I'm looking at doing this, where I have 2 routers in the setup to protect a group of networked computers from other computers.

It would look like this: Internet - Modem - Router A (other computers) - Router B (networked computers)

Will this actually prevent malware from accessing Router B from Router A's computers? On a side note, should I use different brand routers when making this setup?

Thank you very much.

  • It depends on the router brand and ios,normal router will support stateless access-list but if you have router with firewsll features you can define statefull firewall rules. – Mr.lock Mar 16 '17 at 8:09

That's not a very good idea, it's prone to MiTM attack since LAN B is a part of LAN A. Anyone with access to the latter can control what happens between modem and LAN B. The inner firewall won't help much against a dedicated attacker with access to LAN A. If nothing else, he/she could extract sensitive information from computers inside the private network through network communication.

Better option would be to reverse the situation and limit the public LAN group inside the private LAN according to the least privilege principle. Also, you can always monitor the switch where public network (LAN A) connects to (LAN B) and potentially set up some rules against various type of scans.

It needs to be said though that neither options are bulletproof. The safest option here, if you can afford it, is to have two modems connecting to two different ISPs. One for private network and the other for public, totally separated from one another.

  • What options are there for limiting the public LAN group in the private LAN? Is that using vlan, or dmz, etc? Also, is it prone to anything else other than MITM attacks? Thank you. – Smiith Mar 16 '17 at 13:36
  • For the first part of the answer, there is no 'click on a button' solution. You would need to setup a switch, a computer with custom configuration to act as a failsafe between your private and public network, possibly equipped with NIDS and HIDS, sth like Snort and Tripwire. You could make it act as a wifi router or you could attach the router to it and, optionally, also make another firewalled switch for private network to join the other switch in the outer network, to prevent discovery. Even if the attacker makes progress from public network through the switch to outer network...to be cont.. – user633551 Mar 16 '17 at 16:06
  • he would only discover the other switch and some of the other untrusted machines that you have decided to keep them away from important information. At this point he would be able to sniff traffic but still unable to access your private network. However, you would also get notification that your public switch has been compromised and could pull off the plug. The second part, yeah MiTM only if those computers are updated and properly secured and then left alone from within because user role plays a huge part. – user633551 Mar 16 '17 at 16:14
  • What do you mean by switch? Is it actually a seperate computer or is it just a switch device that gets configured? And I should check, what would the end setup look like? Thank you. – Smiith Mar 16 '17 at 20:51
  • Layout is 3 networks, the outer network(ON) that goes from modem through the router. Here are both of the switches and bunch of other machines needed for mailing n stuff. The switches then have their own subnets. You could go with both computer or configured switch device, though I think you can have a better setup on a computer with linux OS for example. The key is to have the public switch under the least privilege policy in the ON as well as under close inspection and not directly connected to your private network. Just remember that private switch borders on 2 dangers, WAN and other switch – user633551 Mar 20 '17 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.