Guest VLAN isolation with an Edimax router

Configuring an Edimax router to use a VLAN for guest traffic isolation gives visitors their own address range and broadcast domain while keeping them away from your main network. It is useful when a partner, family member or short-stay guest needs internet access without being able to reach your NAS, printers, cameras or computer. A guest VLAN can still provide normal web browsing, video calls and streaming, but its access should be controlled by firewall rules rather than by the guest password alone.

Edimax hardware covers several very different product classes. Some routers provide a separate guest wireless network and client isolation, while others expose 802.1Q VLAN tagging and SSID-to-VLAN mapping. Those features are not interchangeable: a broadcast guest SSID does not automatically become a routed VLAN. The exact model and firmware therefore determine whether the configuration described here is available, partly available through a different device, or impossible without replacing equipment.

The practical goal is straightforward: place the Edimax device in the right mode, assign guest devices to a separate VLAN, provide addressing that cannot overlap with the home network, and deny unwanted traffic at the boundary. This matters in Australian homes as well as small offices, especially where several people share an internet connection or a managed apartment network. A sound configuration remains understandable years later when the device has been renamed and its original settings are forgotten.

Check the router's VLAN capabilities

Begin with the label on the router, not with a generic web tutorial. Check whether the manual for that model mentions VLAN, 802.1Q, tagged ports, guest networks or wireless isolation. For model identification and default-address references, the Edimax setup guide is a useful companion to the manufacturer’s documentation. Look for the hardware revision and firmware version too, because a feature may exist in one revision and be absent from another.

Management addresses on Edimax devices commonly include 192.168.2.1 and 192.168.1.1, although the supplied model determines the correct value. Connect a laptop by Ethernet to a LAN port, join the router’s initial wireless network if required, and open its local address in a browser. Use the administrator credentials printed on the label or specified in its manual, then change them before exposing administrative pages to guests. A VPN or proxy on the laptop can also prevent access to a local setup page.

Decide whether the Edimax will be the main router, an access point or an extender before configuring VLANs. A wired access point behind a VLAN-aware gateway normally leaves IP assignment and firewalling with that gateway. A router behind an upstream gateway usually needs the appropriate WAN and LAN tagging. A conventional extender repeats the network it joins and does not create a VLAN merely because WPS is used. Saving an incorrect port setting can interrupt the entire connection, so record the current settings and keep the administrator cable available while making changes.

Plan the guest VLAN and IP addressing

Give the guest network an identity that will not clash with existing services. VLAN 20 and 192.168.20.0/24 are convenient examples, not mandatory values. Check the home LAN, any second router, VPN address ranges and site-to-site tunnels before choosing them. If the Edimax is the guest gateway, it can allocate addresses from 192.168.20.100 to 192.168.20.200 with a lease time of eight hours; the gateway would normally be 192.168.20.1.

Write the intended policy in plain language before touching the interface. Guests may reach the internet through the WAN connection, but they may not initiate connections to private devices, management pages, local DNS services or storage systems. Blocking traffic between different guests is a separate choice, and many household networks leave guests able to stream directly to one another. The firewall must enforce the policy in both directions that matter, while normal address translation allows guest traffic to leave through the internet connection.

The physical design and addressing decisions are closely linked. A single wireless repeater cannot carry a tagged VLAN from the main router to an upstairs room unless it explicitly supports that tagging over its backhaul. Likewise, a basic access point with one untagged LAN connection will not preserve a guest VLAN. The following checks make the required equipment and behaviour clear before installation begins.

  • Use guest VLAN 20 for an example tagged network, with the VLAN gateway set to 192.168.20.1.

  • Reserve 192.168.20.100–192.168.20.200 for DHCP leases and keep that pool outside the private LAN range.

  • Allow guest traffic to the WAN, deny it to private LANs, and decide explicitly whether guest-to-guest traffic is permitted.

  • Create a distinct SSID, such as Home-Guest, secured with WPA2-AES or WPA3 and a password separate from the main network.

  • Confirm that the exact Edimax model supports VLAN tagging, or plan to place it in access-point mode behind a VLAN-aware gateway.

  • Provide a managed switch with enough ports for the private network, the guest uplink and a spare tagged connection.

  • Mark one switch port as a trunk for VLAN 20 and any private VLANs, while assigning guest device ports as untagged access ports.

  • Use an access point that can map a wireless SSID to a VLAN; do not rely on WPS pairing to perform that mapping.

Build a VLAN-aware physical path

A typical wired path is an internet gateway, then a VLAN-aware switch, then the Edimax router or access point. The switch-to-router link is a trunk that carries the private VLAN and the guest VLAN with their tags intact. Guest laptops and phones connect through access ports, where their untagged traffic is assigned to the guest VLAN. This arrangement is different from using one cable for a plain internet connection, because the switch now relies on both tagged and untagged port definitions.

Matching port roles on both devices is the critical detail. The Edimax must send and expect the same VLAN identifiers as the switch, and the native VLAN must be defined consistently. Do not use an arbitrary native VLAN number merely because it appears in a menu. If the router offers a WAN port that accepts only an untagged connection, put the VLAN-aware switch between it and the router, or let the upstream gateway own the tagging. Test the private connection after each change so a guest-network error does not hide a broken management path.

Australia’s NBN connections use several technologies, including FTTP, FTTN and HFC, and an ISP gateway may need to remain upstream depending on the connection and provider. The Edimax may sit behind that gateway without replacing it. Shared apartment cabling in a Sydney or Melbourne building can already carry internet, voice or IPTV on separate VLANs, often managed by the property owner. Obtain the switch configuration from the building manager before changing an access port; otherwise a guest network may expose or disrupt services that are not yours.

Before ordering a managed switch, compare the proposed model with the current specifications listed by network hardware suppliers and confirm support for the VLAN IDs in use. Australian buyers should compare the actual hardware requirements rather than choosing from an overseas specification. Consumer prices are commonly shown in Australian dollars with 10% GST included, while business buyers should allow for GST and local warranty support. Check that the power adapter suits Australian Type I mains and 230 volts, or use an approved local supply if the supplied unit is unsuitable. Freight and import charges make an imported bargain less attractive when support or replacement parts are difficult to obtain locally.

Configure the guest SSID and traffic rules

Open the management interface from a trusted wired device and install current firmware for that exact hardware revision before designing the guest network. Menu names differ across Edimax ranges, but capable models generally expose wireless settings, LAN or VLAN settings, DHCP and firewall controls. If there is no VLAN identifier beside the guest SSID, check whether the device can act as a managed access point with an upstream controller. A feature that only creates an isolated guest SSID can provide basic separation, but it is not a configurable guest VLAN.

On a router that supports the design, create the guest SSID, assign it to VLAN 20 and configure the required tagged or untagged port. Enable wireless client isolation if the model offers it as an additional control. Use WPA2-AES or WPA3 rather than an open network or obsolete WEP, and keep the administration interface reachable only from the trusted LAN. After saving, reconnect a test device to the guest SSID and confirm that it receives an address from the guest pool rather than the main network.

DHCP must have one clear owner. If the Edimax routes the guest VLAN, configure the guest interface with the chosen subnet, gateway and DNS addresses, then enable DHCP on that broadcast domain. If an upstream gateway owns DHCP, disable the Edimax DHCP server for the VLAN and let the gateway supply leases. Do not run overlapping DHCP services on the same broadcast domain, since a device could then receive an address that gives it the wrong route. Guest leases do not need static reservations, while trusted devices should remain on the private network.

Firewall rules should follow the written policy. Permit the guest interface or VLAN to reach the internet-facing connection, deny access to private interface addresses, and block guest-to-guest traffic if that was the chosen behaviour. Apply rules to the guest network itself, not to the trusted LAN or a port that merely carries several VLANs. DNS is an easy exception to overlook: either allow the guest to use the router’s resolver or provide explicit access to chosen public resolvers. Test both a web address and a name lookup after applying the rules.

Test the boundary and protect it

Verification should demonstrate a boundary, not merely a working password. From a guest device, confirm that it has a 192.168.20.x address, can open a website and resolve a domain name, but cannot reach the router’s administration page, a private laptop, a NAS or a network printer. Repeat the checks from the private network to ensure guest access has not weakened local protections. Test a second guest device if guest-to-guest isolation was required, and check that a failed connection is blocked rather than redirected to an unexpected service.

Shared-spectrum use in busy Australian cities can complicate the evidence. A 2.4 GHz network using 20 MHz channels 1, 6 and 11 avoids overlapping neighbours in the same area, while a suitable 5 GHz channel often gives visitors better speed with less contention. These are separate from VLAN settings: a crowded radio band may make the guest network slow without making it insecure. Check the router’s Australian regulatory-domain setting and compare signal strength at the places guests actually sit rather than at the router’s position.

Documentation is part of the isolation. Keep a short record of the guest VLAN ID, subnet, DHCP pool, SSID, port roles and firewall policy, and store administrator credentials somewhere secure. Update firmware, review guest access after household devices change and remove obsolete VLAN definitions when they are no longer needed. Disable WPS once guest access is established, use a strong administration password, and ensure firmware updates or configuration exports are protected. This prevents a later router replacement from silently returning to an open guest network.

Extenders need particular care. In a regional Australian home, a study, guest room or garden office may lie outside the router’s useful range, but an extender does not add VLAN awareness that it lacks. WPS can simplify the wireless link between an extender and router, yet it assigns no guest VLAN and should not be confused with traffic separation. Use a wired backhaul or a model that explicitly supports tagged VLANs, and check its client-isolation behaviour. The lasting principle is simple: a guest SSID creates guest access, while VLAN assignment, DHCP boundaries and firewall rules create guest traffic isolation.