Broadband Tech > Security > Wireless Security > Using two routers for securtity without double NAT

Using two routers for securtity without double NAT

Route add 192.168.8.0 mask 255.255.255.0 gateway 172.30.100.2
Or
Route -p add 192.168.8.0 mask 255.255.255.0 gateway 172.30.100.2 

Why not just get the ZyWALL 5, which has a DMZ interface with which to have a private LAN and a Public LAN.

I agree that a Zywall five is a better solution if you need most of its features. However, a Z5 costs almost $400 dollars and is overkill if all you want to do is protect a wired home network from wireless intruders. Also, the Z5 doesn’t have a DHCP server for the DMZ and wireless costs extra. The purpose of my post is to explain how to set up a DMZ using relatively inexpensive equiptment (less than $125 if you use two P334WTs).
--
Jim Anderson

reply to Anav

Re: Using two routers for secur without double NAT

DMZ on a Zywall5 is/can be totally different than any home routers DMZ. You can set firewall rules to allow or not allow all kinds of stuff. DMZ on most if not all home router is like placing the PC/s connected to it on the NET. Not so with the Z5 or it can be. It's all how you set it up.
--
Shooter Ready--Stand By BEEP ********

reply to janderso1

Re: Using two routers for securtity without double

With this setup the wireless users can’t see anything on the wired LAN. The wireless users will only be accessible if the route add is done on the wireless PC.
--
Jim Anderson

Jim,

So if on the wireless PC a route add is done, will wired users be able to see the wireless users and vice versa?

Is there a way to make it so that wired uses always see wireless users but wireless users cannot see wired users?

I really want to isolate my wireless users from my wired lan. In case there is a break into the wireless network, I don't want them to be able to break into my wired lan.

Thanks.
-AP_

The route add tells the wireless PC to use the alternate gateway to reply to a request from the wired PC. The wireless PCs are still blocked from initiating a request to the wired segment by the firewall in R2. In my case I forwarded port 515 to the IP address of my print server on the wired segment to allow wireless PCs to print to it.
--
Jim Anderson

With the NAT disabled in R2, 192.168.8.0 addresses reach R1 and then use R1's NAT to go out to the internet?

So there is still a firewall even with NAT disabled? I always thought that NAT was the firewall in most routers. I guess the SPI firewall is separate from NAT and still does not allow arbitrary traffic INTO the router?

Thanks.
-AP_

Yes, R1 must do NAT for both subnets (not all routers will doe this, the ones I mentioned will). On the Zyxel routers you can enable/disable NAT and the SPI firewall separately. You may be able to do this with some of the Linksys routers.
--
Jim Anderson

You could always get a soekris box (net4801) for about $275, »www.soekris.com/ which has a WAN port and 2 LAN ports and then run M0n0wall on it, »m0n0.ch/wall/ . I have my wired LAN on one LAN interface and my wireless on the other. Then configure each interface for 2 different subnets and a firewall rule on the wired LAN to block all traffic from the wireless LAN. That way the wireless network is behind NAT but cant get to my wired LAN but I can access the wireless network via the wired.

Its not clear to me how this avoids double NAT. Its seems like both routers are on seperate subnets!?

When you disable NAT on R2 (the Zyxel) it acts as a pure router. When a PC on the R2 LAN accesses the Internet its real 192.168.8.x address is passed to R1 by R2. R1 then replaces the 192.168.8.x with its WAN IP address (which is why R1 must be able to do NAT for more than one subnet).
--
Jim Anderson

reply to janderso1
If I map R2's MAC address to 172.x.x.2 in R1. Then in R2 enable DHCP for the WAN port. R2 should get the proper IP address from R1 based on MAC, and possibly it will get the DNS servers as well?

Just trying to get automatic DNS address updating as my ISP likes to tinker.
--
dnoyeB
"Then said I, Wisdom [is] better than strength: nevertheless the poor man's wisdom [is] despised, and his words are not heard. " Ecclesiastes 9:16

That should work but I haven’t tried it. 172.16 through 172.31 are valid private Ips.
--
Jim Anderson

reply to janderso1
Well it was all good until I tried to ssh into my linux box. Having issues.

When you don't NAT you cant ssh to the WAN IP of the Zyxel, you must use the actual LAN address of the computer you want.

So the first router does NAT and the 2nd router doesen't. But this raises the question of what kind of protection is being provided by the 2nd router? Port forwarding don't make sense on the 2nd router since its not doing NAT. Ports only get forwarded when they are targeted towards the routers WAN address, but this don't work with NAT off if I am comprehending correctly.

On this same notion it does not make sense to have the first router target the 2nd router as its DMZ since stuff targeted toward the router with NAT off just gets blocked.

The scheme just does not work. With NAT off it basically walls off the whole thing. You can initiate connections from within the router, but nothing can be initiated from without. You can't tell the router what to do with an incoming port without NAT...

If you want fidelity and flexibility, stop trying to put a round peg into a square hole. There is nothing wrong with Janders methods but there are limitations as one should expect with a process, which is a work around from the get go.
--
Ain't nuthin but the blues! "Albert Collins". Leave your troubles at the door! "Pepe Peregil" De Sevilla. Just Don't Wifi without WPA, "Yul Brenner"LlamaWorks Equipment

reply to dnoyeB
It is true that with NAT off you must use the LAN IP address of the computer you want to access, not the WAN IP of the Zyxel. You have two subnets with R2 routing between them.

The firewall in the second router protects its LAN segment. Try to telnet to a PC on R2s LAN and you will see in the log that the firewall blocked it.

Port forwarding also creates a firewall rule in these low end Zyxels to allow the incoming traffic so if you forward the SSH port to your SSH servers LAN IP you should be able to connect. I forwarded port 515 to my print server and port 53 to my DNS server and they work. In other words port forwarding does what you want with NAT off or ON.

Setting R2 as the DMZ/default server of R1 allows R2 to log incoming port probes (and I indicated that it was optional). If you are using the Netgear WGR614 as R1, it doesn’t log incoming port probes. Another benefit of setting R2 as the DMZ target is you don’t need to set up any port forwarding on R1 unless you have a server on its LAN segment that needs to be accessed from the Internet.
--
Jim Anderson