How can I test my guest network?

Question

I enabled my guest network and put my devices on it so my communications could be separate from the rest of my family on the main network. How can I test this to ensure the guest network really is secure and doesn't interact with any devices on the main network? So far I can tell that my devices are on a new subnet.

I am using a buffalo AC1900 router. I am not sure if they have a good or bad reputation in regards to security. I noticed that the router was secured with WPA-2 AES out of the box and it is secured as default even if you reset the firmware. WPS was enabled but it has a time out function and I could easily disable the WPS option. Wireless guest mode implementation is easily switched on and off and you can enable a second authentication that requires a login to a captive portal before use. One issue I did find is that the login to change settings only allows 8 characters. You can completely disable administration from wireless or wired LAN.

Answer 1

1. On your non-guest network, Take a computer and setup a shared folder. Note the computer name and IP address. Take another device and connect to the guest wifi. See if you can access the non-guest-computer's share on the guest network.
2. Is the IP address on your guest machine the same subnet as your non-guest machine. Can you ping the non-guest machine from the guest-machine? You did say that "So far I can tell that my devices are on a new subnet." so the ip addresses should be a different IP Scheme.
3. With the same setup as #1, but on the computer on the guest network, download Wireshark and then start capturing data from your guest wifi. While the capture is running, go to the non-guest-network computer and do some internet browsing for a minute. Go back to the Guest computer, and stop the capture. Remember the IP address from the non-guest computer, and start looking through the capture for that one IP address. You can setup Filters to do that, such as "ip.addr==[Non.Guest.IP.Address.goes.here]". Not familiar with that router, but in the Wireshark capture you shouldn't see any stream of "computer" connecting to "google" in your stream. You might see an ARP request or something of that nature. When looking through the stream, most things are shown as IP addresses.

Those three things should all give a positive result of:

1. Can't access the share
2. Can't ping the non-guest computer, and ip addresses are a different subnet (192.168.1.x for non-guest, and 192.168.55.x for guest as an example)
3. Can't see any network traffic from the non-guest machine while capturing from the guest machine.

Routers can handle the "guest" network differently than others, and not being familiar with that router, I can only speculate, but these would be the tests I would run if I were testing that out.