Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I have a standard SOHO router that we connect to browse the Internet, etc. As I doing my internship in networking I would like to know whether a subnet would protect the rest of the network when I am testing other computers.

For example I would like to set up a scenario where I browse the Internet with no antivirus, anti-malware, etc. If one of the test computers I set up is infected I would like to make sure that none of the other computers that are used regularly will be infected.

Does a subnet provide such security? If not what type of setup should I consider and how should I set it up?

share|improve this question
The Internet is a different subnet than your LAN; Have you ever caught a virus from the Internet? :) – Ƭᴇcʜιᴇ007 Oct 27 '11 at 22:24
up vote 1 down vote accepted

It depends on if the subnets are set up to talk to each other. If they are, then it makes no difference and makes more work for you. If they are actually isolated and can only see the Internet, then you should be safe. Try to ping a computer on a separate subnet, and see if you can access it. If you can't, and firewalls are off, then it's likely a safe bet.

Here at my computer shop, we have our Modem plugged into a switch, then two routers off of the switch. One for the 'tech' side, and one for the 'infected' side (aka Customer machines)

share|improve this answer
Thanks. I am curious as to how I can set them up so they cannot communicate with each other. What would I need do? – PeanutsMonkey Oct 27 '11 at 22:28
Well, one switch and two routers is the quick, no-config-needed route. If you want to use your built in router, I'd suggest using DD-WRT if it's compatible – Canadian Luke Oct 27 '11 at 22:29
Sorry for being a n00b for seeing I have one ADSL router, would that connect to the switch off which the 2 additional routers would hang off? – PeanutsMonkey Oct 27 '11 at 22:33
Moden -> Switch -> Router 1, then Modem -> Switch ->Router 2 – Canadian Luke Oct 27 '11 at 22:36
so that would be 2 switches and 2 routers? – PeanutsMonkey Oct 27 '11 at 22:39

Creating a separate subnet doesn't really offer any additional security unless there is some kind of firewall between the two subnets that is filtering traffic.

If malware is going to scan the other network for systems to exploit, they would probably start on the subnet that is in-used on the local machine, but it doesn't stop their, it could simply start scanning other networks.

share|improve this answer
So what Luke has suggested would not work without a firewall? I want to setup a scenario where each subnet can share the same internet connection but NOT see each other or communicate, etc – PeanutsMonkey Oct 27 '11 at 22:29
@PeanutsMonkey You want the "clean" side fire-walled against attacks from the "dirty" side. – Ƭᴇcʜιᴇ007 Oct 27 '11 at 22:37

The only effect different subnets have on virus propagation is if that particular piece of malware only scans the local subnet as an expansion vector. Subnets just mean it has to pass through a layer three device to reach the other subnet. If you were using an old pix or ASA between the two subnets then one would be able to initiate contact in to the other but not vice versa. This is the benefit of using a real SOHO firewall over a soho router with DMZ hosting. The soho router does no isolation on the DMZ host. In this way it is effectively not a DMZ or separate network.

The solution for what you are trying to do if you want not to get infected by infected PCs is to use a real soho firewall that has a real DMZ set up. A pix 501 is pretty cheap on flea-bay. Alternately, you could get an old computer with three network cards and install a linux distro on it...then configure ipchains/iptables appropriately.

share|improve this answer
What do you mean by If you were using an old pix or ASA between the two subnets then one would be able to initiate contact in to the other but not vice versa? – PeanutsMonkey Oct 28 '11 at 0:35
The pix is configured by zones. ports in one zone cannot initiate contact to more secure zones. ports in more secure zones can initialize contact to less secure zones. So it helps in keeping malware in the less secure zone – RobotHumans Oct 28 '11 at 2:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .