Great article, topology and concepts. That article is from 2016 and inevitably CVE’s exist for the ASUS RT-N12 now. Home routers seem plagued with problems in that department. If the router has security issues then topology becomes less important.
Since the Surf SOHO supports 16 VLAN’s - it’s like having “16 routers” for the cost of one and it gets regular security updates. The Surf can support the configuration in this article using VLAN’s with inter-VLAN routing off, a few simple fire wall rules and layer 2 isolation.
Using the 3 router example in the article, my only recommendation is to move the 192.168.50.1 admin subnet off the “untagged LAN”. The idea here is that the untagged LAN is the “border lan” and should not have an admin access capability IMHO. Either way the Surf is orders of magnitude better compared to my old home router.
Admin access should be allowed only on the “secure lan” which can be accomplished on the Surf SOHO MK3 by creating a VLAN and assigning the 192.168.50.1 subnet to it. I took it a step further and assigned that admin VLAN to a single PORT/single computer.
I literally set up my network like the article suggests by isolating everything - each device gets its own VLAN on a dedicated port/Wi-Fi network. Nothing can talk to each other. The reason? Because I got hacked! Looking through my notes, before I bought a SOHO MK3, I was only using a 10 letter Wi-Fi password. It sounds bad (it was) but like many home users I was just too busy with other stuff. Worst of all the admin webpage was programmed to close after 60 seconds of inactivity so it made it difficult or impossible to enter larger more secure passwords and to monitor the client list etc… Kicking the admin off the router every 60 seconds is a security feature?
With the Surf I can easily enter new random ~40 digit upper/lowercase alpha/numeric/symbolic Wi-Fi passwords monthly, keep an eye on the client list while I am folding@home, and run Kismet on a non-networked laptop. The first year I owned the SOHO MK3 it received more updates than my old consumer grade router got in 5. Some of the updates even included new features - for free. It just keeps getting better.