two routers two networks one isp

[allochthonous]

I got my hands on another Linksys router and want to attempt a dual router setup creating two distinct networks. I want to be able to connect "rogue" or unknown machines to the internet, but keep my primary network isolated and protected.


So I was thinking something like this:

MODEM -- Internet port on ROUTER1 (network 192.168.6.0)
LAN ports 2-4 ----"rogues"
LAN port 1 -- Internet port on ROUTER2 (network 192.168.1.0)
LAN ports 1-4 on ROUTER2 ----- regular network


So anything that is done on the first layer "rogue" network will not affect my main network, right? Is there anything else that needs to be done to prevent traffic (or viruses, etc) from jumping the networks?

I am apprehensive because in my mind, it does not seem like it would be terribly difficult for a piece of malware to quickly ping all networks within the 192.168 range until it is successful and then make note of that address and exploit it.

Is the technology not there? Am I oversimplifying?

I tried this configuration a few minutes ago and i was not able to reach the internet on the second layer. It looks like the second layer router would not get an IP address from the first layer. Or do i need to try to get an IP on the second layer router from the modem?

Any thoughts?

[johnwill]

That should work fine. The NAT layer on the second router shields you from any incoming threats.

As long as the base address of the two routers are in different subnet, it should work fine. I've done that in a number of locations, the first router is a wireless "public" router, and the secondary router is the secure network.

[allochthonous]

Is this the same JohnWill as the Tech Suppory Guy forum?

Can you explain physically how i can set this up using the Linksys routers?

PK

[johnwill]

Yep, I'm the same guy.

You just need to access the Linksys web based setup and change the base address of the secondary router to something like 192.168.2.1, it can't be in the 192.168.1.x subnet to connect using the WAN connection of the secondary router.

[allochthonous]

I finally got it to work. Apparently at least part of the problem was was a cabling issue.

I was not happy with the performance though, as it seemed to take a long time for a host to be able to access the internet from the second layer.

Can anyone think of another way to accomplish what i want? A friend recommended DD-WRT and set up seperate VLANS.

PK

[johnwill]

There should be no measurable delay between the two routers, I've done this a number of times. Something is amiss if this is happening.

You could use DD-WRT, it will separate the networks for you, that's another way to go.

[johnwill]

There should be no measurable delay between the two routers, I've done this a number of times. Something is amiss if this is happening.

You could use DD-WRT, it will separate the networks for you, that's another way to go.

[allochthonous]

To eliminate any hardware issues with the hand me down router, I bought a new second router (a Netgear WPN824) and hooked it up as planned. Everything seems to be working OK. I left both routers set on DHCP. ROUTER1 getting its IP address and DNS IP’s from the modem (ISP) and ROUTER2 getting its IP and DNS addresses from ROUTER1. I can ping both gateways (192.168.1.1 and 192.168.6.1) from a client on the 1.0 network, but cannot ping a client on the 6.0 network. I cannot ping 192.168.1.1 from a client on the 6.0 network, nor can I ping a client.

Am I good to go? Is this the best method for what i want to do?

I just don't have time to delve into the world of DD-WRT.

PK