Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day,

I often work on friends computers when they suspect a virus or some other malware and I'm wondering the best way to connect them to my network when I need to get out to the net. My home network is your simple cable modem into a Linksys router into a desktop. I want to connect this rogue machine to the router to get to the net, but I obviously don't want to risk infecting my own machine.

In the past, I've just simply powered off my own machine when it was time to connect the rogue machine, but this isn't always convenient.

My question is if I daisy chain two routers - in other words hang a separate router off my existing router and connect the rogue machine to that router - does that keep the two machines or maybe it would be appropriate to say two networks sufficiently sandboxed? Or is there even a better way?


share|improve this question

You want to create a "DMZ", a demilitarized zone, to put the untrusted host on, and that's what you're suggesting, only you got the order wrong.

Cable modem <-- router <-- DMZ <-- router <-- trusted network.

Make sure you connect the visitor on the "outside" of the router you're own machine is on, that is, the WAN port on the router your home network uses should be connected to the "inside" switch port on the router that has its WAN port connected to the cable modem.

i.e. your inner router and the visitor both connect to the router connected to the cable, your desktop being the most "far away" from the internet.

share|improve this answer
Thanks Matt. I'm pretty sure I understand what you're suggesting. One question, when you say "DMZ" - are you using that term descriptively or are you saying one of the connections should actually use the DMZ port on the router? – Hank Mar 31 '11 at 10:27
@Hank: the "DMZ port" on your router might be a place to plug in the untrusted host, if it does what it should, you won't need an extra router then, but be careful! Sometimes routers for home use don't do what an experienced user might expect. Read the manual to make sure the DMZ computer cannot access the internal network! (I meant it descriptively.) – MattBianco Mar 31 '11 at 10:55
Interesting you say that...that's exactly why I was thinking two routers - I did not trust the DMZ port. – Hank Mar 31 '11 at 11:20

The DMZ port/settings on most SOHO routers won't isolate the sick machine from the good ones. The DMZ host will get the same private network assignment, and thus, will be in the same layer-2 domain as the other hosts. Having a 2nd router, however, would keep the broadcast domains from overlapping. For extra protection, block all traffic from the infected router's WAN IP on the good router.

share|improve this answer

First off, your normal run-of-the-mill cable router speaks PPPoE on its WAN port, not IP, so it is doubtful you could chain two routers like this without buying a special router.

If you were to have a second router you'd want to place it in between your desktop and the Linksys to act as a firewall between the unsafe and safe portions of the network.

You would be best off using an old PC with a couple of network cards in it. Ideally 3:

  1. connected to the internet router
  2. connected to your desktop
  3. connected to the rogue computer

You can then set up NAT and firewalling in the operating system of your choice to isolate the two networks. Or you could install a pre-built firewall product on the old PC, such as Smoothwall, IPCop or MonoWall etc.

Desktop -----*s*------>|Nic 2   |
                       |        |
                       |   Nic 1|---------> Linksys
Rogue -------*s*------>|Nic 3   |

In IPCop for example, the interfaces would be allocated as:

  1. RED - the untrusted internet connection
  2. GREEN - the trusted internal network
  3. BLUE - an additional network that is unable to access the GREEN network but can access the RED network.

Depending on your network card's abilities you may well need to have either crossover cables or insert switches in your configuration at the * s * points in the diagram to link the computers to the firewall machine. If you use switches make sure you use 2 separate switches or one good switch that can isolate ports into separate VLANs to prevent any possibility of the GREEN and BLUE networks getting access to each other.

share|improve this answer
Thanks for the response Matt. I'd rather not add another PC to the the mix, because that's just one more machine to manage / get infected, etc. I'd much rather figure something out with routers if possible. – Hank Mar 31 '11 at 10:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .