I'd like to know a bit more about VLAN routing when it comes to sharing one resource across VLANs maintaining segregation between them.

I have a "standard" ISP issued broadband router/modem with no VLAN capabilities at all that I can see (tag or port based) connected to port 1 on my Draytek router.

What I want to do is have two VLANs - 1) for the local LAN comprising of ports 2 & 3 and 2) a guest port comprising of port 4. The intention is that the VLANS 1 and 2 can access the internet, but not each other. VLAN 1 for the LAN is fairly self explanatory; it just acts as an internal network but VLAN 2 is a guest connection which allows a device connection to the internet but prevents access to any device on the LAN.

Seems quite simple but I gather this cannot be achieved as the router/modem has not got any VLAN capabilities.

Could port 1 be it's own VLAN (perhaps VLAN3) and then VLANS 1 & 2 bridge across to that but not each other - I'm wondering whether this might provide the router/modem with a VLAN capability which it doesn't have. Sounds like a get around (as well as wishful thinking) but I'm just trying to understand if there is an easier way to do this.

Are there any other features of a Vigor 2927 router which may allow me to over come this issue?

Thanks

I use vlan exclusively on a 2862.
However I don't use port based vlans, it's routed by the 2862 out of port 1 into a managed switch.
That's said port based vlans is probably easier as you can assign a vlan per port.

You don't specify which router you believe will not handle this, but my 2862 can/could and is five years old. Additionally I'm currently looking at a 2927 and have no doubt it will handle my much more complicated set of demands.

So which router do you have?