My network routing (both routers are consumer-grade NETGEAR WNDR3700) is like this:

Modem ==> Router 1 ==> Router 2 WAN Port

I have Router 1 set to DHCP the entire home network. I want Router 2 to section off a web server from the home network in case it gets compromised, but I want computers on the home network to be able to administer the web server.

As it stands, the web server can access PCs on Router 1, and not vice-versa. In effect, I want this to be reversed. Can this be done without changing the physical configuration?

Any help much appreciated!

UPDATE: All right, I bit the bullet and switched the router chain so Router 2 comes before Router 1. Set up was so easy and though it's not perfect, it's all ready! Thanks for your responses everyone.

  • These are consumer class routers? Jul 14 '11 at 19:40
  • This question can't be answered without information about what kind of router you are using. (Well, it can be answered, and the answer is "sure, if your router does that".) Jul 14 '11 at 20:57
  • Haha, sorry. The routers are consumer-grade Netgear WNDR3700s.
    – David Arvelo
    Jul 14 '11 at 21:07
  • I am not sure why you do not want to reverse them. That is a more natural order. The web server is closer to the Internet, and more exposed. Your home network would be one off, and a little more secure. Otherwise, you are going to have to change a lot of rules.
    – KCotreau
    Jul 15 '11 at 0:09
  • Thanks for your suggestion @KCotreau. I'd like to do it that way, but the physical area isn't ideally suited for it.. I'd be cramming a lot of hardware in a small space, which raises heat and maintenance pain, not to mention the complaints about noise and such from others! I'm surprised there's not an easier way to do this.. I looked into VLANs but that seems to be a top-tier switch method. Subnetting doesn't seem to fit what I'm trying to do either.
    – darvelo
    Jul 15 '11 at 0:26

I recommend you pickup a used NetScreen or other such firewall/gateway device, heck I'm pretty sure they made a version of the 5GT that had a DSL modem built-in. This would easily segment your network into three networks and at the same time combine what was 3 devices into one. It may even have wireless :)

  • I'm running a small operation here at home, so I can't really justify buying something like that. Thanks for the suggestion, though. :)
    – David Arvelo
    Jul 14 '11 at 22:00
  • i have 5 spares, want one? :) Jul 15 '11 at 4:11

You need the Web Server to be the DMZ, which would eliminate the need for a second router. How about port forwarding so that the webserver only listens on Port 80 (for the web stuff) and whatever port you need for administration? It's not going to be completely sectioned off if the web server gets compromised, it will be protected from the home computers

  • I would definitely use your method if I didn't want the web server completely separated from my home network. I'm mostly concerned about security from attacks through the website.
    – darvelo
    Jul 14 '11 at 23:26
  • Then you would need your modem going into a switch, then the router WAN ports each plugging into the switch. It'll be completely isolated, and you'll need to access the router by name to access the computers behind it, AND still have the ports opened you need Jul 14 '11 at 23:44
  • I agree. Another way to do it is to switch the router chain around, but there are a few reasons why I'm reluctant. One of them being complaints from others in the house. ;) Another is ease of access and maintenance.
    – darvelo
    Jul 15 '11 at 0:23

Are these the rules you want?

  • Internet --tcp 80 & 443 --> Webserver
  • Local computers --remote desktop or ssh --> Webserver

One way to do this:

Modem ==> Router 1 WAN ==> Router 1 LAN ( ==> Router 2 LAN ( ==> Router 2 WAN ( ==> Webserver (

Router 1 is set to port forward tcp 80 and 443 to the Webserver IP. Also has static route to via Chap 5 of the WNDR3700 manual describes port forwarding and static routes.

Router 2 has DHCP disabled and default routing.

Local computer to administer the webserver also has static route to via

Another way to do what you may want is to set router 1 to port forward web traffic to the webserver on same net as local computers, and set every local computer firewall to deny all traffic from the webserver's IP. Then you can keep Router 2 as a spare or put it on eBay.

In any event, don't let the two router's WiFi settings stomp on each other.

  • I'm about to give this a go, but would you know if this prevents access to my home computers from the web server in the event that shell access was granted to the Linux web server in the case of an SQL injection/Linux hack, for example?
    – darvelo
    Jul 14 '11 at 23:24
  • Did you mean Router 2 boldWAN ( ==> Router 2 boldLAN ( ?
    – darvelo
    Jul 15 '11 at 0:45
  • No, because you want to protect the rest of the network from the webserver, as if it were dangerous like the Internet. It's not a traditional config, but can be effective.
    – Paul
    Jul 15 '11 at 2:09

All right, I bit the bullet and switched the router chain so Router 2 comes before Router 1. Set up was so easy and though it's not the topology I hoped for, it's all ready! Thanks for your responses everyone.

  • This may be the way that you decided to go given your networking knowledge and restrictive circumstances, but you should not have accepted this as the best answer. Jul 30 '11 at 5:31
  • You give no rationale for this. The answer I chose is based on what actually worked for me. Why wouldn't that be the accepted answer to my question? Plus, if I hadn't closed this out, I'd have people here trying to solve a problem that's already been solved.
    – darvelo
    Jul 30 '11 at 6:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.