2

I’ve currently got one computer behind a router with built-in firewall functionality, connected to a home cable-modem that has a single Ethernet port and one IP. I’m going to have to set up another computer for the rest of the family to use which of course will need to be connected to the Internet, probably wirelessly since the modem is in my room and the new system would not be.

What I would like to do is to get two more small routers with firewall capability and connect each computer to a router, which would in turn connect to the main router which connects to the cable-modem. That way, both systems have a hardware firewall protecting them (particularly the wireless system) and the burden of blocking would be reduced on both the computer CPUs and the main router because the secondary routers would handle some of the workload.

I’m trying to find out about the complexities inherent in this design and how I could set it up to work, specifically the IP handling and NAT aspect.

Thanks a lot.

3
  • 2
    Do you expect computers withing your network to be able to communicate?
    – Zoredache
    Mar 5, 2010 at 19:46
  • Nope. I don’t care about that. If I ever have a need to share files between the two systems, I’ll just use a disk. If I need to use share a printer, I’ll just pick it up and plug it into the other one.
    – Synetech
    Mar 5, 2010 at 21:27
  • @hit-and-run–down-voter, you should explain your problem, less your opinion be useless and meaningless.
    – Synetech
    Nov 7, 2012 at 19:38

6 Answers 6

13

This idea is over engineered. Why is any of it necessary?

One router should be plenty for your home network of three computers on a cable Internet connection. There is no burden for the level of traffic you are describing.

4
  • 2
    First rule of optimization: Don't do it unless you have a reason! Unless the OP has some other strange requirements that weren't mentioned in the question, one router should provide the protection and bandwidth necessary in a home setting.
    – heavyd
    Mar 5, 2010 at 20:41
  • Yeah this is defintally over engineered. It will also be a nightmare if you needed to open any ports, because your going to have double, maybe even triple NAT.
    – jburke
    Mar 5, 2010 at 21:29
  • There is no burden for the level of traffic you are describing. Tell that to my router which gets hot and always has a full log. Also tell it to my system which often slows to a stop when I download at my connection’s maximum speed, even with HTTP, let alone any sort of P2P.
    – Synetech
    Mar 5, 2010 at 21:30
  • Also, as to why it’s necessary, the system wired to the router is fine, but the wireless one has a vulnerable space between it and the router where bad-guys could cause trouble… then again, I suppose if the router’s wireless functionality is correctly configured, it should be okay right?
    – Synetech
    Feb 3, 2011 at 18:48
1

Are you able to acquire a second-hand computer? If so, you could use something like IPCop to handle the firewall. It would sit between your modem and your router.

You could (possibly) also set it up to handle DHCP/DNS to nix the router, but you would still need a switch.

1

Any reason why you can't replace the existing router with a better one, rather than adding two additional routers in a complex setup? That seems to be the most elegant solution. Any COTS WiFi/Router/Switch combo device should be more than sufficient. Does your current router have any sort of special/advanced firewall features that you don't want to lose?

Besides, any network processing performed by your computers is negligible. I agree with the first post that you're being overly-paranoid and trying to over-optimize.

10
  • Aside from, cost? What I was thinking was using a router as hardware firewall instead of using software, so aside from the performance impact (which is an issue; just Google for examples), having a separate, hardware device blocking connections before they even get to the system is definitely better than software (especially for a wireless connection). I recently explained in detail the benefits somewhere, but I cannot seem to find the comment/answer.
    – Synetech
    Jan 4, 2013 at 20:33
  • I suppose what I'm asking is, what can your current device do that another one cannot? If you have two hardware devices chained with firewall capabilities, the first one will block any intruders, and the second one will have nothing to filter. I must be missing something, do you have two additional routers lying around somewhere? If not, you're going to have to shell out $$ for those. Instead of buying 2, just buy 1 and replace the existing one. Additionally, what kind of system do you have, the one which slows down when downloading something? It sounds like a completely different problem.
    – Bigbio2002
    Jan 4, 2013 at 23:31
  • If you have two hardware devices chained with firewall capabilities, the first one will block any intruders, and the second one will have nothing to filter. Correct, but what if you take a laptop out of that network and connect it to another one, like at a coffee shop? Granted, having a router dangling from a laptop’s Ethernet port is not sleek, but it would be a useful digital prophylactic for the laptop, and people already have all kinds of stuff hanging from their laptops. Moreover, isn’t necessarily a commercial router; e.g., one could be made from a tiny Raspberry Pi.
    – Synetech
    Jan 5, 2013 at 17:27
  • Basically, I’m wondering about wrapping a system (or rather, each system) with its own dedicated piece of hardware protection. That it happens to usually come in the form of a router is merely a complication due to the networking aspect.
    – Synetech
    Jan 5, 2013 at 17:29
  • Let's say you find some kind of USB firewall dongle to use, and all incoming ports are blocked via this device (not that it can't be done with the built-in Windows firewall). It doesn't protect you from visiting a malicious site, or getting served a malicious ad on a legit site. It doesn't protect you from a zero-day exploit. It doesn't protect against plugging in an infected flash drive from a friend. Having a firewall and being careful of what you download doesn't provide a guarantee of safety (take a look at Stuxnet and how it works). You are definitely trying to over-engineer this.
    – Bigbio2002
    Jan 6, 2013 at 22:06
0

The extra routers would protect the computers from one another - is that your goal? If not, you don't need them.

4
  • Once configured, the routers would protect the computers that are connected to them from anything. I can set up the firewall rules to prevent both incoming and outgoing traffic, wherever it may come from, especially the wireless one which could pick up traffic from the neighborhood in addition to the primary router.
    – Synetech
    Mar 5, 2010 at 21:29
  • It can be useful to run WiFi on a router next to the internet and provide a second router to route ethernet to your local computers. That would protect the wired computers from anyone on the WiFi while allowing the wired computers to communicate with each other. Providing a router for each computer will block them from communicating with each other without explicitly setting them up to allow it. Neither configuration will reduce the load on the gateway router.
    – JRobert
    Mar 5, 2010 at 21:44
  • True, it would not reduce the load from incoming traffic. However, it would reduce the load from outgoing traffic: the routers (particularly the wireless one connected to the family computer) could be configured to block any and all unauthorized outgoing traffic. That way, anything that sends out too much data, say a bad P2P app, or an infection that may occur due to a trojan, would be sand-boxed to that system until it can be cleaned. As for the systems connecting to each other, I think you guys are all too LAN-minded. I just want to connect two systems to the Internet, not create a LAN.
    – Synetech
    Mar 13, 2010 at 18:13
  • You need to put a lot of this information in the OP to clarify. It's very hard to piece together your situation by reading through comments.
    – Bigbio2002
    Jan 4, 2013 at 23:35
0

For a moment, let's ignore the practiacl/physical aspects of this question and answer the theoretical aspects. Let's say you have a computer hooked up to a router. You want to have that router connected to another one to access the Internet.

Set the "local router" up with a particular subnet, let's say 10.1.1.xxx. Doesn't matter, as long as it's a valid RFC1918 subnet and it doesn't conflict with any other subnets you use. Your computer will DHCP to that subnet and be behind that device. Set that router itself to be configured for NAT and let it DHCP itself to the next highest network. Essentially, you'll have a double NAT. It's quite simple, really.

1
  • Actually, yesterday I had to take my cable-modem in because it was dying, and the new one has a built-in router. After some experimentation, I ended up deciding to leave the ISP’s router in gateway mode (WiFi AP, router, firewall) instead of bridge mode and leave my old router (which has some features that the ISP’s does not) as is. Now, I connect my system to the router which connects to the cable-router. Obviously it took a bit of configuration to get everything right, but it all seems to be working nicely. The ISP’s blocks whatever it can, and mine filters a little more (and heats up less).
    – Synetech
    Jan 13, 2013 at 17:05
-1

You're using home routers as hardware firewalls. They are nothing but toys and will not defend your personal data against hackers.

You need to invest in a real firewall, like a Cisco ASA 5505 or a Sonicwall, or Watchguard Firebox. Spend around $900 on a firewall, another 800 for IPS Signature subscription. As far as the wireless router goes, you could buy a regular WiFi router and use it as an access point – let the real firewall do all the routing and NAT.

2
  • 3
    > You're using home routers as hardware firewalls. They are nothing but toys and will not defend your personal data against hackers. Not true in the least. > Spend around $900 on a firewall, another 800 for IPS Signature subscription. Did I ever say anything about being rich or using this in a corporate setting? I clearly said one computer and home cable modem and family. What makes you think that spending hundreds or thousands of dollars on an enterprise solution even remotely applies to this question?
    – Synetech
    Feb 22, 2012 at 18:49
  • 2
    That's a pretty strong claim and a generalization that simply is untrue. Feb 22, 2012 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .