Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I’ve currently got one computer behind a router with built-in firewall functionality, connected to a home cable-modem that has a single Ethernet port and one IP. I’m going to have to set up another computer for the rest of the family to use which of course will need to be connected to the Internet, probably wirelessly since the modem is in my room and the new system would not be.

What I would like to do is to get two more small routers with firewall capability and connect each computer to a router, which would in turn connect to the main router which connects to the cable-modem. That way, both systems have a hardware firewall protecting them (particularly the wireless system) and the burden of blocking would be reduced on both the computer CPUs and the main router because the secondary routers would handle some of the workload.

I’m trying to find out about the complexities inherent in this design and how I could set it up to work, specifically the IP handling and NAT aspect.

Thanks a lot.

share|improve this question

migrated from Mar 5 '10 at 20:06

This question came from our site for system and network administrators.

Do you expect computers withing your network to be able to communicate? – Zoredache Mar 5 '10 at 19:46
Nope. I don’t care about that. If I ever have a need to share files between the two systems, I’ll just use a disk. If I need to use share a printer, I’ll just pick it up and plug it into the other one. – Synetech Mar 5 '10 at 21:27
@hit-and-run–down-voter, you should explain your problem, less your opinion be useless and meaningless. – Synetech Nov 7 '12 at 19:38

This idea is over engineered. Why is any of it necessary?

One router should be plenty for your home network of three computers on a cable Internet connection. There is no burden for the level of traffic you are describing.

share|improve this answer
First rule of optimization: Don't do it unless you have a reason! Unless the OP has some other strange requirements that weren't mentioned in the question, one router should provide the protection and bandwidth necessary in a home setting. – heavyd Mar 5 '10 at 20:41
Yeah this is defintally over engineered. It will also be a nightmare if you needed to open any ports, because your going to have double, maybe even triple NAT. – jburke Mar 5 '10 at 21:29
There is no burden for the level of traffic you are describing. Tell that to my router which gets hot and always has a full log. Also tell it to my system which often slows to a stop when I download at my connection’s maximum speed, even with HTTP, let alone any sort of P2P. – Synetech Mar 5 '10 at 21:30
Also, as to why it’s necessary, the system wired to the router is fine, but the wireless one has a vulnerable space between it and the router where bad-guys could cause trouble… then again, I suppose if the router’s wireless functionality is correctly configured, it should be okay right? – Synetech Feb 3 '11 at 18:48

Are you able to acquire a second-hand computer? If so, you could use something like IPCop to handle the firewall. It would sit between your modem and your router.

You could (possibly) also set it up to handle DHCP/DNS to nix the router, but you would still need a switch.

share|improve this answer

Any reason why you can't replace the existing router with a better one, rather than adding two additional routers in a complex setup? That seems to be the most elegant solution. Any COTS WiFi/Router/Switch combo device should be more than sufficient. Does your current router have any sort of special/advanced firewall features that you don't want to lose?

Besides, any network processing performed by your computers is negligible. I agree with the first post that you're being overly-paranoid and trying to over-optimize.

share|improve this answer
Aside from, cost? What I was thinking was using a router as hardware firewall instead of using software, so aside from the performance impact (which is an issue; just Google for examples), having a separate, hardware device blocking connections before they even get to the system is definitely better than software (especially for a wireless connection). I recently explained in detail the benefits somewhere, but I cannot seem to find the comment/answer. – Synetech Jan 4 '13 at 20:33
I suppose what I'm asking is, what can your current device do that another one cannot? If you have two hardware devices chained with firewall capabilities, the first one will block any intruders, and the second one will have nothing to filter. I must be missing something, do you have two additional routers lying around somewhere? If not, you're going to have to shell out $$ for those. Instead of buying 2, just buy 1 and replace the existing one. Additionally, what kind of system do you have, the one which slows down when downloading something? It sounds like a completely different problem. – Bigbio2002 Jan 4 '13 at 23:31
If you have two hardware devices chained with firewall capabilities, the first one will block any intruders, and the second one will have nothing to filter. Correct, but what if you take a laptop out of that network and connect it to another one, like at a coffee shop? Granted, having a router dangling from a laptop’s Ethernet port is not sleek, but it would be a useful digital prophylactic for the laptop, and people already have all kinds of stuff hanging from their laptops. Moreover, isn’t necessarily a commercial router; e.g., one could be made from a tiny Raspberry Pi. – Synetech Jan 5 '13 at 17:27
Basically, I’m wondering about wrapping a system (or rather, each system) with its own dedicated piece of hardware protection. That it happens to usually come in the form of a router is merely a complication due to the networking aspect. – Synetech Jan 5 '13 at 17:29
Let's say you find some kind of USB firewall dongle to use, and all incoming ports are blocked via this device (not that it can't be done with the built-in Windows firewall). It doesn't protect you from visiting a malicious site, or getting served a malicious ad on a legit site. It doesn't protect you from a zero-day exploit. It doesn't protect against plugging in an infected flash drive from a friend. Having a firewall and being careful of what you download doesn't provide a guarantee of safety (take a look at Stuxnet and how it works). You are definitely trying to over-engineer this. – Bigbio2002 Jan 6 '13 at 22:06

The extra routers would protect the computers from one another - is that your goal? If not, you don't need them.

share|improve this answer
Once configured, the routers would protect the computers that are connected to them from anything. I can set up the firewall rules to prevent both incoming and outgoing traffic, wherever it may come from, especially the wireless one which could pick up traffic from the neighborhood in addition to the primary router. – Synetech Mar 5 '10 at 21:29
It can be useful to run WiFi on a router next to the internet and provide a second router to route ethernet to your local computers. That would protect the wired computers from anyone on the WiFi while allowing the wired computers to communicate with each other. Providing a router for each computer will block them from communicating with each other without explicitly setting them up to allow it. Neither configuration will reduce the load on the gateway router. – JRobert Mar 5 '10 at 21:44
True, it would not reduce the load from incoming traffic. However, it would reduce the load from outgoing traffic: the routers (particularly the wireless one connected to the family computer) could be configured to block any and all unauthorized outgoing traffic. That way, anything that sends out too much data, say a bad P2P app, or an infection that may occur due to a trojan, would be sand-boxed to that system until it can be cleaned. As for the systems connecting to each other, I think you guys are all too LAN-minded. I just want to connect two systems to the Internet, not create a LAN. – Synetech Mar 13 '10 at 18:13
You need to put a lot of this information in the OP to clarify. It's very hard to piece together your situation by reading through comments. – Bigbio2002 Jan 4 '13 at 23:35

For a moment, let's ignore the practiacl/physical aspects of this question and answer the theoretical aspects. Let's say you have a computer hooked up to a router. You want to have that router connected to another one to access the Internet.

Set the "local router" up with a particular subnet, let's say Doesn't matter, as long as it's a valid RFC1918 subnet and it doesn't conflict with any other subnets you use. Your computer will DHCP to that subnet and be behind that device. Set that router itself to be configured for NAT and let it DHCP itself to the next highest network. Essentially, you'll have a double NAT. It's quite simple, really.

share|improve this answer
Actually, yesterday I had to take my cable-modem in because it was dying, and the new one has a built-in router. After some experimentation, I ended up deciding to leave the ISP’s router in gateway mode (WiFi AP, router, firewall) instead of bridge mode and leave my old router (which has some features that the ISP’s does not) as is. Now, I connect my system to the router which connects to the cable-router. Obviously it took a bit of configuration to get everything right, but it all seems to be working nicely. The ISP’s blocks whatever it can, and mine filters a little more (and heats up less). – Synetech Jan 13 '13 at 17:05

You're using home routers as hardware firewalls. They are nothing but toys and will not defend your personal data against hackers.

You need to invest in a real firewall, like a Cisco ASA 5505 or a Sonicwall, or Watchguard Firebox. Spend around $900 on a firewall, another 800 for IPS Signature subscription. As far as the wireless router goes, you could buy a regular WiFi router and use it as an access point – let the real firewall do all the routing and NAT.

share|improve this answer
> You're using home routers as hardware firewalls. They are nothing but toys and will not defend your personal data against hackers. Not true in the least. > Spend around $900 on a firewall, another 800 for IPS Signature subscription. Did I ever say anything about being rich or using this in a corporate setting? I clearly said one computer and home cable modem and family. What makes you think that spending hundreds or thousands of dollars on an enterprise solution even remotely applies to this question? – Synetech Feb 22 '12 at 18:49
That's a pretty strong claim and a generalization that simply is untrue. – Oliver Salzburg Feb 22 '12 at 18:49

You must log in to answer this question.

protected by Community Jan 18 '13 at 5:59

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .