Is a vulnerable router less of an issue when placed "behind" a secure one?

Question

Assume router A, which is secure with up to date firmware, and router B, which is less secure, with no longer updated firmware.

I have one router connected to the net socket (internet source), and the other router connected to the first one via WAN. Each router has a different router IP address, and two separate wifi access points.

From the perspective of security, is there any difference which router "comes first", that is, which is the router that connects to the internet source and then "forwards" it?

Note: For the purposes of the question, assume no other difference in use. Both routers are accessed by devices I control and for similar purposes.

Answer 1

TL;DR: It is a bad idea to place a vulnerable router on the network in the first place. But depending on the actual vulnerability and on the trust one has into other devices in the network it might be possible to at least reduce the impact of the vulnerability.

From my understanding you are proposing the following setup:

    Internet
       |          WAN A
    ----------
    |  A     |
    ----------    
    |  |  |  |    LAN A, WiFi A
       |
       |          WAN B
    ----------
    |  B     |     
    ----------
    |  |  |  |    LAN B, WiFi B

Assuming that both routers do NAT from LAN/WiFi to WAN the following observations can be made:

1. The devices in LAN A and WiFi A are accessible from LAN B and WiFi B, unless an explicit separation is done in router A (which is not even possible with many routers).
2. The WAN interface of A is accessible from the internet.
3. The devices in LAN A and WiFi A are not accessible from the internet, unless explicit port forwarding is setup in A.
4. Because of [3] the WAN interface of B is not accessible from the internet.
5. Similar to [3] the devices in LAN B and WiFi B can not be accessed from LAN A and WiFi A due to NAT in router B (assuming no port forwarding is setup).

It is assumed that a successful exploit means that the attacker compromises a router in a way that they have access to both WAN and LAN/WiFi side systems and maybe can also modify any traffic passing through the router. Based on this:

• If the router can be exploited from the WAN side
  then it would be a bad idea to use it as internet facing A. This way all devices in LAN A and WiFi A might be affected and additionally the internet facing traffic from devices in LAN B and WiFi B could be impacted. Placing such vulnerable router inside as B prevents attacks from the internet but still allows attacks from inside LAN A and WiFi A.
• If the router can be exploited from the LAN side or WiFi
  (for example by using a CSRF attack run through a browser inside LAN B) then it would be a bad idea to place it as internal router B. This way not only the devices in LAN B and WiFi B are impacted but is would also be possible to attack the devices in LAN A and WiFi A. Making such router instead internet facing as A, would still allow attacks from LAN A and WiFi A but no direct attacks against LAN B and WiFi B. But internet facing traffic from B might still be affected by a compromised router A.

Answer 2

Depends on how is configured the vulnerable router, if works as a transparent proxy/router probably is less vulnerable from the outside, however, you need to remember that upgrade/update your router should be something mandatory if you want to keep your network healthy in terms of security.

Answer 3

Doing this is basically equivalent to putting the device behind a firewall. Excepting any rare vulnerabilities in the packet handling code of the kernel and assuming no port forwarding to the inner router, this setup should protect from any remote attacks originating from the internet.

However, internet traffic is only half the battle; what about traffic originating on your local network? What if the router has a web interface, and there are vulnerabilities for authentication bypass, CSRF, and command injection (I have seen this exact case on at least one real consumer device; still unpatched probably)? If you visited a malicious webpage from a device on your internal network, the attacker could remotely take over the device. Or, if your computer is compromised, it could be used to launch attacks against internal services on your router.