do different subnet masks on home network provide any security?

Question

So I have two routers on my home network: one is provided by my ISP, and the other is my private router. Router A- ISP router: 192.168.1.x router B- private router: 192.168.2.x

Clients on my router A's LAN network cannot ping clients on my B's network. However, clients on B can ping clients on A. Does this provide any security, if I allow friends/visitors to use my ISP's router? Or is this only security through obscurity. So if an attacker managed to get into router A, can they see clients on router B easily?

Answer 1

Well that's happening because it's probably using NAT for router B. It's not bad but it's not bad practice. Obviously if they can get into router A then technically they can indeed take over the network. So if router B sends traffic router A will see that flow.

Now if you want a good setup, the key is to make several subnets and restrict them accordingly. For instance make three different subnets:

• 192.168.1.0 management
• 192.168.2.0 trusted
• 192.168.3.0 visitors

These networks should be separated and should not route between each other (but you can route from trusted to visitors, but not vice versa (firewall function)). You can then assign a port on your router which has the 192.168.1.0 network configured so you can access the managment interface (this should not be reachable from the two other networks). This prevents attackers from accessing your routers.

Answer 2

It's not exactly security through obscurity,but more like circumstantial security. Since clients of B are internally NAT'd, they can ping A but not the other way around, similar to how you can ping only the router of another friend on the Internet since they too are prolly in a NAT.

Speaking from experience in offensive security, a network like that can be compromised in several ways right from attacking the router B (hosting your private subnet) to ARP Spoofing or network traffic analysis. This would however depend upon the expertise of the attacker.

Like Lucas said, Firewall policies are definitely one way to secure yourself better, but judging by your post this matter is of house-hold security not a corporate.

But, since this is really not a problem when internal clients are concerned (the attacker ie. would have to be in your house), so just ensure your WiFi is well secured towards externals. The WiFi Alliance has a paper on securing personal WiFi.