maximize customer experience, minimize calls for internet issues, and optimize security and device separation so not sure if this would make fixing internet issues less streamlined and more of a headache

C)  Purchase another internet account -  (Simple Costly Method)-  ask your ISP to run another service line into the house and provide another ISP public address and line that you connect a second router to. All of these above methods will involve additional routers but depends on how those routers are used.  This method prevents double NAT and network interference, but allows separate ethernet wired networks to exist to isolate the property devices from the guests. It just happens to cost more. May or may not be worth it depending on your guest type, cashflow, and personal needs (ie if you also live on the property). 

Any other ideas, suggestions or comments?  I hope this helped someone, I have seen a few searches on this, but not a lot of clear answers on options and issues.  I also hope someone can help me if there are other options, or someone has experience with this???

1) - This is how I have Wifi set up for guests  Answered!   ‎26-12-2018 07:51 AM  - https://community.withairbnb.c...
2) - What is Double NAT?  Toasty Answers  - Youtube   (Good explanation)
3) -  let’s subnet your home network // You SUCK at subnetting // EP 6  - NetworkChuck - Youtube

0Reply
82 views

Most Popular Reply

Investor · Greenville, SC · Member since 2015 · 1k+ posts · 1k+ votes
3y

So for an STR, this is typically too much effort for the typical person. I am an IT consultant by trade and have been for decades and I don't go through this with my STRs. You have to weigh the risk/benefit ratio and to me there is not enough risk for me to provide network separation between the guest using internet and my wifi thermostat, ring camera, streaming TVs. They are all password protected and I just don't feel like there is a huge risk with the guest jacking something up through the network. Keep it simple. They would have to figure out my password and most people just are not gonna be able to do that. Again, I said MOST.

Now having said all that, if my STR was attached to my house where I lived, I would absolutely have firewall separation where there would be no way they could reach my house network from the network at the STR. Too much to protect at my personal house from a network perspective. Not so much with my stand alone STRs.

Also, just adding subnets does not help unless there is firewall separation between the subnets.
 

See this reply in the discussion

5 Replies

Jump to latestLatest
  • Investor · Greenville, SC · Member since 2015 · 1k+ posts · 1k+ votes
    3y

    So for an STR, this is typically too much effort for the typical person. I am an IT consultant by trade and have been for decades and I don't go through this with my STRs. You have to weigh the risk/benefit ratio and to me there is not enough risk for me to provide network separation between the guest using internet and my wifi thermostat, ring camera, streaming TVs. They are all password protected and I just don't feel like there is a huge risk with the guest jacking something up through the network. Keep it simple. They would have to figure out my password and most people just are not gonna be able to do that. Again, I said MOST.

    Now having said all that, if my STR was attached to my house where I lived, I would absolutely have firewall separation where there would be no way they could reach my house network from the network at the STR. Too much to protect at my personal house from a network perspective. Not so much with my stand alone STRs.

    Also, just adding subnets does not help unless there is firewall separation between the subnets.
     

  • John UnderwoodPro Member
    Investor · Greer, SC · Member since 2014 · 13k+ posts · 17k+ votes
    3y

    Just Enable the guest mode and password for the rental. Use a wifi extender if needed.

    Run a direct burial ethernet to rental with its own router.

    If someone did something illegal you could easily look at your calender and see who it was. I'm not losing sleep over this one. 

  • Member since 2023 · 2 posts · 1 vote
    3y

    Take a look at UniFi Wifi products. They require a little more tech savvy, but they’ll allow you to have multiple Wifi SSIDs, and keep them on separate subnets. You can even create a “login” page that makes them agree to TOS (eg no illegal downloads).

  • Bonnie LowPro Member
    Lender · Asheville, NC · Member since 2016 · 1k+ posts · 1k+ votes
    3y

    This is a great question, but I suspect you're more knowledgeable than 99% of the rest of us so you may be asking the wrong crowd for advice ; ) Personally, I'd have to go the simplest route and I know it's doable. We have a property with a main house with a long term renter in it and a smaller ADU property that we rent out as an MTR. Ourlong term tenant has her own internet account for the main house - nothing, including wiring, is shared. We pay for the separate account for the MTR. No shared lines. No shared equipment. I have found the Best Buy Total Tech program to be the best investment I've made in a long time because I'm terrible with all things electronics. I bought our smart tvs and devices through them (I'm not affiliated in any way) and get free installation of everything. I just explained what I needed and they set it up. And a total bonus was that they let me move the membership when I bought another property instead of having to pay for another tech membership. Their customer service has been phenomenal.

  • Michael BaumPro Member
    Olympia, WA · Member since 2016 · 8k+ posts · 7k+ votes
    3y

    Quite a few routers offer multi SSIDs for a single network.

    TP-Link has it all built in. Just make sure you disable the router portion of the DSL/Cable modem if you have that sort of box.

Join the conversationCreate a free account to reply, vote on answers and follow this thread.