Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My network routing (both routers are consumer-grade NETGEAR WNDR3700) is like this:

Modem ==> Router 1 ==> Router 2 WAN Port

I have Router 1 set to DHCP the entire home network. I want Router 2 to section off a web server from the home network in case it gets compromised, but I want computers on the home network to be able to administer the web server.

As it stands, the web server can access PCs on Router 1, and not vice-versa. In effect, I want this to be reversed. Can this be done without changing the physical configuration?

Any help much appreciated!

UPDATE: All right, I bit the bullet and switched the router chain so Router 2 comes before Router 1. Set up was so easy and though it's not perfect, it's all ready! Thanks for your responses everyone.

share|improve this question
    
These are consumer class routers? –  SpacemanSpiff Jul 14 '11 at 19:40
    
This question can't be answered without information about what kind of router you are using. (Well, it can be answered, and the answer is "sure, if your router does that".) –  Jed Daniels Jul 14 '11 at 20:57
    
Haha, sorry. The routers are consumer-grade Netgear WNDR3700s. –  David Arvelo Jul 14 '11 at 21:07
    
I am not sure why you do not want to reverse them. That is a more natural order. The web server is closer to the Internet, and more exposed. Your home network would be one off, and a little more secure. Otherwise, you are going to have to change a lot of rules. –  KCotreau Jul 15 '11 at 0:09
    
Thanks for your suggestion @KCotreau. I'd like to do it that way, but the physical area isn't ideally suited for it.. I'd be cramming a lot of hardware in a small space, which raises heat and maintenance pain, not to mention the complaints about noise and such from others! I'm surprised there's not an easier way to do this.. I looked into VLANs but that seems to be a top-tier switch method. Subnetting doesn't seem to fit what I'm trying to do either. –  darvelo Jul 15 '11 at 0:26
show 2 more comments

migrated from serverfault.com Jul 14 '11 at 22:25

This question came from our site for professional system and network administrators.

4 Answers

I recommend you pickup a used NetScreen or other such firewall/gateway device, heck I'm pretty sure they made a version of the 5GT that had a DSL modem built-in. This would easily segment your network into three networks and at the same time combine what was 3 devices into one. It may even have wireless :)

share|improve this answer
    
I'm running a small operation here at home, so I can't really justify buying something like that. Thanks for the suggestion, though. :) –  David Arvelo Jul 14 '11 at 22:00
    
i have 5 spares, want one? :) –  SpacemanSpiff Jul 15 '11 at 4:11
add comment

You need the Web Server to be the DMZ, which would eliminate the need for a second router. How about port forwarding so that the webserver only listens on Port 80 (for the web stuff) and whatever port you need for administration? It's not going to be completely sectioned off if the web server gets compromised, it will be protected from the home computers

share|improve this answer
    
I would definitely use your method if I didn't want the web server completely separated from my home network. I'm mostly concerned about security from attacks through the website. –  darvelo Jul 14 '11 at 23:26
    
Then you would need your modem going into a switch, then the router WAN ports each plugging into the switch. It'll be completely isolated, and you'll need to access the router by name to access the computers behind it, AND still have the ports opened you need –  Canadian Luke Jul 14 '11 at 23:44
    
I agree. Another way to do it is to switch the router chain around, but there are a few reasons why I'm reluctant. One of them being complaints from others in the house. ;) Another is ease of access and maintenance. –  darvelo Jul 15 '11 at 0:23
add comment

Are these the rules you want?

  • Internet --tcp 80 & 443 --> Webserver
  • Local computers --remote desktop or ssh --> Webserver
  • Webserver --NO TRAFFIC ALLOWED--> ANY DESTINATION

One way to do this:

Modem ==> Router 1 WAN ==> Router 1 LAN (10.1.1.1) ==> Router 2 LAN (10.1.1.2) ==> Router 2 WAN (10.2.2.1) ==> Webserver (10.2.2.2)

Router 1 is set to port forward tcp 80 and 443 to the Webserver IP. Also has static route to 10.2.2.2 via 10.1.1.2. Chap 5 of the WNDR3700 manual describes port forwarding and static routes.

Router 2 has DHCP disabled and default routing.

Local computer to administer the webserver also has static route to 10.2.2.2 via 10.1.1.2.

Another way to do what you may want is to set router 1 to port forward web traffic to the webserver on same net as local computers, and set every local computer firewall to deny all traffic from the webserver's IP. Then you can keep Router 2 as a spare or put it on eBay.

In any event, don't let the two router's WiFi settings stomp on each other.

share|improve this answer
    
I'm about to give this a go, but would you know if this prevents access to my home computers from the web server in the event that shell access was granted to the Linux web server in the case of an SQL injection/Linux hack, for example? –  darvelo Jul 14 '11 at 23:24
    
Did you mean Router 2 **bold**WAN (10.1.1.2) ==> Router 2 **bold**LAN (10.2.2.1) ? –  darvelo Jul 15 '11 at 0:45
    
No, because you want to protect the rest of the network from the webserver, as if it were dangerous like the Internet. It's not a traditional config, but can be effective. –  Paul Jul 15 '11 at 2:09
add comment
up vote 0 down vote accepted

All right, I bit the bullet and switched the router chain so Router 2 comes before Router 1. Set up was so easy and though it's not the topology I hoped for, it's all ready! Thanks for your responses everyone.

share|improve this answer
    
This may be the way that you decided to go given your networking knowledge and restrictive circumstances, but you should not have accepted this as the best answer. –  Michael Dillon Jul 30 '11 at 5:31
    
You give no rationale for this. The answer I chose is based on what actually worked for me. Why wouldn't that be the accepted answer to my question? Plus, if I hadn't closed this out, I'd have people here trying to solve a problem that's already been solved. –  darvelo Jul 30 '11 at 6:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.