up vote 0 down vote favorite
1
share [g+] share [fb]

I’ve currently got one computer behind a router with built-in firewall functionality, connected to a home cable-modem that has a single Ethernet port and one IP. I’m going to have to set up another computer for the rest of the family to use which of course will need to be connected to the Internet, probably wirelessly since the modem is in my room and the new system would not be.

What I would like to do is to get two more small routers with firewall capability and connect each computer to a router, which would in turn connect to the main router which connects to the cable-modem. That way, both systems have a hardware firewall protecting them (particularly the wireless system) and the burden of blocking would be reduced on both the computer CPUs and the main router because the secondary routers would handle some of the workload.

I’m trying to find out about the complexities inherent in this design and how I could set it up to work, specifically the IP handling and NAT aspect.

Thanks a lot.

link|improve this question
48% accept rate
2  
Do you expect computers withing your network to be able to communicate? – Zoredache Mar 5 '10 at 19:46
Nope. I don’t care about that. If I ever have a need to share files between the two systems, I’ll just use a disk. If I need to use share a printer, I’ll just pick it up and plug it into the other one. – Synetech Mar 5 '10 at 21:27
feedback

migrated from serverfault.com Mar 5 '10 at 20:06

This question came from our site for system administrators and desktop support professionals.

4 Answers

up vote 9 down vote

This idea is over engineered. Why is any of it necessary?

One router should be plenty for your home network of three computers on a cable Internet connection. There is no burden for the level of traffic you are describing.

link|improve this answer
1  
First rule of optimization: Don't do it unless you have a reason! Unless the OP has some other strange requirements that weren't mentioned in the question, one router should provide the protection and bandwidth necessary in a home setting. – heavyd Mar 5 '10 at 20:41
Yeah this is defintally over engineered. It will also be a nightmare if you needed to open any ports, because your going to have double, maybe even triple NAT. – jburke Mar 5 '10 at 21:29
There is no burden for the level of traffic you are describing. Tell that to my router which gets hot and always has a full log. Also tell it to my system which often slows to a stop when I download at my connection’s maximum speed, even with HTTP, let alone any sort of P2P. – Synetech Mar 5 '10 at 21:30
Also, as to why it’s necessary, the system wired to the router is fine, but the wireless one has a vulnerable space between it and the router where bad-guys could cause trouble… then again, I suppose if the router’s wireless functionality is correctly configured, it should be okay right? – Synetech Feb 3 '11 at 18:48
feedback
up vote 0 down vote

The extra routers would protect the computers from one another - is that your goal? If not, you don't need them.

link|improve this answer
Once configured, the routers would protect the computers that are connected to them from anything. I can set up the firewall rules to prevent both incoming and outgoing traffic, wherever it may come from, especially the wireless one which could pick up traffic from the neighborhood in addition to the primary router. – Synetech Mar 5 '10 at 21:29
It can be useful to run WiFi on a router next to the internet and provide a second router to route ethernet to your local computers. That would protect the wired computers from anyone on the WiFi while allowing the wired computers to communicate with each other. Providing a router for each computer will block them from communicating with each other without explicitly setting them up to allow it. Neither configuration will reduce the load on the gateway router. – JRobert Mar 5 '10 at 21:44
True, it would not reduce the load from incoming traffic. However, it would reduce the load from outgoing traffic: the routers (particularly the wireless one connected to the family computer) could be configured to block any and all unauthorized outgoing traffic. That way, anything that sends out too much data, say a bad P2P app, or an infection that may occur due to a trojan, would be sand-boxed to that system until it can be cleaned. As for the systems connecting to each other, I think you guys are all too LAN-minded. I just want to connect two systems to the Internet, not create a LAN. – Synetech Mar 13 '10 at 18:13
feedback
up vote 0 down vote

You're using home routers as hardware firewalls. They are nothing but toys and will not defend your personal data against hackers.

You need to invest in a real firewall, like a Cisco ASA 5505 or a Sonicwall, or Watchguard Firebox. Spend around $900 on a firewall, another 800 for IPS Signature subscription. As far as the wireless router goes, you could buy a regular WiFi router and use it as an access point – let the real firewall do all the routing and NAT.

link|improve this answer
> You're using home routers as hardware firewalls. They are nothing but toys and will not defend your personal data against hackers. Not true in the least. > Spend around $900 on a firewall, another 800 for IPS Signature subscription. Did I ever say anything about being rich or using this in a corporate setting? I clearly said one computer and home cable modem and family. What makes you think that spending hundreds or thousands of dollars on an enterprise solution even remotely applies to this question? – Synetech Feb 22 at 18:49
That's a pretty strong claim and a generalization that simply is untrue. – Oliver Salzburg Feb 22 at 18:49
feedback
up vote -1 down vote

I think you're getting a little too paranoid man. You gotta be up to something illegal. Get Zonealarm if you want to keep an eye on incoming and outgoing traffic. No need for a million routers all scattered about the apartment. In the end, it's piece of mind... and that's it.

link|improve this answer
Illegal‽ It’s the other way around genius; I want to keep criminals out of my systems and network. If you had bothered to read the question, the issue is in using a hardware firewall instead of a software like ZoneAlarm because a hardware firewall is a dedicated piece of hardware that does not have the resource overhead of a software one. – Synetech Apr 22 '11 at 21:26
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.