up vote 0 down vote favorite
share [g+] share [fb]

My network routing (both routers are consumer-grade NETGEAR WNDR3700) is like this:

Modem ==> Router 1 ==> Router 2 WAN Port

I have Router 1 set to DHCP the entire home network. I want Router 2 to section off a web server from the home network in case it gets compromised, but I want computers on the home network to be able to administer the web server.

As it stands, the web server can access PCs on Router 1, and not vice-versa. In effect, I want this to be reversed. Can this be done without changing the physical configuration?

Any help much appreciated!

UPDATE: All right, I bit the bullet and switched the router chain so Router 2 comes before Router 1. Set up was so easy and though it's not perfect, it's all ready! Thanks for your responses everyone.

link|improve this question
These are consumer class routers? – SpacemanSpiff Jul 14 '11 at 19:40
This question can't be answered without information about what kind of router you are using. (Well, it can be answered, and the answer is "sure, if your router does that".) – Jed Daniels Jul 14 '11 at 20:57
Haha, sorry. The routers are consumer-grade Netgear WNDR3700s. – David Arvelo Jul 14 '11 at 21:07
I am not sure why you do not want to reverse them. That is a more natural order. The web server is closer to the Internet, and more exposed. Your home network would be one off, and a little more secure. Otherwise, you are going to have to change a lot of rules. – KCotreau Jul 15 '11 at 0:09
Thanks for your suggestion @KCotreau. I'd like to do it that way, but the physical area isn't ideally suited for it.. I'd be cramming a lot of hardware in a small space, which raises heat and maintenance pain, not to mention the complaints about noise and such from others! I'm surprised there's not an easier way to do this.. I looked into VLANs but that seems to be a top-tier switch method. Subnetting doesn't seem to fit what I'm trying to do either. – David Arvelo Jul 15 '11 at 0:26
show 2 more comments
feedback

migrated from serverfault.com Jul 14 '11 at 22:25

This question came from our site for system administrators and desktop support professionals.

4 Answers

up vote 0 down vote

I recommend you pickup a used NetScreen or other such firewall/gateway device, heck I'm pretty sure they made a version of the 5GT that had a DSL modem built-in. This would easily segment your network into three networks and at the same time combine what was 3 devices into one. It may even have wireless :)

link|improve this answer
I'm running a small operation here at home, so I can't really justify buying something like that. Thanks for the suggestion, though. :) – David Arvelo Jul 14 '11 at 22:00
i have 5 spares, want one? :) – SpacemanSpiff Jul 15 '11 at 4:11
feedback
up vote 0 down vote

You need the Web Server to be the DMZ, which would eliminate the need for a second router. How about port forwarding so that the webserver only listens on Port 80 (for the web stuff) and whatever port you need for administration? It's not going to be completely sectioned off if the web server gets compromised, it will be protected from the home computers

link|improve this answer
I would definitely use your method if I didn't want the web server completely separated from my home network. I'm mostly concerned about security from attacks through the website. – David Arvelo Jul 14 '11 at 23:26
Then you would need your modem going into a switch, then the router WAN ports each plugging into the switch. It'll be completely isolated, and you'll need to access the router by name to access the computers behind it, AND still have the ports opened you need – Luke Jul 14 '11 at 23:44
I agree. Another way to do it is to switch the router chain around, but there are a few reasons why I'm reluctant. One of them being complaints from others in the house. ;) Another is ease of access and maintenance. – David Arvelo Jul 15 '11 at 0:23
feedback
up vote 0 down vote

Are these the rules you want?

  • Internet --tcp 80 & 443 --> Webserver
  • Local computers --remote desktop or ssh --> Webserver
  • Webserver --NO TRAFFIC ALLOWED--> ANY DESTINATION

One way to do this:

Modem ==> Router 1 WAN ==> Router 1 LAN (10.1.1.1) ==> Router 2 LAN (10.1.1.2) ==> Router 2 WAN (10.2.2.1) ==> Webserver (10.2.2.2)

Router 1 is set to port forward tcp 80 and 443 to the Webserver IP. Also has static route to 10.2.2.2 via 10.1.1.2. Chap 5 of the WNDR3700 manual describes port forwarding and static routes.

Router 2 has DHCP disabled and default routing.

Local computer to administer the webserver also has static route to 10.2.2.2 via 10.1.1.2.

Another way to do what you may want is to set router 1 to port forward web traffic to the webserver on same net as local computers, and set every local computer firewall to deny all traffic from the webserver's IP. Then you can keep Router 2 as a spare or put it on eBay.

In any event, don't let the two router's WiFi settings stomp on each other.

link|improve this answer
I'm about to give this a go, but would you know if this prevents access to my home computers from the web server in the event that shell access was granted to the Linux web server in the case of an SQL injection/Linux hack, for example? – David Arvelo Jul 14 '11 at 23:24
Did you mean Router 2 **bold**WAN (10.1.1.2) ==> Router 2 **bold**LAN (10.2.2.1) ? – David Arvelo Jul 15 '11 at 0:45
No, because you want to protect the rest of the network from the webserver, as if it were dangerous like the Internet. It's not a traditional config, but can be effective. – Paul Jul 15 '11 at 2:09
feedback
up vote 0 down vote accepted

All right, I bit the bullet and switched the router chain so Router 2 comes before Router 1. Set up was so easy and though it's not the topology I hoped for, it's all ready! Thanks for your responses everyone.

link|improve this answer
This may be the way that you decided to go given your networking knowledge and restrictive circumstances, but you should not have accepted this as the best answer. – Michael Dillon Jul 30 '11 at 5:31
You give no rationale for this. The answer I chose is based on what actually worked for me. Why wouldn't that be the accepted answer to my question? Plus, if I hadn't closed this out, I'd have people here trying to solve a problem that's already been solved. – David Arvelo Jul 30 '11 at 6:16
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.