Guest Network Setup in Front of Switch?

[UberMon]

So, we have bought the Asus AC3200 and the Netgear Nighthawk X6 Wireless routers. I activated the guest networks with an IP address of 192.168.2.1, which is different than our internal IP address. I had the option of giving the Guest users "Intranet Access" off.

The Wireless router's were connected through our Data ports going back to our switch.

The guest users were able to access local files and shares that should not have been accessible.

I am thinking I might have set something up wrong, or does the routers have to be setup connected to the main line coming into the building, then connect everything else to the switch in order to have the guest network block the "intranet" access. Or should it have worked the way I set it up?

I no longer have the routers, as I sent them back. I did call Asus, and they said it was software issue, then had it replaced with a brand new one from vendor, but same issue.

 

[ColinTaylor]

Turning off intranet access on the router only blocks access to other devices connected to the LAN ports of that router. It can not block access to devices connected to the WAN side, i.e. devices plugged into you upstream switch.

You are correct in thinking that the only way to block intranet access for guests is to have the router connected as the first device into your building and everything else plugged into it.