IP Cams on Guest Network or Separate AP

[Robert Tickle]

Just upgraded from an Asus RT-AC66U to an Asus RT-AC3100. I have seven cheap wireless IP cams (Foscam and Wansview) on the network. I noticed that my wireless client list kept changing. Connections seem to be dropping off and being re-added constantly. Also, my System Log was getting new entries every few seconds.

Since I've heard of "rogue" IP Cams, I decided to setup a Guest Network and move all the IP cams to the guest network. The results have been very positive. My wireless client list is much more constant. My system log now get one or two entries per HOUR.

I was also thinking of using my old RT-AC66U as an access point, give it a separate SSID, and move all my IP Cams to that network, which would give me even more isolation from any rogue IP cams.

Do you guys think my guest network solution is sufficient or should I set up a second AP for the IP cams?

 

[CaptainSTX]

Just upgraded from an Asus RT-AC66U to an Asus RT-AC3100. I have seven cheap wireless IP cams (Foscam and Wansview) on the network. I noticed that my wireless client list kept changing. Connections seem to be dropping off and being re-added constantly. Also, my System Log was getting new entries every few seconds.

Since I've heard of "rogue" IP Cams, I decided to setup a Guest Network and move all the IP cams to the guest network. The results have been very positive. My wireless client list is much more constant. My system log now get one or two entries per HOUR.

I was also thinking of using my old RT-AC66U as an access point, give it a separate SSID, and move all my IP Cams to that network, which would give me even more isolation from any rogue IP cams.

Do you guys think my guest network solution is sufficient or should I set up a second AP for the IP cams?

Connecting to a guest network on an AP will not isolate them from your primary network. Your primary router can't determine which clients on your AP are guest and which are regular SSID.

If you want more isolation than you currently have put your AC66 as the network facing router with guest networks and then double NAT your AC3100 behind the AC66. Since the AC66 and AC3100 will be in different subnets nothing on the AC66 will be able to access the LAN behind the AC3100. Devices on the AC3100 Lan will be able to see devices on the AC66.

This adds the additional security you are looking for with a minimal impact on latency, download speeds, etc. The cons are that port forwards are more complicated and you probably won't be able to run a VPN server on the AC3100 though setting up a VPN client is straight forward.

If you don't want to use the double NAT then you will have to using scripts create VLANs. It would then be possible that ALL devices connecting to the AC66 could be in their own VLAN and isolated.

 

[maxbraketorque]

Connecting to a guest network on an AP will not isolate them from your primary network. Your primary router can't determine which clients on your AP are guest and which are regular SSID.

....

I thought there was a guest network isolation mode. I've seen it discussed in several threads.

...

Since I've heard of "rogue" IP Cams, I decided to setup a Guest Network and move all the IP cams to the guest network. The results have been very positive. My wireless client list is much more constant. My system log now get one or two entries per HOUR.

...

I taking this approach or some other depends on your needs or concerns. If you are worried about the cameras being used as an entry point to your network, then if the guest network isolation mode actually exists, then this should keep your IP cameras separate from the rest of your network. However, if you don't need access to the cameras from outside your home network, then just disable the UPNP option in the camera settings or disable any manual port forwarding set up for the cameras. Then they can remain on your regular network.

 

[CaptainSTX]

The guest network provides isolation when run on the router. It doesn't work using the GUI settings when run on an AP.