Karl Auer

Do you want the SOHO subnet to have wifi access too?

Either way, something like a Mikrotik RB951G-2HnD will do the trick
nicely - one wifi interface, one GigE WAN interface, four GigaE LAN
interfaces, all separately configurable, groupable, bridgeable -
whatever. And a massive feture set behind them.

For your specific case, put the Internet on ether1. Put the wifi subnet
on wlan1. Set up the SOHO network on ether2. Leaves you ether 3, 4 and 5
free.

If you want wired access for the SOHO network, bridge ether3 to ether2,
get a cheapie AP and plug it into ether3.

Regards, K.

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer*******/kauer389

GPG fingerprint: B862 FB15 FE96 4961 BC62 1A40 6239 1208 9865 5F9A
Old fingerprint: AE1D 4868 6420 AD9A A698 5251 1699 7B78 4EEE 6017

Welll - the packets might make it out, and be transmitted into the
Internet, but they would have a legitimate source address, namely an
outside address of the NAT router. A side effect of NAT is to clamp the
source address range of outbound packets to the configured NAT outside
address range.

Regards, K.

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer*******/kauer389

GPG fingerprint: B862 FB15 FE96 4961 BC62 1A40 6239 1208 9865 5F9A
Old fingerprint: AE1D 4868 6420 AD9A A698 5251 1699 7B78 4EEE 6017

Read more »

If the script will be running as root, you cam use the -u option to sudo
to run any command as any user, without a password. see "man sudo".

So just write your script, and use sudo to run the single command that
must be run as a particular user.

Warning: I have not tested the above answer. Test, and test with care.

Regards, K.

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (kauer*******/blog

GPG fingerprint: B862 FB15 FE96 4961 BC62 1A40 6239 1208 9865 5F9A
Old fingerprint: AE1D 4868 6420 AD9A A698 5251 1699 7B78 4EEE 6017