0

I asked a similar question on this topic and some guys recommended use VLANs or guest network, so I asked to a friend and he will give to me a router with guest network function. However, there is a device (my father's computer) that I want to also isolate, but guest network will not work totally since this computer use cable directly connect to the router.

This is my intranetwork currently:

          Another devices
                |
Internet --- Router 1 
                |     
       My father's devices

But I recently read that if I connect a cable from a router's LAN port to another router's WAN port, it's like isolate the devices, as devices in router 2 can connect to router 1, but not vice-versa.

This will work like this:

                      Another devices
                             |
Internet --- Router 1 --- Router 2
               |       
       My father's devices

My intention is, because security concern, isolate ALL the traffic between my father's devices and another devices in my home. So, my question is: Will the second intranetwork do that? I need, at least, that my father's devices can't communicate with another devices.

  • Yes this will work, provided that router#2 does NAT or has a firewall which separates the "internal" devices from the "external" ones. Note that "Router" is a very broad term which can mean lots of different things and within these lots of different configurations. Also, some "routers" actually can do guest network on LAN ports too. – Steffen Ullrich May 18 at 16:15
  • @SteffenUllrich, I don't know if I understand correctly. By default, the second intranetwork will do what I want, or do I need to configure something else? – Mycroft May 18 at 16:18
  • Your full specification of the device you use is "Router 2". It is completely unknown what actual device this is and how it is configured and what the defaults of this unknown device are. Therefore one cannot say if the unknown (default) configuration if the unknown device does what you need. – Steffen Ullrich May 18 at 16:23
  • If both routers performs NAT and "another device" would require VPN, this configuration might break NAT traversal. Otherwise this should work, but I'd still prefer VLANs. – Esa Jokinen May 18 at 16:42
  • 1
    @Mycroft: If you use different VLAN's for different networks you can make sure that these networks cannot communicate with each other but still can access the internet. As far as I understand your use case this should be all you need. – Steffen Ullrich May 20 at 4:26
0

Assuming that you would trust Router 2 to protect your devices from internet traffic on the WAN port, it would provide the same protection from your father's computers to the devices behind it on the network shown. The main disadvantage is that it might affect internet performance by adding another "hop". This probably does not matter in reality.

If you want to use port forwarding for the devices behind Router 2, it will require configuration on both routers. It might be possible to make Router 2 the DMZ of Router 1 to simplify this in the future.

Devices on the Router 2 network will have complete access to those in the Router 1 network unless firewall rules are added. Some fancy WAPs have firewall filtering that only allows backhaul traffic to the default gateway.

The evil maid problem may be a thing. It could happen in good faith if he just plugs his computer into any/the wrong port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.