Hey do,
I am considering to implement a smart home with all the different thingymajobs and alike. Since I don't really trust them with potential spyware and security issues, I want to run them on their own subnet. My current router is an Linksys 1900 ACS (v2) with DD-WRT.

I am considering two options.

1. Acquire a 2nd router. Place the secure subnet as a leg on the insecure router, intended for personal devices, LAN, etc.
2. Acquire a new with complete subnet support, such that I can achieve the same thing, but with one router instead of nesting two.

My terminology is as follows
insecure - smart devices, server, smart tv, phones and stuff
secure - LAN devices, PC's, trusted devices.

Any recommendations? Thanks!

In reply to @warped:linuxdelta.com
If you don't trust VLANs and firewalls to work, then the only solution is 2 internet lines. Otherwise, you need to trust something. Nothing is 100%. If someone wants to get in, they will. A provider modem/router with 2 routers plugged in, for secure and insecure, will give you all the isolation you need without much setup. Added benefits are that you can have 2 WiFi channels, so they can't interfere with each other.

Thanks. This were the answer I were looking for. May have been unclear in my question.

As my ISP, I have the option of setting up my own router, and that is what I did. Therefore, I were looking for an option of separating the devices into trusted and untrusted categories by connecting them to different wireless networks.

As for my understanding of dd-wrt, yes, it has a firewall, but I don't know how it will work for wireless devices connected attempting to connect to a machine on my LAN.

And agreed, nothing is 100%, but I can still take my steps and isolate devices I trust versus those I don't (PCs versus IoT fluff)

In reply to @splintter:matrix.org

Hey do,
I am considering to implement a smart home with all the different thingymajobs and alike. Since I don't really trust them with potential spyware and security issues, I want to run them on their own subnet. My current router is an Linksys 1900 ACS (v2) with DD-WRT.

I am considering two options.

1. Acquire a 2nd router. Place the secure subnet as a leg on the insecure router, intended for personal devices, LAN, etc.
2. Acquire a new with complete subnet support, such that I can achieve the same thing, but with one router instead of nesting two.

My terminology is as follows
insecure - smart devices, server, smart tv, phones and stuff
secure - LAN devices, PC's, trusted devices.

Any recommendations? Thanks!

Personally I have always used vlans and firewalls, also I would separate slightly further into the following VLANs

1. Admin (router/switch config, IPMI/iDrac/etc, PAW)

2. Hostile - no internet access + restricted vlan3 access (IOT, Smart TV)

3. Server/Services

4. Trusted Devices - full internet access, full access to vlan 3, stateful access into vlan 2

5. Untrusted - Internet and as needed restricted access to vlan 2 and 3

6. Guest - Internet access only

I follow the concept of least privilege, if something doesn't need to talk to something it doesn't.

Also I think in threat modeling terms, so not so much trusted/untrusted but more what bad behavior do I expect and gow to mitigate said bad behavior