Using with ONE LAN interface GATEWAY

Hi,

I'm a bit confused by the design.
you place 2 doors within the same network and hope your users & devices use the correct one?
Some other applications may "see" the other door and ignore the correct way.

Moin, its only for home-use and family. Theoretically every smartphone via USB on a PC is a door :-) They have no local admin/root-rights on the devices, so the GW is 'secure'. The main use-case are the proxy-blacklists.

While your setup may fit your needs and they have no local admin on the devices they might be able to start their devices with a linux live environment and go directly to the fritzbox as gateway.
Why not simply add a 2nd NIC in the machine and do proper LAN to WAN routing with no easy options to bypass the firewall (other than physically plugging cables)?

For routing I need 2 different networks. But I wont change all LAN Client-IPs and I will not change the IP of the Fritzbox-Router and the Router can only handle 1 IP on its LAN Interface. To be really secure I also need a tresor to prevent plugin a RJ45 Cable to the Router, better a MDM, NAC, glue up all USB-Ports and lock up all pc-housing, authenfication only with an RFID Implantat to every family members forehead.

Sure, you could do all that. But I see now you don't want anything to change and are not willing to change LAN Client IP's which may all have static IP's now to have a reservation in the DHCP server so they still have a "fixed" address.

We just tried to advise you on a situation that would give better protection and would make better use of the capabilities of the firewall. If that is not what you are looking for then I think in that case Lucar Toni's answer might be your best option.

I want more a technical discussion than a preaching morality

But right now, everybody can simply change there Gateway to the fritzbox, completely bypassing everything? 

But right now, everybody can simply change there Gateway to the fritzbox, completely bypassing everything? 

Everybody can simply plugin a 5G Stick and completely bypassing everything. Normal OS have a right-management, so not everybody can change the gateway.

So, which question is open? As stated, you can do a Route 0.0.0.0 and this will work.