Setup for network isolation in B&B (3 rooms, wired and wireless)

[mpa]

@Aidiakapi

My question is if this is a good setup, or if you'd recommend a different approach.

I don't see any obvious mistakes in this design.

@Aidiakapi

As for wireless, as far as I understand, it's not easily possible to have one SSID and differentiate based on a password, so it'd have to be a different SSID per room, and depending on which one you're connected to, you would be part of that room's VLAN.

With the small number of SSIDs, I think your choice is reasonable.
For completeness, this is the documentation about the other solution: dynamic VLANs.

@Aidiakapi

I'm currently considering using a secondary (the currently in-use TP-Link Archer C9) router for the residential area of the house, so that it can be configured separately. However, I think this might cause issues, so if the VLAN is enough security, maybe that'd work too.

I would tend to leave out the secondary router and rely on VLAN isolation in the switch and firewalling in the primary router. But this decision depends on various factors which were not discussed yet.

@Aidiakapi

Additionally, what kind of hardware would you recommend for building such a setup? The amount of bandwidth is mostly just things like Netflix/YouTube streams, on the order of at most 200mbps, so nothing spectacularly high end should be necessary, though the amount of clients in the room can easily be 10 for the rooms, and about 16 for the residential area.

200 Mbit/s - is that the downstream capacity of the ISP line? How much is the upstream?

To ensure the network serves all clients equally well and with low latencies, I suggest to look at Smart Queue Management (SQM) for the primary router, and Air Time Fairness for the access point(s).

However, SQM increases the demand on the router CPU, which should be considered in the hardware selection. Some benchmarks have been posted, and there are threads with hardware recommendations in this forum.

How many access points will there be?
Are you planning to run them with vendor firmware or OpenWrt?
Will (some of) the SSIDs be available on more than one AP, and a smooth client handover between APs be desired?