My goal is to isolate a computer on my home network. This computer (a rapsberry pi) should be considered untrusted and is accessible from the internet (port 22). I need a solution that will prevent this raspberry pi from accessing or interacting with my home network in any way in the event that it's compromised. Similar questions have been asked before, but I want to know if the following setup will work.
Here is my attempted solution, please let me know if you see any major problems with it from a security perspective.
My example home network now, without the Pi:
┌───────> PC 1 Internet <───────> Router <──┼───────> PC 2 └───────> Network Drive
My planned network:
┌───────> PC 1 Internet <───────> Router A <───┬───> Router B <──┼───────> PC 2 │ └───────> Network Drive │ └───> Router Z <──────────> Raspberry Pi
Router A is used mainly for internet NAT and firewall. Router B is used for the firewall to prevent the Pi from connecting to any of the home PCs. Router Z prevents the Pi from spoofing the address of router B and intercepting communication (would this work?). All routers (A, B, and Z) will have NAT enabled to keep the networks separated. Routers A and Z will forward port 22 to the Pi.
Hardware: I do not have business-class networking hardware, but I have an Apple Airport Extreme (Router B) and some random Linksys routers (Routers A and Z).
This solution may have networking issues, and I'd be glad to hear them, but my top priority is security. Are there problems with this setup, or improvements that can be made? Or am I taking a completely wrong approach?
Potential problem: The Pi will have access to the login page of Router Z, and due to possible vulnerabilities in the router, may be able to turn NAT and the firewall off on Router Z.
Aside: This is a just-for-fun project. I plan on securing the Pi with ssh key authentication, so this is a defense-in-depth scenario. I may want to run other services from the Pi in the future (possibly a VPN), and I know that I'm no security expert, so I may make mistakes in terms of software on the Pi, and want the networking setup to act as a last defense. I'm mostly worried about script-kiddies since I'm not going to be a prime target for hackers, but I'll implement other security and obscurity techniques like disabling password login, using port-knocking, etc on the Pi.