39

I have a few Internet-connected devices which I don't trust to be secure, but that I would like to use anyway (a smart TV and some off-the-shelf home automation devices). I don't want them on the same network as my computers.

My current solution is to plug my cable modem into a switch and connect two wireless routers to the switch. My computers connect to the first router, everything else connects to the second router.

Is this enough to completely segregate my computers from everything else?

Also, is there a simpler solution using a single router that would effectively do the same thing? I have the following routers, both with DD-WRT:

  • Netgear WNDR3700-v3

  • Linksys WRT54G-v3

All devices (secure and insecure) connect wirelessly, except for a single computer on the secure network.

3
  • 4
    Separation from your computers is great, but what about separating your insecure smart TV from your insecure WiFi toaster? ;)
    – ZX9
    Nov 4, 2016 at 14:34
  • Hmm... Well I do have several more old routers lying around. I wonder how many IPs my ISP will give me?
    – Chris B
    Nov 4, 2016 at 15:00
  • reactiongifs.com/r/but-why.gif
    – Alexander
    Nov 6, 2016 at 1:55

6 Answers 6

22

Yes, your solution is also ok but will increase one switching hop, plus config overhead, you can achieve this with one router by doing the following:

  • Configure two VLANs, connect trusted hosts to one VLAN and untrusted to another.
  • Configure iptables to not allow trusted to non trusted traffic(vice versa).

Hope this helps!

5
  • 1
    I think I know how to set up multiple VLANs properly using the LAN ports, but everything is connected via Wi-Fi. Is it possible to segregate Wi-Fi traffic into multiple VLANs on a single access point?
    – Chris B
    Nov 3, 2016 at 13:47
  • 1
    @user1152285 Yes, all reasonably modern WLAN devices are capable of hosting multiple wireless networks (on the same channel). Whether the software allows it is yet another question.
    – Daniel B
    Nov 3, 2016 at 15:22
  • 2
    I'm not 100% certain, but dd-wrt should be able to give you multiple SSIDs on the same AP with VLAN segregation. So you'll run two virtual wireless interfaces, one for trusted and one for untrusted devices.
    – Saiboogu
    Nov 3, 2016 at 15:22
  • @user1152285 Yes I searched, and found that dd-wrt does support it. Also found the link which shows mapping of interface to wlan virtual interface. And you can add vlan tags also(brilliant! :) ) Nov 4, 2016 at 6:36
  • 1
    Agreed with @ZX9 . Since the asker specifically mentions they have DD-WRT, at the very least some links to documentation on how to configure VLANs, multiple SSIDs, and traffic segregation would be very helpful.
    – Doktor J
    Nov 4, 2016 at 14:48
10

It's completely possible, but I'd like to address a few things first.

My current solution is to plug my cable modem into a switch and connect two wireless routers to the switch. My computers connect to the first router, everything else connects to the second router.

It's interesting both routers have internet access when your cable modem appears to be just a modem. Does your ISP do NAT? If not, I'd recommend taking the switch out (is it really a switch or is the switch capable of NAT?), and place one of your DD-WRT routers as the gateway. Your current setup as it is (without knowing to which port the routers were wired to), may either have IP address conflicts, or may occasionally experience random and sporiadic loss of connectivity on one or the other network.

Is it possible to segregate Wi-Fi traffic into multiple VLANs on a single access point?

Yes, but it'll take a bit of config work and some testing. I use a similar setup myself for segregating a guest network. The method I'll describe below doesn't involve VLANs.


DD-WRT (among others) support creating multiple SSIDs on the same AP. The only thing needed to do is to create another bridge, assign it to a different subnet, then firewall it off the rest of the main network.

It's been a while since I last did it this way but it should go somewhere along like this (be prepared to lose connectivity):

  1. Open an access point's config page
  2. Go to Wireless => Basic Settings
  3. Under Virtual Interfaces click Add[^virtif]
  4. Give your new IoT SSID a name and leave Network Configuration to Bridged, enable AP Isolation as you wish
  5. Go to tab Wireless Security, set your passwords, and set Security Mode to nothing less than WPA2-Personal-AES if possible[^nDS]
  6. Go to tab Setup => Networking
  7. Under Bridging, click Add
  8. Give your bridge an arbitrary name[^brname], maybe br1?
  9. Give your bridge an IP address that is not on the same subnet as your main network[^ipaddr]
  10. (You may have to click Save then Apply Settings to get this to show up) Under Assign to Bridge, click Add, then assign br1 to Interface wl.01 or what its interface name was given[^virtif], save and apply
  11. Under Multiple DHCP server, click Add and assign it to br1

  12. Go to Administration => Commands and paste these (you might have to adjust the interface names)[^note2]
    iptables -t nat -I POSTROUTING -o `get_wanface` -j MASQUERADE
    iptables -I FORWARD -i br1 -m state --state NEW,RELATED -j ACCEPT
    iptables -I FORWARD -i br1 -o br0 -j REJECT
    And click Save Firewall

  13. You should be all set, I think

For more details, you can take a look at http://www.alexlaird.com/2013/03/dd-wrt-guest-wireless/

A caveat for this is that this setup is effective only for the gateway router/AP. If you want the same setup to work for the other router, you'll have to use VLANs. The setup is similar, but it's a bit more involved. The difference here is that you'll have to configure and bridge a new VLAN to the IoT SSID and maybe do some routing rules.

[^virtif]: The first is usually the physical interface and often labeled as wl0. Your virtual interfaces (up to three if I'm not mistaken) will be labelled as wl0.1, wl0.2, and so on.

[^brname]: This will be the interface name DD-WRT will give to the bridge interface.

[^ipaddr]: Say your main network is on 172.16.1.0/24, give br1 an address of 172.16.2.0/24.

[^nDS]: If you have a Nintendo DS, you'll have to use WEP. Alternatively, you could create another SSID just for the NDS and have it also bridged to br1 for convenience.

[^note1]: At this point after applying settings, anything that connects to the IoT SSID will now be assigned to a different subnet. However, the two subnets can still communicate with each other.

[^note2]: This bit might need some work.

5
  • Thanks for the info, I'll have to dive more in to this when I get home. For reference, it's definitely using a (dumb, no NATing) 4-port switch. Both routers are connected to the switch through their WAN ports. The DHCP ranges on the routers are different, though with the current setup that shouldn't matter. It's possible I'm getting two different IPs from my ISP
    – Chris B
    Nov 3, 2016 at 15:52
  • If both routers are connected to their WAN ports, yes, it shouldn't matter. And yes, it is possible to get two different IPs from your ISP (you're very lucky if they do, what I'd give for a second IPv4 address right now...)
    – gjie
    Nov 3, 2016 at 16:03
  • @user1152285 if you do a bit of research this can literally be a much better option! i didnt know ddwrt can use AP ISOLATION... try this first!
    – Bryan
    Nov 3, 2016 at 16:24
  • Update: I just checked, and each of my routers has a different public IP. So it seems my ISP is giving me multiple IPs
    – Chris B
    Nov 3, 2016 at 21:41
  • @BryanCerrati AP isolation is part of the solution, but not the whole answer. Protects you on wireless to wireless clients but won't help you from wireless to wired.
    – gjie
    Nov 5, 2016 at 10:48
6

Is this enough to completely segregate my computers from everything else?

Assuming your connection from router 1 to the Switch is using the WAN port of the router and you are not sharing WAN and LAN in OpenWRT (meaning you did not change the default settings and did the cabling as you would when connected directly to the modem), you are mostly fine.

Of course your devices on router 2 could send traffic to anybody, which can be a problem in itself (usage statistics, camera images, sound over microphones, information about WLAN, GPS receivers etc. depending on devices).

Also, is there a simpler solution using a single router that would effectively do the same thing? I have the following routers, both with DD-WRT:

You can configure your ports separately and route the bad traffic separately from the good traffic. Your keyword would be DMZ, there are plenty of tutorials available.

If you want to have more complexity, you can also enable VLANs, this way you can put additional VLAN-aware devices behind the router and connect both types of devices to them, essentially making your whole home as if every device was plugged in directly into a port of one of both routers, even if you have only a single router and 5 switches behind it daisy-chained... but do this only if you must, as the possibility for error is substantial and the benefit depends on your cabling (almost none when using star topology, great when having to use ring topology).

4
  • I should have mentioned that almost all of the devices connect to the router over Wi-Fi. If all devices are connecting to the same access point, is there a way to stop them from seeing each other (given that these are fairly standard home routers)?
    – Chris B
    Nov 3, 2016 at 13:52
  • 1
    OpenWRT enables you to create different wireless networks with different SSID and passwords. You can then use them like a switched network (your TV sees your stereo, but not your PC) or use VLANs with 802.1x and RADIUS auth to completely separate your devices (802.1x uses RADIUS to check if a device is allowed and to assign it to its own or shared VLAN). With OpenWRT, everything is possible, but it may become a PITA to set it all up.
    – user121391
    Nov 3, 2016 at 14:11
  • 802.1x would solve all... except all devices are wireless.
    – Bryan
    Nov 3, 2016 at 15:17
  • 2
    @BryanCerrati: 802.1x works with wireless also.
    – Ben Voigt
    Nov 3, 2016 at 18:14
6

Some consumer-grade Wi-Fi routers have a "Guest Mode" that is a network that is partitioned off from the normal network.

You could restrict your untrusted devices to the "Guest" AP.

Not that every router that has that feature is especially secure.

Although the article Warning: “Guest Mode” on Many Wi-Fi Routers Isn’t Secure talks about insecurity, the major flaw they discuss is privacy. If you don't care if your network-enabled TV is phoning home to tell the maker what you are watching, then who cares if the neighbors are watching it do that.

1
3

Also, is there a simpler solution using a single router that would effectively do the same thing? I have the following routers, both with DD-WRT:

Most home WiFi routers allow you to configure a "guest network". This wireless LAN is allowed to connect to the Internet, but isn't allowed to connect to devices on the main wired or wireless LANs. So you could put the IoT devices on network, and they won't be able to compromise your computers.

0

Create a separate network should be the best way to keep the insecure devices away from your secure LAN to prevent malicious users/devices from gaining access to your shared files or networked devices ,it can be achieved by enabling the GUEST network Using the Netgar WNDR3700v3 features with a strong and differents passwords .

Disable the UPnP

A virus, Trojan horse, worm, or other malicious program that manages to infect a computer on your local network can use UPnP, just like legitimate programs can. While a router normally blocks incoming connections, preventing some malicious access, UPnP could allow a malicious program to bypass the firewall entirely. For example, a Trojan horse could install a remote control program on your computer and open a hole for it in your router’s firewall, allowing 24/7 access to your computer from the Internet. If UPnP were disabled, the program couldn’t open the port – although it could bypass the firewall in other ways and phone home

Disable the remote access through the WIFI to your routers

most routers offer a “remote access” feature that allows you to access this web interface from anywhere in the world. Even if you set a username and password, if you have a D-Link router affected by this vulnerability, anyone would be able to log in without any credentials. If you have remote access disabled, you’d be safe from people remotely accessing your router and tampering with it.

Also do not connect the insecure devices unless you need to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .