My home office setup currently has a wireless router running DD-WRT NXT connected to a cable modem. Connected to this router are a number of workstations which I do not have to deal with that I assume are all infected with viruses, malware and root kits, one workstation that I do my best to keep secure, and a NAS that I also do my best to keep secure.
Right now I believe the major threats are from the crap on other people's workstations and someone on the outside attacking the router. I am not worried about malicious users attacking from within the intranet.
I would like to add a web server to the network, but do not know how to best layout the network to minimize the additional risks. While the plan right now is to only host static webpages, I am betting it will be running wordpress in the future if I demonstrate that I can keep a web server running. While it would be nice to host the files for the web server on the NAS, I am willing to host them directly on the server if this improves security.
I was thinking about was simply adding the web server to the network and forwarding the appropriate ports from the router. Does putting the web server on a separate subnet provide any additional security? What about adding a second router between the web server and the main network (i.e., the cable modem is attached to router A which is connect to the web server and router B which is connected to the NAS and workstations).