I have a device that is connected to Raspberry Pi via Ethernet cable. The Pi is connected to internet via WiFi. The device should not be visible from the main home network, which has 10.0.0... ip address range. How do I setup a 192.168... subnet on Raspberry’s ethernet so it can communicate with the device via UDP ? The device itself does not need to access wan.
The easiest way is to use static IP addresses, if your device supports that. Give the device IP address 192.168.1.100 netmask 255.255.255.0 and your pi's ethernet adapter the address 192.168.1.101, same mask.
Another fairly easy way would be to buy a cheap router/switch thing with a DHCP server in it. You probably won't need gigabit speeds. This has another advantage: you can connect the "wan" interface to your home-network and allow port forwarding to the Pi. And you will probably have a few spare ports on the 192.168-lan, which can be useful.
Of course, it is also possible to set-up a DHCP server on the Pi. In that case, you can connect the device directly to Pi (no switch or cross-over cables are needed). There are plenty tutorials on how to set-up such a server (see reply by @ingo)
You can use systemd-networkd that provides everything out of the box, including a DHCP server. You only have to configure it, no need to install additional helper programs. First setup the WiFi connection. You can Use systemd-networkd for general networking, following section ♦ Create interface file for a WiFi connection.
Then create this file for the wired interface to the device:
rpi ~$ sudo -Es # if not already done rpi ~# cat > /etc/systemd/network/04-wired.network <<EOF [Match] Name=e* [Network] Address=192.168.0.1/24 MulticastDNS=yes DHCPServer=yes EOF
Because there is no ip forwarding or routing enabled, only the RasPi can connect to the device and there is no way for the device to your local network and vice versa and to the internet.
As suggested by @LjmDullaart I set static ip address to ethenet adapter in /etc/dhcpcd.conf
in section eth0 with no other changes. Please note you will not see the change in ifconfig unless someting is connected to the ethernet port. So now my device is connected to pi and there is no access to it from the outside world, just what I need.