[ErrorMargin]

Originally Posted by masraum

I haven't read this article, but a quick scan says that it's one way (without buying a device with the capabilities to do it in one device) to do it. And if the main device has a "guest network" then you'd have your 3 networks.

https://www.smallnetbuilder.com/lanwan/lanwan-howto/howtotwoprivlan/

That will work. It needs three routers, but it will certainly do the job. I think this will need more configuration than the article suggests.

This article from SmallNetBuilder describes the exact scenario I propose in my example above, but it does it at the switch level instead of the router level which is probably cheaper than my proposal to buy a router to do it. In this example all your equipment can be whatever you have today, you just need the VLAN managed switch to handle the VLAN routing.
https://www.smallnetbuilder.com/lanwan/lanwan-howto/how-to-segment-a-small-lan-using-tagged-vlans/

The article references an older Netgear switch to do manage the VLANs. A modern switch that can do what is described in the article is the Netgear GS108Tv3. There are plenty of other options out there too.

This article from Netgear shows how to configure that switch for untagged VLAN (access) ports in step 3.4: https://kb.netgear.com/000066734/How-to-configure-a-VLAN-on-a-NETGEAR-Smart-Switch-with-a-Smart-UI