Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 3 down vote favorite

I have an AirPort Extreme (APE) with the Wi-Fi setup for guest account and this works just fine.

I was wondering if I could also provide a wired ethernet guest access without letting this user see my computers AND without me having access to his computer while plugged into this network as well.

I do have a "switch". Could I plug this into my broadband modem (first) then the APE? Would a switch give the isolation I need?

share|improve this question

3 Answers

up vote 1 down vote

No - you need a specific switch that would create a wired VLAN (virtual LAN) to segment the guest network from the rest of the house's network. VLAN are how the wireless system works as well but the software doesn't have a way to identify or switch one or more than one of the wired ethernet ports to anything but the main VLAN.

If you add a switch (or router) to handle the VLAN - it will need to either have physical ports to differ from the AirPort so you might be better just letting it run your entire network. Cisco makes many of these - mostly for the enterprise / medium business - but there are other options if you don't like the Cisco brand.

share|improve this answer
2  
Thank you for your info and expertise. It looks like this would end up being a much larger project (time & $$) then I had imagined, so I'll just have to stick with what I have. Again, thanx... – Siegfried Sep 27 '12 at 19:51
up vote 0 down vote

I can't see any obvious way to do this using the parts you've listed. If you had a second AirPort, bridge mode could take that guest wireless network and share it over ethernet. There are also wireless bridge devices that can turn a wireless connection into ethernet, or several ethernet ports if combined with the switch.

There is one thing you could try. Connect the modem to the switch and the switch to the router. This usually doesn't work, but some internet connections allow you to connect more than one device (via a switch) to the modem. If you can connect another computer to that switch and have it get an IP address while the router still has access with its own IP, you may have a solution. The guest's PC will be outside the router and have just as much access as any other PC on the internet. This is a long shot, but it won't hurt anything to try.

share|improve this answer
up vote -1 down vote

If the switch is capable of creating VPNs then the switch will do. You will have to configure a VPN in the switch and assign a network block, and assign it to either a port on the switch or if you know the guest user's NIC MAC address, that might be an option as well.

EDIT:

After reading your question again. What you describe will work, if you use a modem with a build-in router. You need DHCP, because your guest will need an IP assigned to their computer. The router will assign an IP to your guest and to the APE. The guest will be on the same IP block as your APE, but outside the APE IP block.

share|improve this answer
Most switches operate at OSI level 2 and aren't capable of creating VPNs or anything else that requires intelligence. VPNing would require a multilayer switch which normal people don't have sitting around at home. – gabedwrds Sep 25 '12 at 23:50
The second idea would technically work, if the modem has a built-in router option or there's a second router available. It's considered Double NAT and can be problematic - port opening becomes more difficult and path MTU discovery usually breaks. AirPort routers check for it and treat it as an error. – gabedwrds Sep 25 '12 at 23:52
Most people do not have a multilayers switch sitting in their house, but the OP did not specify the type of switch he has. Also, the OP need not worry about port forwarding. All he wants to do is isolate access to his wireless network from his guests. Double NAT will not be a problem for Internet access. I have used Double NAT networks for increased security repeatedly. To make it easy he can set the DNS servers on the APE to help his normal internal devices access the Internet without interruptions. – thetitan Sep 26 '12 at 4:16
Please forgive my ignorance, how do I find out if my Linksys 5 port Workgroup switch is capable of creating VPNs? My modem does not have a router built-in. All of this is sounding way too difficult for me. Apple makes it easy with the APE. Is there something like this for a wired solution? – Siegfried Sep 27 '12 at 2:41
As you may have read earlier, all this is just way way too much for me right now both in time and financial investment. I do deeply appreciate all of the help and expertise, you guys are the best. Thanx again... – Siegfried Sep 27 '12 at 19:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.