My setup:
-
Internet router: Sunrise Connect Box 3 (Sagemcom, consumer firmware, no known VLAN support on the LAN ports)
-
Switch: TP-Link TL-SG105E (Easy Smart), operated like an unmanaged switch without VLANs
-
Cabling: Connect Box 3 → switch port 5 (uplink); port 1 = work PC; port 2 = banking notebook (online banking only, no email/browsing, LAN only, Wi-Fi/Bluetooth disabled)
-
Other devices are also on the home network (Apple products, LG smart TVs, some wired, some via Wi-Fi)
Goal: The banking notebook should be isolated from the PC and all other devices on the local network (no direct reachability within the LAN), but still have normal internet access. VLANs are ruled out, because the Connect Box 3 does not process VLAN tags and my switch does not allow a shared uplink port for separate port groups.
Planned solution:
-
Mango in normal router mode (not WISP/WDS)
-
Mango WAN port → switch port 2
-
Mango LAN port → banking notebook (own subnet, default 192.168.8.x, own NAT)
-
Mango Wi-Fi permanently disabled, Ethernet only
-
Power supplied via USB directly from the banking notebook
My questions:
-
Is this setup (Mango behind a switch, in front of a single end device) a sensible and reliable way to achieve isolation, or is there a better approach?
-
Does the Mango’s default firewall reliably block access from the upstream network (WAN side) into the subnet behind it? Do I need to configure anything for that?
-
Is the Mango’s web interface reachable from the WAN side (i.e. from my home network), and can this be disabled?
-
Are there problems with online banking due to double NAT (Connect Box 3 + Mango)?
-
Any pitfalls with USB power from the notebook (e.g. the router shutting down when the notebook goes to sleep)?
-
Are the Mango’s 100 Mbit LAN ports fully sufficient for pure online banking?
Many thanks for any experience or corrections!