My home office setup currently has a wireless router running DD-WRT NXT connected to a cable modem. Connected to this router are a number of workstations which I do not have to deal with that I assume are all infected with viruses, malware and root kits, one workstation that I do my best to keep secure, and a NAS that I also do my best to keep secure.

Right now I believe the major threats are from the crap on other people's workstations and someone on the outside attacking the router. I am not worried about malicious users attacking from within the intranet.

I would like to add a web server to the network, but do not know how to best layout the network to minimize the additional risks. While the plan right now is to only host static webpages, I am betting it will be running wordpress in the future if I demonstrate that I can keep a web server running. While it would be nice to host the files for the web server on the NAS, I am willing to host them directly on the server if this improves security.

I was thinking about was simply adding the web server to the network and forwarding the appropriate ports from the router. Does putting the web server on a separate subnet provide any additional security? What about adding a second router between the web server and the main network (i.e., the cable modem is attached to router A which is connect to the web server and router B which is connected to the NAS and workstations).

  • 1
    Some home routers support a DMZ. The issue with port forwarding is that if someone hacks the web server they're on your internal network. Although you say it's full of malware already, so that may not be an issue.
    – paj28
    Aug 17, 2016 at 15:32
  • @paj28 maybe I am wrong but I feel malware on a network behind a firewall is less dangerous then a malicious user penetrating the network from the outside.
    – StrongBad
    Aug 17, 2016 at 15:36
  • Consider your internal network a lost cause and just as untrusted as the Internet. Which means the server shouldn't treat the internal network differently from the real internet. Also when administering the server make sure not to use any unencrypted protocols and use strong authentication (SSH keys, client certificates, etc). Aug 17, 2016 at 22:37

1 Answer 1


There's two aspects you should consider:

  • The web server will be accessible from internet. That's a pretty big attack surface compared to all the other internal hosts.
  • Your internal network might be as dangerous as the internet, the web server should treat it as hostile as well.

You can address both aspects with a simple setup like this:

               _ -(    )- _           
          .--,(            ),--.      
      _.-(                       )-._ 
     (           INTERNET            )
      '-._(                     )_.-' 
        |  '__,(            ),__'     
        |       - ._(__)_. -          
                     \           \
        |             \            
                       \           \
        |               \
        |           _____\____       \
  Only port 80     [_.Router.°]        
        |           /        \         \
        |          /          \        No incoming traffic
                  /            \         \
        |        /              \          
        |       /                \         \
        v      /                  \         v
     .Public network----.         .Private network.
     |  ________        |         |  ____   __    |
     | |==|=====|       |         | |    | |==|   |
     | |  |     |       |         | |____| |  |   |
     | |  |     |       |         | /::::/ |__|   |
     | |  |     |       |         |               |
     | |  |     |       |<- - - - |               |
     | |  |====°|       |         '---------------'
     | |__|_____|       |  Pt 80 only

The dotted lines represent logical connections and the full lines are physical connections.

You just setup a separate subnet for the webserver and only allow access to it on port 80 (and perhaps 443).

You should be aware that this makes your router a single point of failure. In a SOHO environment this is usually the case anyway, but it doesn't necessarily have to.

Once this gets beyond the "just to see how it goes" phase you may want to consider hosting it on AWS or other cloud provider. You get the same level of control, much better redundancy, amazing scalability and great security for pennies.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .