Potential security risk found

[Coouge]

I just added a second Nest Wifi router to our mesh and when I plugged the other router to the ethernet, I got this error on the Google Home App. But when I unplug the second Nest router from the ethernet, the error disappear. I wanted to extend the range of the Nest router using a second Nest router upstairs, but I want to make sure that this error doesn't mean anything serious.

Error message from Google Home App:

Potential security risk found

It looks like there's an unknown server on your network. This could compromise your connection.

[richj44]

Just guessing, but it sounds like you may not have purchased the right router to add to your network, that's all.  Are you sure this one is the same model as your first router?  If so it should mesh seamlessly.  If it's a different model, the first router won't see it as an additional mesh point and will throw that error or something similar.

[Coouge]

It’s the same model and it’s showing up and connecting as a point. Just when you plug in the Ethernet, the message shows up. I want to plug in the second router as a backhaul to increase the signal. 

[Coouge]

Here's a diagram of what's I did. I connected the second Nest Router to the ethernet outlet using WAN. That's when I get the error. But when it's not plugged in, the error disappears. Why can't I plug the second router to make the signal stronger instead of using it as a wireless point? I wanted to do a wired backhaul.

[MichaelP]

Hello @Coouge 

When wiring a secondary Nest WiFi Router unit, you cannot connect it to the same outer network as the primary Nest WiFi Router unit's WAN Ethernet port. The primary is a router+firewall, while the secondary is simply a bridge. So, when you connect that secondary to the outer network, you're effectively bridging the inner and outer networks, exposing two different DHCP servers that want to assign different addresses to everything and provide different default routes. Here's a web page with more details: https://support.google.com/googlenest/answer/7215624?hl=en 

Based on what I see from the diagram above, you may want to buy an inexpensive, unmanaged 5 or 8 port Ethernet switch, use it instead of the Actiontec to distribute Ethernet to the ports throughout your home, then move the "main" Nest WiFi Router unit to the basement in between the Actiontec and the new switch. So, it would look something like:

NID --> ONT --> Actiontec --> Google Nest Router (main) --> Ethernet switch (new) --> ports

Then you can connect the bedroom unit to the port in that room, and it should work, because it will be connected downstream from the main Nest WiFi Router unit rather than upstream from it.

This will leave a "hole" in your coverage on the main level. But, you can pick up another secondary Nest WiFi Router unit to fill that hole (wired like the current one is there) or hope the bedroom unit covers it well enough.

It will also mean the Office Point unit will be connecting to the basement through WiFi rather than only having to get to the main level through WiFi. This may impact the performance of that unit. That could be solved by connecting another new (wired secondary) Nest WiFi Router unit there instead.

Lastly, this means double NAT for everything (which you already have for everything on WiFi), since the Actiontec router is still there in the chain. You may be able to remove it entirely, depending on whether your ISP requires some form of authentication or encapsulation (mine uses a VLAN, but some use PPPoE, or something else). You may be able to find some more help from people who are more familiar with your particular ISP requirements on that question.

Whew. I know this is a lot of disruption for something that seems like it should be as easy as just plugging it in. But, your current network is a little odd to start with, and that makes it harder to get to where you want to be easily.

[Coouge]

I bought a managed switch so I don’t have to move the nest router in the basement. I’ll test it out later today. I’ll set the actiontec to bridge mode.

[MichaelP]

Managed switches typically have loop detection / spanning tree protocol enabled. Google/Nest WiFi uses spanning tree protocol itself to ensure a loop-free topology when wiring secondaries. I see no way* to connect your system using a managed switch that would avoid having to move the primary Nest WiFi Router to the basement. 

*Ok, there's a way, but it would require two managed switches, one on the main level and another in the basement, with VLANs configured to carry both the WAN and LAN side connections over the single cable between the basement and the main level. You'd still need to ensure the switch has loop detection disabled on the LAN side, and configuring both switches to multiplex both networks through one cable using VLAN tags, while certainly not impossible, is not going to be trivial.

[richj44]

I'm no expert but after looking at your diagram, Michael is correct.  You have to connect the new Nest wifi unit to the existing unit directly or it's going to see it as a different network and cause you problems.  

I'm not sure what that data module in the garage is, are you using it as a switch?  All you need there is a simple unmanaged switch.  I mean, what I would do is set the action tech to bridge mode.  Run a single ethernet to the switch, move the main Nest router to the garage and connect it to the switch via ethernet, then connect the lan 2 ethernet switch to the main Nest lan port.  I'm pretty sure that would be simple to do and it should work fine.  I'd try to diagram it but I'm on my phone at the moment.  

Modem - switch - main Nest Router - new Nest router.  You can plug Lan 3 & 4 into the switch too and you're done, unless I'm missing something obvious.

[MichaelP]

@richj44 

Close – it has to be Modem (in this case, NID + ONT + bridge-mode Actiontec) – main Nest WiFi Router – switch – new Nest WiFi Router. You can't connect a switch upstream from the main Nest WiFi Router. That's what the OP is attempting to do now by using the switch built in to their Actiontec router to feed all the ports in the house, and it won't work.

[richj44]

I wasn't trying to connect a switch between the two Nest points, although looking back I see I typed "lan 2 switch". What I meant was the lan 2 cable, not lan 2 switch.

But congrats on getting it working! 

[Coouge]

It's working now! I bought an Ethernet power adapter and connected the second Nest Router's LAN port to the main Nest Router's LAN port using the adapter. The notification is gone, and we're now getting 511 Mbps.