1

I was wondering if I can make an artificial firewall by using two routers (Referred as Router 1 and Router 2). My server will be on router #1 while router #2 hosts all the other devices on my network. I was thinking that router #2 could be a total separate "entity" and appear as a singular device on the network. So if people breach the server only router #1 will be breached, and router #2 could still stay protected. Ill try to show you in a more visual way.

Router#1 (192.168.0.1) /Server "FreeBSD 10.0" (192.168.0.2), Router#2 (192.168.0.3)

As you can see Router #2 would look like any normal device to Router #1

(it will look like 192.168.0.3 to router #1) Router #2 (192.168.1.1)/ PC "Windows 7" (192.168.1.2), PC "Windows 8.1" (192.168.1.2)

Will this setup work, has it been done before, these are my questions. What can I do to make this work?

| improve this question | |
  • The configuration you propose is nothing unusual, however to get an answer from a security perspective you should provide at least information what do you try to protect and from what threats. – techraf May 31 '16 at 4:54
  • I will probably edit my question to have a visual picture – Nicholas Awesomepants May 31 '16 at 14:07
2

Assuming the routers you are using have stateful access lists then they can be used as basic network firewalls and the design you have will provide some very basic defense in-depth benefits. If it's a possibility you may want to block all inbound packets initiated by the Free-BSD server entering the second router (clients behind the second router can still access the server but not vice-versa because TCP ACK 0 packets inbound to the internal network will be blocked).

Will it work ? yes but it might be easier if you segment the network ranges so they don't overlap. Maybe use a 192.168.1.x network and a 192.168.2.x network (there's a LOT of ways to do this, I'm just throwing out a really basic example)...

Has this been done before ? Yes, a long time ago before firewalls were popular and inexpensive this is one way people segmented networks.

Note: Just because this works doesn't mean it's a good idea. Some routers temporarily drop their filtering rules when under duress and allow "all" traffic through. Firewalls don't generally behave this way. Likewise almost any firewall will offer a lot of additional features that the routers won't be able to offer you.

If you are on a budget I would highly recommend simply using something like IPTables or PFSense.

As a side note if your First router has 3 interfaces you can also use one interface to connect to the Internet, a second for your Free-BSD server and then use the third for your internal network and not need the second router to create the same type of segmentation. (think Y-shaped network diagram)

| improve this answer | |
  • The OS I'm using (FreeBSD 10.0) does not have IPTables, it has PF, IPFILTER, IPFW. As you might see, I am fairly new to security. Which one of these firewalls is good for Basic Security, I believe PF is somewhat like IPTables but I'm not sure.Click here for the documentation – Nicholas Awesomepants May 31 '16 at 16:14
  • IPTables was just a general suggestion. As mkin also mentioned you can use ipfw. I recommend deploying host-based firewalls on all systems this configuration is sometimes called a Zero-Trust firewall configuration and it helps reduce connections between systems to only those connections that are absolutely required. – Trey Blalock May 31 '16 at 16:59
0

Since you have freebsd, you can use ipfw for firewall usage. Though, if you understand how breaches work, they don't start from the outside in, they're mostly inside out.

Firewalls can stop outside scanning to internal networks, but internal hosts get compromised and that is a different kettle of fish.

| improve this answer | |
  • Your answer could use more details and I'm confused about the beaches reference – Neil Smithline May 31 '16 at 4:16
  • 2
    Confusing formatting, there's no need to edit your post with pseudo editing regsubs, just make the edit. – Johnny May 31 '16 at 4:53
  • I think he meant breaches not beaches. – Nicholas Awesomepants May 31 '16 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.