TiggerLAS

For trunk ports, the port on each end of the cable should be configured identically. So, if you set your ports on your router for Tagged 60 and 61, the port on the switch you're connecting it to should also be set for Tagged 60 and 61, and of course be configured as a Trunk port.

To assign a specific VLAN to the other ports on your switch:

Port Mode: Access

VLAN60, Untagged, PVID60

• or -

VLAN61, Untagged, PVID61

Anything plugged into those ports would be dumped onto the specificed VLAN, whether the device is VLAN-Aware or not.

I don't agree with the "paying a premium for wireless backhaul" argument.

Here's why:

Many of the integrated mesh systems have a relatively inexpensive price-per-unit when purchased in 2 and 3-packs - often lower than individual access points.

Many of the integrated mesh systems often come with various bells-and-whistles that access points don't offer out-of-the-box. Content filtering, activity monitoring, control features, etc. Granted, some functionality may be subscription based, but they are nonetheless available.

Yes, you can accomplish some of it with additional hardware or software, but again, that is either adding to costs or complexity.

If you have multiple access points, you may discover that in order to have seamless roaming, you need to either purchase a separate hardware access point controller, or perhaps have a computer running 24/7 for the software version. This is true for the TP-Link EAP series access points, and possibly others. Integrated mesh systems have that functionality built right in.

Unless you're using table-top access points, then chances are you'll need a POE injector to power the access points (which aren't always included), or a separate POE switch -- yet another added expense.

And, on top of all of that, you'll need a separate router to use ordinary access points.

So, now that the price issue has been debunked. . .

There are some reasons you might choose access points over an integrated mesh-based system. . .

Pro-sumer access points (such as Ubiquiti/Unifi) can be very stable. They can run for months on end without requiring a restart to fix connectivity issues. You won't find that in consumer-grade equipment.

If your access points are powered by a POE switch, then on the rare occasion that there is a connectivity issue, you just power-cycle the POE switch, and the access points will re-start. With a mesh system, you'd end up running from room-to-room to power-cycle each device manually.

Pro-sumer access points tend to be better at handling large numbers of wireless clients, so if you have alot of wireless IoT or smart-home devices, you'll probably see more stability with them than you would with a consumer-grade integrated mesh system.

Integrated mesh systems use one of the units as a router. Some makes/models only offer 1Gb ports, so if you buy one of those units, you may be be locked in to 1GB speeds across your system.

In order to use all of the mesh system's integrated features, it will need to act as the primary router for your network. For most folks, this isn't a big deal, but there are scenarios where this isn't practical. Dual WAN (ISP) usage being one of them. If you bypass the routing functions of your integrated mesh system, it will essentially disable all of the bells-and-whistles that the system offers.

Phew. With all of that said. . .

Ubiquiti makes good stuff. Once you configure it, it is usually "set it, and forget it". I log into my Unifi access points via the free software console app every 4 to 6 months to check for firmware updates, but that's about it.

I hear good things about TP-Link access points. If you have more than one access point, and need seamless roaming, you'll either need a hardware-based controller, or a PC running 24/7 with their controller app. However, they do offer the ER7212PC router, which has a built-in POE switch and access point controller, so it's a good pairing, at least up to 1Gb ISP speeds. TP-Link is generally more affordable than Ubiquiti, but I think the Ubiquiti platform is more stable.

If you do go with a new set of powerline adapters, try one of the adapters with the new(er) G.hn technologies, such as the Zyxel PLA6456 or similar.

Who is the carrier?

You only want one router on your network -- the one connected directly to your ISP/Modem.

Any other device after that should either be a network switch, and access point, or another router that is specifically set to access point mode.

If you attempt to use two routers in "routing mode" on your network, one of them will end up behind a 2nd layer of NAT, and potentially wreak havoc with gaming and any port-forwarding that you might have in place.

Some providers will sell you a public/static IP address for a monthly fee, which would make the CGNAT a non-issue. I'm not saying that is the route to go. . . just a possibility.

What kind of service do you have? Fiber? Cable? DSL?

As u/Mannus01 mentioned, using the guest network, with client isolation is the easiest way, as it is only a few clicks in your router settings.

However, that might also limit what your renters can do with their network. For example, if they have a WiFi printer, they wouldn't be able to use it, since the clients are fully isolated from each other.

Using two routers would isolate ONE of the two networks. . . but in order for them not to be able to see your stuff, they'd have to be the first router -- the one connected to your ISP. Your router would need to be connected to theirs. . . which could cause some connectivity issues for your stuff. (Gaming, etc.)

Without getting their own ISP, the only way to give your renters the same networking experience that you currently enjoy would be to use a more advanced router that supports VLANs. Then you can keep your stuff on one VLAN, and theirs can exist on the other, with each one having access to the internet, but fully isolated from one-another.

I've noticed that many manufacturer's documentation and datasheets have been annoyingly incomplete the last several years, and it seems to getting worse. Missing specifications such as port capabilities, and POE requirements to name a few. I did see several references online that mentioned either multiple, or three multi-gig ports with regards to this router, which I assume to mean the 10GB and 2.5Gb ports.

I don't use the default VLAN (VLAN1) on my network; I have one port assigned to VLAN1 on my ER-X, which I can plug into for management access to the ER-X. Everything else is on its own VLAN.

I created a few VLANs on my ER-X, and then used simple firewall rules to deny or permit access from one VLAN to the next as needed.

So:

VLAN1 = Unused, assigned to 1 port on ER-X for management. Untagged.

VLAN2 = PCs, phones, etc.

VLAN3 = Smart TVs, other smart devices.

VLAN4 = Guest network.

With that said, your plan would also work.

Add VLAN2 for your kid's devices. Add your NAT rules for internet access. Add Firewall rules to prevent access between VLANs. Add Firewall rules to allow access from your kid's network to printer. Trunk port to your access point, as you indicated in your diagram. Separate SSID for your kid's WiFi stuff, tied to their VLAN. Access port for your kid's hard-wired devices.

One additional negative (to the already numerous comments against CCA) is the general frailty of the cable itself.

It is fairly easy to break one of the conductors inside the cable, if it gets kinked/snagged while pulling the cable. Copper is much more forgiving.

Also, for those who foolishly crimped plugs onto the ends of the cables, they probably learned fairly quickly that the terminations failed at a higher than normal rate compared to copper cables. I suspect that the aluminum, being more brittle than copper, is probably cracking inside the connector either during the crimping process, or due to strain on the cable at the connector.

MonoPrice sells excellent cables. I've used their Cat6 full-boot series for several years. Never had one fail during ordinary use, out of the 100-150 cables in use at the office, and home.

(I actually did have 2 fail, but that was due to people carelessly snagging the cables while moving office furniture, and ripping them out of the wall jacks.)