How to create a separate subnet for wireless access?

Solution 1:

The way to accomplish this using consumer grade equipment is using a 3 router Y configuration

By setting the two routers up using the same subnet but on different "LAN"s it is impossible for one network to talk to the other network.

Think of it this way: you have a computer on LAN A with a IP of 192.168.1.2 and a one of the wireless clients on LAN B with a IP of 192.168.1.3. If on LAN B you request 192.168.1.2 (one of the wireless clients trying to connect to a wired client) it goes to LAN B's router, sees that it is a request for the 192.168.1.x subnet and does not forward the packet any further up the chain (it could but it would not matter, see the lower section of this answer). It also sees that it does not know of any computer at 192.168.1.2 (The only computer it knows about is 192.168.1.3) and reports back to the original computer "destination host unknown". If we request any other IP other than 192.168.1.x it will use the gateway and continue on to the internet to try and resolve your IP connection.

This gives you complete security on your network giving you two LANs that are physically impossible to talk to each other while still letting both connect to the internet.

Depending on how your wireless router's firmware works you may be able to do it with two routers by just moving the connection of the wireless from it's LAN port to its WAN port. However you can only do this if the wireless router does NOT forward requests it can't resolve to the gateway for it's own subnet (so in my previous example the wireless router must NOT check the WAN port for 192.168.1.2 for the two router configuration). The upside to this if your router does behave the way you want you don't need to buy any additional hardware.

In the 3 router Y configuration it does not matter if the router forwards requests or not because on the Y LAN there are no 192.168.1.x computers, only the two routers WAN interfaces which are both 192.168.0.x.

Here is a new diagram that is closer to your original diagram to help explain it.

Solution 2:

I'm assuming your wireless router is a sub-$100 one you'd buy at a department store.

You really need a router with 3 interfaces. A PC running Linux with 3 network cards does this nicely - one NIC is the WAN, the other NIC is connected to your LAN hosts, and the third your wireless router is plugged into. You can then run a DHCP on the Linux box listening and giving out IPs on the LAN and WLAN interface.

You're in for a bit of iptables configuration in order to make sure the WLAN hosts can't talk to the LAN hosts (relatively simple since they are on separate subnets).

You could also put the LAN hosts behind their own router, and configure any SPI firewall settings on the wireless and wired router to drop traffic from the other subnet. Note that in this situation you'll need a separate DHCP server running on each subnet since broadcast traffic isn't forwarded by routers.

You could also, if the wireless router supports it, tell it to block all outgoing traffic originating from behind it to the subnet that your wired LAN is on.