WiFi / ethernet security

[#1]

I have just realised that the lodger in my house can theoretically get access to my computer because he uses my broadband in his room.  Actually his room has its own ethernet cable running from the main house router directly to his room which connects to an old slave WiFi router in the room.  It means that he has a good strong WiFi signal.

Now this is technically insecure, and I ought to find a way to protect my hardware from snooping !  His router password does not offer any protection even though it has a separate password.

So is there any way in which I could set up some parameters which would enable him to use the WiFi for connecting to the outside world only but barring him access to my hardware ?  Could I establish two network groups, one for him and one for my family with separate passwords / IP addresses ?  If that is possible, I do not know how to do it but I am sure there is someone out there who could tell me !

Thanks.

[#2]

You probably need to look at splitting your network into two VLANs.

None of the routers we ship support this functionality, however some after-market ones do.

A cheaper option would be to acquire a managed switch like this one (no affiliation), and have that look after the VLAN separation.

Expect to do a fair bit of reading up if you're not familiar with how these things work   

[#3]

Alternatively change your main router for one that can isolate the LAN port serving the slave wireless access point from the other LAN ports. Many models in the FRITZ!Box range can do this by enabling guest access for the “LAN4” port.

The dropdown on this knowledge document shows which models support this https://en.avm.de/service/knowledge-base/dok/FRITZ-Box-7530/949_Setting-up-LAN-guest-access-in-the-F...