My goal is to isolate a computer on my home network. This computer (a rapsberry pi) should be considered untrusted and is accessible from the internet (port 22). I need a solution that will prevent this raspberry pi from accessing or interacting with my home network in any way in the event that it's compromised. Similar questions have been asked before, but I want to know if the following setup will work.

Here is my attempted solution, please let me know if you see any major problems with it from a security perspective.

My example home network now, without the Pi:

                             ┌───────> PC 1
Internet <───────> Router <──┼───────> PC 2
                             └───────> Network Drive

My planned network:

                                                  ┌───────> PC 1
Internet <───────> Router A <───┬───> Router B <──┼───────> PC 2
                                │                 └───────> Network Drive
                                │
                                └───> Router Z <──────────> Raspberry Pi

Router A is used mainly for internet NAT and firewall. Router B is used for the firewall to prevent the Pi from connecting to any of the home PCs. Router Z prevents the Pi from spoofing the address of router B and intercepting communication (would this work?). All routers (A, B, and Z) will have NAT enabled to keep the networks separated. Routers A and Z will forward port 22 to the Pi.

Hardware: I do not have business-class networking hardware, but I have an Apple Airport Extreme (Router B) and some random Linksys routers (Routers A and Z).

This solution may have networking issues, and I'd be glad to hear them, but my top priority is security. Are there problems with this setup, or improvements that can be made? Or am I taking a completely wrong approach?

Potential problem: The Pi will have access to the login page of Router Z, and due to possible vulnerabilities in the router, may be able to turn NAT and the firewall off on Router Z.

Aside: This is a just-for-fun project. I plan on securing the Pi with ssh key authentication, so this is a defense-in-depth scenario. I may want to run other services from the Pi in the future (possibly a VPN), and I know that I'm no security expert, so I may make mistakes in terms of software on the Pi, and want the networking setup to act as a last defense. I'm mostly worried about script-kiddies since I'm not going to be a prime target for hackers, but I'll implement other security and obscurity techniques like disabling password login, using port-knocking, etc on the Pi.

  • This looks more like a networking issue than a security issue. I would look at it not from a "router" perspective, but a "network and routing" perspective. We can advise on the network and routing perspective, but with your hardware limitations, you have another layer of implementation that comes into play that we cannot advise on. – schroeder Feb 9 '16 at 18:02
  • From a network and routing perspective, you could simply add the untrusted computer to the existing router and implement VLANS, routes, and segregated networks. But your hardware might prevent this. – schroeder Feb 9 '16 at 18:03
  • Have you ever heard of Security Now? The pod cast from 2 FEB 2016 talks about this same scenario. twit.tv/shows/security-now/episodes/545?autostart=false is the link to the show called three dumb routers. Essentially is it designed with security in mind using simple hardware that you would have laying around the house. As well as using the same design as your second diagram. – RB4 Feb 9 '16 at 18:04
  • Thanks @schroeder, I looked into VLANS (and I'm not familiar with the other two, but I'll read up), but like you said, my networking hardware limits this. That's why I went with this three-router approach. Maybe I could install DD-WRT on one of the Linksys routers to create a VLAN. And if you think this is better for somewhere like SuperUser feel free to move it, or to close it if you think there's not enough information. – Steve Feb 9 '16 at 18:16
  • And thanks @RB4, I'll take a look at that podcast, that sounds like it'll be a helpful resource (can't upvote comments). – Steve Feb 9 '16 at 18:16

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.