I have been scouring the internet for some general information on how to do this, but haven't come up with enough information to verify if what I want to do is correct.
My goal is to put my Guest wireless access on a different network segment from the rest of my LAN.
The basic reasoning for this is to improve the security of my LAN from guests. I believe this is possible based on my limited networking knowledge, but am trying to understand how to implement it with the existing network hardware that I have. A secondary goal that I have is to use this issue to improve my understanding of networking, so a mentor's guidance is appreciated.
Note that I am constrained to solve this using my existing hardware (described below). So if it is possible, I want to learn how to do it. Only tell me to go buy other hardware if it is not possible with what I have. Yes, I understand that using other hardware may make it easier for me to do this, but that option isn't available.
Existing hardware and network diagram:
Incoming DSL line ---> TP-Link DSL Modem (bridged to gateway) ---> PC Engines APU2C4 (gateway/firewall/router) ---> Trendnet 8-port Switch (unmanaged) ---> Buffalo WZR-600DHP (dumb WAP).
Of course, I have other PCs and printers connected to the switch, but not mentioned, and should be irrelevant to the issue.
The APU2 has three interfaces; igb0 is WAN, igb1 is LAN, igb2 is currently not used.
The Buffalo WZR is running the current LEDE 17 firmware. The Buffalo WZR has a WAN interface and 5 LAN interfaces. Since it is setup as a dumb access point, just a single network cable is connected to one of the LAN interfaces.
My LAN is setup on 192.168.123.x/24 and I have wireless access working on both radio signals of the Buffalo WZR. I would like to setup the Guest wireless access on the network 192.168.234.x/24.
I think I need to configure some type of VLAN setup within the Buffalo WZR to use a second LAN interface on a separate network, then configure a new wireless access point on one of the radios to use this separate network. But I am not familiar with VLANs at all and I think that is where I can use the guidance.
Once that is configured on the Buffalo WZR, then I think if I connect this second network point on the Buffalo directly to the un-used interface on the APU2 (once it is properly configured for the second network) and bypassing the switch (since it is dumb I don't want to confuse it with packets from another network), it should provide a completely separate network for the Guest wireless access. So the diagram for the Guest network would be:
Incoming DSL line ---> TP-Link DSL Modem ---> PC Engines APU2 (igb2) ---> Buffalo WZR Guest (192.168.234.x/24).
Would this work to meet my goal? If so, can someone give me some guidance on how to setup the LAN interfaces on the Buffalo WZR? I think I can figure out the rest of it after that.
If this would not work, please explain to me why and where my network knowledge is lacking so that I can identify where I need to do more reading. Thanks.