Networking – How to connect Netgear N600 Router to AT&T Uverse Router

Alright your problem can be broken down into two main things here.

1. You need clients to have company access on a secure SSID
2. You need guests to only have internet access on an open SSID

Now, for the first problem, you need to set up the router so that all DHCP requests are forwarded to your DHCP server. These clients need to behave as if they were plugged into the network. Your DHCP server must be involved because they are usually interfaced with AD & DNS. It sounds like you've already managed to do this. This should be placed on your company VLAN so the traffic is treated as such.

For, your second problem, these clients should behave as if they originated in a DMZ (De-Militarized Zone). They should have no company access, and only able to access internet exterior to your network. Typical implementations would have you create a separate VLAN for these clients so their DHCP requests are responded to ONLY by a DHCP server that handles this type of thing. If you already have a DMZ DHCP server then set it up to listen to that VLAN (If you have a webserver it can sometimes be serviced by this). If you have only one DHCP server that handles both, you need to make sure it can differentiate and assign addresses to that VLAN and that all traffic is routed/switched through this DMZ with no access to the company VLAN.

I know this may look complicated, but this is the necessary steps to have the traffic entirely differentiated from each other.

If you consider the LAN/WLAN side of the primary router (that is, the network segment(s) between the primary router and the secondary router) to be part of "the local network" that the Guest Network devices should not have access to, then a secondary router cannot provide Guest Network access only to the Internet without cooperation from the primary router.

The Guest Network's traffic to/from the Internet has to cross the same link between the two routers as local network traffic. But if you want it segregated from the local network, it has to be tunneled or tagged in some way that segregates it from the local network traffic. But if that traffic is segregated through, say, VLAN tagging or some kind of higher-layer tunneling, the primary router needs to know how to do the right thing with that traffic (that is, decapsulate it and send it only to the Internet, and not let it route back onto the LAN).

I don't know if any Netgear equipment has support for this kind of "Guest Network Extension" functionality, where the primary router acts as a VLAN-aware device or tunnel endpoint so that secondary routers can forward segregated Guest Network traffic to it.

I know that Apple AirPort Extreme/Express/Time Capsules as of firmware 7.6.3 support this. If you have an Apple AP as your primary router (in NAT mode), and have Guest Network enabled, and another Apple AP as your secondary "router" (actually in bridge mode, not really being a "router" per se), also with Guest Network enabled, then the secondary AP will forward Guest Network traffic toward the primary AP, but will VLAN tag it so it's segregated from local LAN traffic. The primary AP also subscribes to the same VLAN, and knows to forward traffic from that VLAN to the Internet, but not back onto the local LAN.