Home Subnetwork

[Eilua]

Hi,

I'm in my mid 30s and unfortunately I've recently had to move back in with my parents for financial reasons. My step dad pays for a gigabit fiber connection to the property (I offered to contribute but he wasn't having any of it) and is a bit of a control freak who quite frankly doesn't respect my right to privacy. This was all a bit weird when I was still a teenager, but is definitely beyond the pale now that I'm an adult. The obvious solution would be to get my own place again but that isn't likely to be financially feasible in the short term. In order to find a short term solution to this problem that won't cause too much bad blood I've been considering buying my own router in order to restabilish security and privacy for my devices as well as combine this with a VPN in order to encrypt my traffic and therefore shield myself from prying eyes. While I am generally quite tech savvy I've pretty much always lived with IT professionals of one form or another and so have never really had to think too hard about home networking. I wanted to check, before spending the money on hardware, that what I want to do is possible and if there are any considerations I should be making / limitations with this approach. I was struggling a bit to find the information I need on google so I'm hoping someone here is able to help!

To give a background for how our home network is setup currently: We have an ISP provided router that routes traffic along ethernet cables fixed around the outside of the house. I have one ethernet socket in my room that I connect to a 4 port switch that is in turn connected to my various devices. While the ISP provided router does have 2.4Ghz and 5Ghz Wifi capabilities I am not permitted to use them because the wifi signal isn't very good and my step dad doesn't want me saturating it while he's trying to watch netflix in bed (fair enough!). As a consequence I've been relying on mobile data for software updates etc..

I am hoping to be able to purchase a router that would provide me with wifi coverage in my room as well as be able to control the traffic going in and out of my room. At the moment I'm leaning toward picking up a Ubiquiti Unifi Express 7 and reusing my current switch in order to get around the single LAN port on the 7. The idea is to connect the ethernet socket in my room with the WAN port on the router, connect the LAN port on the router to my switch, and then connect my switch to each of my devices like I currently do. I am hoping that this will result in my step dad being able to see the router connected to his network but not be able to see (or ping) any of the individual devices connected to my router. I believe he currently uses MAC address filtering on the home network (he insisted on taking photos of the settings pages that listed the MAC addresses on each of my devices before he would grant me access). I am hoping that I as long as he adds the MAC address of my new router to his settings my internet connection should essentially work as normal only without his ability to see anything in my room beyond the router itself. Once you combine this with routing all of my traffic through a VPN I am hoping that he will be able to see all of the packets coming to and from the router placed in my room but be unable to see what kind of packets they are / where they are being routed too, thereby reinstating my privacy.

Am I right in thinking that this sort of setup is possible? I don't want to spend the money on the router only to find that It's not possible to do what I want it to do.

I'd appreciate any advice any of you can give me!

Thanks.

 

[wonko]

First off, are you sure that your network traffic can be monitored? If it's just an ISP-provided router you're connected to then unless it has fancy parental controls/monitoring, all that could be seen is what devices are attached and UPNP port forwarding. Maybe look up the ISP router specs and see what it can do - you might be worrying too much about it and a simple Access Point is perhaps all you'd need.
I don't know about the specific Ubiquiti kit you mention, but putting a router behind another router introduces 'double NAT' which can cause some problems.
It sounds like your step dad would know enough to understand that a router/VPN would 'hide' what's attached and what traffic is being sent, and if this triggers his control freakery he could refuse to allow you to connect one, so you may as well try to get agreement before spending the money. You could spoof the MAC on the WAN port with an already-whitelisted address but if he's really monitoring things that might lead to an argument and the ethernet cable to your room being unplugged.
To completely avoid any arguments, if you've got good mobile coverage then maybe get yourself a 4G/5G router with a preloaded data SIM.

 

[Quartz]

Funnily enough this is often done in reverse: a parent mandates their children's access all goes through a secondary router so that router can be blocked and managed as needed. All you really need for basic security is a router with an ethernet LAN/WAN uplink. Make sure that it is set to a different private subnet (e.g. 172.16.x.x vs 192.168.x.x) Plug that into the house network and plug all your devices into that router. If your stepfather is going to do packet sniffing then that's a different ballgame and I'll leave you to the experts.