Can still ping from secure network?

Question

I have a standard network and wanted to make a more secure one so I bought a second router and set it up as a separate network daisy chained so it can get internet.

I managed to make the setup, with one network having addresses from 192.168.1.60 - 192.168.1.253 (router was 192.168.1.254. The second router had addresses from 192.168.0.1 - 192.168.0.50 (router was 192.168.0.1). Subnet mask is class C 255.255.255.0.

However I found with this setup, I could still ping devices from the x.x.0.1 network to the x.x.1.1 network. Does this represent a security issue as I thought the two networks are separate and so should not be able to ping each other?

Answer 1

Does this represent a security issue as I thought the two networks are separate and so should not be able to ping each other?

Whether or not it is a security issue is up to you, but the router is behaving normally.

Because the router is directly connected to both networks, it understands how to send traffic between them. To avoid this, you can implement ACLs (firewall rules) or separate the traffic into vlans.

It should be noted that testing connectivity with ping is only testing the ability of ICMP packets to traverse the network. Your firewall rules can be set to block ICMP packets, so pings will fail, but there will still be connectivity. In order to truly segregate the networks you would need a deny all from one network to the other, or split the networks into two vlans and only allow each vlan to access to itself.