1

I am trying to secure my network from some infected computers(the owners dont seem to understand what security means) So I have a second router to make a bridge. What would be the best approach at isolating the network?:

router(infected comps)>router(good comps)>internet

or

router(good comps)>router(inected comps)>internet

I am more looking into preventing sniffing and MITM but pretty much any attack that can come from this situation.

2

The key would be to firewall off the infected computers from the good computer, so if your routers provide firewall capabilities, I'd recommend that you ensure that traffic can't go from "good LAN" to "bad LAN" and vice versa. Also ensure that the router management interfaces are only available on the "good LAN".

If you think about it, in principle you're just treating the "bad LAN" like the Internet (e.g. a network that you don't trust). so if you have your second option there, just make sure that any traffic leaving "good LAN" is encrypted and that there's no management interfaces visible on the "bad LAN" side of the router separating them.

  • How can I close the routers control panel from being visible to its own network( bad LAN)? Since if the bad LAN can manage the final router before the internet then they can do anything. – user36976 Feb 17 '14 at 14:10
  • hmm well depends on the router... I'm assuming here you have control of the network, so you can set creds for the login. Ideally you'd limit the IP addresses that can manage the system, but failing that you could set strong usernames/passwords and just don't tell the people on "bad LAN" :) In terms of them doing anything, well not really, if all your traffic is SSL encrypted and you check certificates, they shouldn't be able to easily intercept your traffic... – Rоry McCune Feb 17 '14 at 14:16
  • Oh also does that setup leave a increased attack surface for MITM attack from the infected computers? – user36976 Feb 17 '14 at 14:35
  • yep if traffic transits a potentially hostile network and it's not using protocols which resist such attacks (e.g. properly configured SSL) there is a risk. With the other way round the risks are a bit different (you need to be careful that "bad LAN" machines can't send traffic to "good LAN" machines on their way to the Internet... – Rоry McCune Feb 17 '14 at 14:40
  • I dont think DMZing the good router on the bad router does any good does it? – user36976 Feb 17 '14 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.