1) Your Network vs Spectrum Network (Clean Separation)

Once bridge mode is enabled, your internal network should look like this:

Your Router (ASUS / OpenWrt / other)
↓
LAN: 192.168.x.x (or your custom subnet)

If Spectrum still has a hotspot or wireless service active, that traffic is not supposed to be bridged into your private LAN.
Instead, it is handled separately by Spectrum and kept outside your own routed network.

2) Spectrum Hotspot Isolation Model

Spectrum hotspot services such as SpectrumWiFi or Spectrum Mobile are designed to be isolated from your
own local subnet. In practical terms, users on that service are routed through Spectrum’s backend rather than through your
office LAN.

The traffic model is more like this:

User → Spectrum hotspot → Spectrum network → Internet

It is not supposed to work like this:

User → Your LAN → Your local devices

3) IP Addressing Difference

Your LAN Devices

Devices behind your own router typically receive private addresses such as:

• 192.168.50.x
• 192.168.1.x
• or another subnet you configured

Spectrum Hotspot Users

Users on Spectrum-managed WiFi do not receive addresses from your router’s DHCP service. They are assigned addresses from a
separate network under Spectrum’s control.

That means they are on a different addressing domain and are not part of your own private client space.

4) Can They Reach Your Network at All?

Direct Access

Under normal conditions, no. Users on Spectrum’s WiFi or hotspot service should not be able to directly browse
to your NAS, printers, workstations, cameras, or other local devices just by being on Spectrum’s wireless service.

Indirect Edge Cases

The main exception is not hotspot access itself but internet exposure caused by your own configuration. Examples include:

• Port forwarding on your router
• Exposed remote administration interfaces
• UPnP-created mappings
• Other intentionally public services

In those cases, someone may be able to reach a service from the internet, but that is different from being placed on your LAN.

5) Important Nuance: RF Space vs Network Access

Even if Spectrum hotspot users cannot access your local network, they may still share the same physical radio environment.
That matters for performance, not for LAN security.

• Security impact: normally none, assuming your router is configured properly
• RF impact: possible additional wireless congestion or interference

In other words, they may share nearby 2.4 GHz or 5 GHz airtime, but they should not share your private routed network.

6) Your Specific Setup: Best Practice

The best-practice model is straightforward:

• Leave Spectrum in bridge mode
• Use your own router for:
  • DHCP
  • NAT
  • Firewall policy
  • LAN segmentation
  • WiFi

Architecturally, the preferred layout is:

[Spectrum modem in bridge mode]
            ↓
     [Your ASUS / OpenWrt router]
            ↓
   [All WiFi + Sonos + LAN devices]

7) Quick Verification Checklist

• Your router WAN address is public, not a private address such as 192.168.x.x
• Your LAN devices are on your own private subnet
• Any Spectrum SSID still visible is not the same as your SSID
• No unexpected devices appear in your router’s DHCP client table

8) Mental Model to Keep

The cleanest way to think about it is this:

The shared hardware enclosure can make it feel like the same network, but from a routing and addressing standpoint it is supposed
to be separate.

Bottom Line

If Spectrum bridge mode is active and your own router is handling the local network, users on Spectrum’s WiFi or hotspot service should not have direct access to your LAN. They are normally assigned to a different network with separate addressing and separate routing.

Your real security boundary is your own router, so that is where your LAN protection, segmentation, and service exposure controls should be managed.