I am trying to design my next home network and I was curious if there was an accepted pattern or if something like my design would work.

-> Main Gateway AT&T Duel Modem Router combo
    |-> Nice Firewall something like a Sophos
            |->DMZ Router cheap router
                |->Web Server - Public facing
            |->LAN Router cheap router
                |->Home Network - xbox, pc's, iot devices
            |->Lab Router cheap router
                |->Pentest Network - vulnerable VM's galore 

Would a setup like this benefit or hurt my network's security?

The caveat here is that I know very little about networking which is why I am trying to setup something complex at home.

My goals here are as follows

  • All three sub networks have access to the web
  • My Lab network isn't visible from the web
  • My Lab network can't see my home network or my web server.
  • My web server cant see my home network or my lab environment

I don't know if this is possible yet but that's why I am doing this.

  • 1
    it all depends upon what you want to secure. and what level of security you need. if you want to just protect from malware/virus, then basic security would be enough. Oct 7, 2016 at 14:53
  • 2
    @HamzaIslam I have updated my question with goals Oct 7, 2016 at 14:58
  • but still you are missing the main goal that why setup all this in such way. do you want to do penetration testing but remain anonymous? or stop attacks to your whole network from hackers? or else Oct 7, 2016 at 15:00
  • @HamzaIslam I want to have a home network that I can reasonably trust. My web server hosts blog posts that are security focused. Those topics will be generated in my lab. If someone is being cheeky and decides to attack my network I want it to have the best chance possible. Oct 7, 2016 at 15:02
  • 3
    Instead of having three cheap routers which could have vulnerabilities without any patches, you only need a four ethernet ports on your Sophos box with some routing table/firewall setup.
    – billc.cn
    Oct 7, 2016 at 15:33

2 Answers 2


Based on the information you have provided, i think you should start with having: - a good firewall (Sophos is ok, IF it has WAF (web app firewall) as blogs are mostly attacked using app level). But if you dont want to pay, then pFsense is also a good choice, its an all in one firewall.

  • host it behind cloudflare or incapsula (preferably paid packege having WAF and DDOS prevention in it)

  • IPS/IDS for detection and prevention of attacks (pFsense has snort for it or suricata)

  • Network design seems to be ok, so its better to have vLANS for network segregation

  • Monitoring system (with logging based on any SIEM, like OSSEC)

I think that should be enough for you


Also consider the following (they're also available under pfsense as well, if you go that route, but probably available on many other platforms:

As its a home network, I assume guests will use it. Set up 2 subnets that are separated, one for trusted use and one for everything else. Set rules that stop the 'everything else' network speaking other than to the WAN, or at least very limited other LAN locations. Use certificate based authentication not WAP2 on the trusted network (802.1X /WPA2-enterprise), its not hard to set up and it makes the network a lot more secure as you need a certificate (saved on your device) and password not just a password. Or look up OTP (one time password) which are those little tokens that change unpredictably and make 2 factor login possible. Don't trust MAC authentication as it can be spoofed. These will raise the barrier for people trying to get network access without permission.

Probe your own network - pfsense has nmap, use it. Check with online port scanners.

Assume your own laptop/device is a possible weakness (if someone controls that they get the network too). Ensure its secure and use good practices there.

Run squid + a network based malware scanner, and an IDS like securicata or snort. It won't solve everything but will catch a lot of known attempt types.

As for pfsense, one other idea - instead of multiple routers, get a 2008 core2 board (dual core or Q6600 or similar, they're all cheap) with 4gb ram for £50/$75 and a small (8-16gb) ssd off eBay (sometimes called a "disk on module"), put pfsense on it, and stack it with 2-3 network adapter cards off eBay (Intel if able and able to handle vlans for when you need them, most Intel Gb cards will). It'll cost less than an OEM router and it'll handle all the above with plenty of juice to spare, and handle any routing and firewalling you're likely to need between half a dozen local networks (whether physically separated on different poirts or logically separated by vlans). Don't worry about server quality - this kind of board can last many years and is cheap to replace/fix 2nd hand if it goes, and you don't need 99.9999% uptime.

Random ideas. Good luck!

  • pcengines APU is cheap for this purpose Oct 7, 2016 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.