I currently own a Draytek Vigor 2820. It is running an unrestricted internal network.

I wish to do the following:

Have 2 internal networks.
Each on different subnets.

The first on 10.0.0.xxx
The second on 192.168.1.xxx

The first will be unrestricted and allow all computers to talk to each other
The second to be restricted and only allow internet access and the computers *not* to see each other.

The first will come out of the draytek say ethernet 1 and go into a large switch

The second will come out of the draytek ethernet 2 and again go to a large switch.

Is the above even possible in any degree in the full capacity i want or in a limited scope, or should i look at simply tagging an additional router onto my draytek to sort this out?

Any advice and input is appreciated!

How about 2820 connected to internet with VLAN enabled keeping Port 1 and Port 2 seperate.
Port 1 -> Draytek 2110 (or any DHCP enabled DSL modem) - issuing 10.0.0.x addresses
Port 2 -> Draytek 2110 (or any DHCP enabled DSL modem) - issuing 192.168.0.x addresses

On the 192.168.0.x Draytek 2110 put something like a Netgear GS748T switch which allows you to run 48 VLANS, i.e. each port will only see itself and the router. The users would get DHCP from the router and the 2110 would forward packets to the 2820 giving all of these users access to the internet.

On the 10.0.0.x Draytek 2110 you could put any large switch (possibly the GS748T again but without VLANS enabled). All of these users would get DHCP from the router, would still see each other, and would also see internet via the 2820.

Richard