How to create an isolated and secured vlan for iot devices?

[rlkoshak (Rich Koshak)]

@ariznaf

The problem is with the devices that do connect to the iot wifi in the other access point outside oepnWRT router, as DHCP does not know that device has connected to wifi and what wifi is connected, and it assigns IPs from the home lan.

Typically if one has two subnets, one needs a DHCP server for each one. If you configure your DHCP server for one subnet it likely breaks the other network.

@ariznaf

But the problem is that I cannot wire directly that access point to the main router, as there is only one ethernet wire between that points.

Wire it to the main one.

ISP Gateway.  <---> Main Gateway. <---> IoT Gateway

The ISP Gateway has its own DHCP service. It supplies the IP for your Main Gateway’s WAN port (or sometimes it’s static).

Your Main Gateway has it’s own DHCP service that supplies the IPs for all the devices directly connected to it.

The WAN IP for the IoT Gateway comes from Main Gateway’s DHCP. The IoT Gateway has its own DHCP service that supplies all the devices connected to it. It also has a different SSID from the Main Gateway.

On the Main Gateway, firewall settings limit the ability for any traffic coming from the port the IoT Gateway is plugged into from reaching the Internet. Routes are set up to route traffic between the IoT network and your Main network.