Creating a secure Home with seperate networks

[timoty]

I’ll try to simplify this and make it brief. However, if anyone needs, or would like, a more detailed explanation please let me know. My kids are old enough that I am starting to worry about the information on my home network that I want secure. This includes loading programs like himanchi and asking to have their friends join my wireless network. In an attempt to fix this, I have created two separate networks. However, I do NOT have managed switches and cannot create VLANs and there are several points in my home where running new cable would require laborious construction measures that I don’t want to do. I have a four level back-split.

Presently, my network is setup as follows (This is simplified but basically covers it):

Modem to switch to two routers back to switch through a cable to the basement to another switch to two more cables that each attach to switches. One of the final switches are for my secure area and several computers, printer, NAS, etc. The second final switch is in the games room for my sons’ PCs, the XBOX and a wireless access point for his friends to use.

Each of the two routers gets a separate public IP from my service provider and each router has a unique IP address (192.168.1.X) and (192.168.2.X). The boys’ PCs and the XBOX are setup with static IPs and the friends that want on my network are assigned IPs from the Wifi access point attached to the switch in the games room. My router assigns IPs to whatever I connect to it with the exception of my printer and NAS which I have assigned IPs to.

So here are my questions:
1) With a maximum of 20 users or IPs creating traffic at any given time in my home, will this create enough ‘collisions’ to make this setup problematic?
2) Is there any fear that someone hacking into one of my kids’ PC’s could compromise my security (I realize that all they would have to do is change their IP address to get on the second network, but this is beyond my kids or their friends….for now)?
3) Is there any chance that someone hacking into the IP on my kids side, would be able to see the items on my second network and get at them since they are using the same cabling and switches without VLANs set up?
Finally, if there is a better way to do this using subnets or anything else, I would love to hear your ideas.

 

[dbhosttexas]

Just a thought. Use a DD-WRT enabled router (they are relatively inexpensive) and you will be able to create those VLANs you want...

 

[john-b691]

The traffic will not be a problem so much, most switches are wire speed so they can handle port speed x2 x number of ports. If you get a broadcast storm could be a issue.

Very bad network design you have your WAN network and both you lans overlapped. Who knows what crap your machines are sending your ISP. All depends what the modem does with broadcasts. You also run the risk if your routers use DHCP for their wan ports they could get IP from your internal routers. Not sure if you hook the wan port to the lan port on a router if it could learn it from itself but it can learn it from the other router.

There is no other solution to this other than to use vlans....well you can buy lots of switches and cables....

Can someone get to your stuff yes. Will they be able to guess you other lan network without some inside help from your kids unlikely. You could change the second network to 10.x.x.x to make it harder to guess. maybe use a different subnet mask

On the machines you really want to protect you could I suppose put in fixed arp entries mapping the ip to mac and then put firewall rules in limiting traffic to only those IPs.

You are running what is called security though obscurity. Never a first choice but I suspect your only option without vlan support.

 

[lukeconft]

DD-WRT is the way to go with that I think. Check one of your routers is compatible. I would not feel good about having my internal network traffic going via the external switch. Are you able to run a second cable to the basement to give you different physical connections for the 2 switches there? If not, are you using Gigabit links to the basement? If no is the answer to both questions, You could try rewiring the LAN cable that goes down to the basment. Basically, network connections up to 100mb only utilise 2 of the 4 pairs in an ethernet cable. As a result, you could buy yourself some rj45 connectors and wire up so you can have 2 connections at each end. Won't work with gigabit as it requires all 4 pairs, but could be a relatively easy solution to your problem.
Also, using DD-WRT allows you to introduce access-lists, so you can actually stop communication between certain subnets and to certain devices etc.
http://www.dd-wrt.com/site/index

 

[timoty]

First off, thank you to everyone who is providing feedback. john-b691, I am confused about one thing you said. You mention that, "you have your WAN network and both you lans overlapped." I'm not sure how that is happening. The modem port goes to a switch, and then to the WAN ports on each of the routers. The routers each pick up a seperate external IP from my service provider via DHCP. So each of my routers clearly knows where to send traffic going out of the home. There is a network cable that goes from the LAN port on each of the routers to a second, different, switch and then a third ethernet cable from that switch to the basement to a third switch, and then two cables from that switch; one to my secure area and the second to a games room.

All the switches and my router are gigabit. The router the kids are using is only 10/100. So if I use this DD-WRT with the exact setup that I presently have, will that solve my issues? I will still have the same traffic on the same lines so won't there still be a way that someone on one network could cross over into the other?

 

[timoty]

One more question. If I can somehow 'finess' a second line into my basement, would there be any concern with the one crossover point that happens after the WAN ports on each of the two routers to a switch that then goes to the modem? I would think that each of the two modems' firewalls would block anything that would attempt to go into it that eminated from either the internet OR the second router on the switch...correct?

 

[lukeconft]

Thinking about it, there is a way to physically separate the networks.
Make yourself 2 Splitters - http://www.instructables.com/id/How-to-make-your-own-Ethernet-%22splitter%22/

This will allow you to use a single physical cable as 2 cables. At the router end, remove the switch that they both plug into on the internal side, plug 1 side of the splitter straight into each router, then go to the basement, remove the switch that the single cable would terminate to plug the splitter in, cable each connection to your other 2 switches, i.e 1 to your secure switch and 1 to your games room switch. At that point, there is no way that there can be communication between the devices on the different networks, unless you configure a static route on each router to take you to the other network.
At the end of it, you will have freed up 2 switches, you shouldn't need to purchase new hardware or use DD-WRT, which can save you a bit of complication. Just need to make yourself a couple of splitters. Obviously, if you aren't using wall ports on your configuration, then you could use the female rj45 connector at the 'single' end of it, or a coupler.

The problem with using DD-WRT, is that you will be creating VLANs, but since none of your switches can operate as trunk ports, then this is limiting you to a single VLAN per physical connection or wire. Since you have only 1 wire connecting to your basement, you need to do the above or run a new cable to achieve your objective, whether you use DD-WRT or not.

 

[lukeconft]

One more question. If I can somehow 'finess' a second line into my basement, would there be any concern with the one crossover point that happens after the WAN ports on each of the two routers to a switch that then goes to the modem? I would think that each of the two modems' firewalls would block anything that would attempt to go into it that eminated from either the internet OR the second router on the switch...correct?

You are correct, there shouldn't be communication, both because of the firewall, but also because you do not have any route configured. To put it simply, the routers do not know about each others internal networks, unless you tell them.

 

[timoty]

Thanks lukeconft. By adopting your solution, I will lose my gigabit capability will I not? As was stated earlier, I will be taking half of the wires from my Ethernet and thereby limiting my traffic to 10/100.

Have I mentioned that I hate back-splits. There are five 2 X 12s nailed together that create the support beam between the levels. I drilled one hole through it to get the single wire through it that exists there now and it took me hours. Since then, I have added drywall so it gets even more difficult...or at least messy.

I may try what you have suggested lukeconft and just move my NAS to a place between my main PCs. That way I can still have my gigabit speeds where I need them and the 10/100 speeds won't matter as much going upstairs to the router. I have 30mbps internet so it shouldn't limit me.

 

[lukeconft]

Yes you will lose your capability to do Gigabit, but unless you are carrying out large file transfers, I don't see it making much difference, maybe streaming 1080p video files?

It can be a right ah heck to add cabling once its all in, we managed to do it at my house by taping 2 cables to the existing one and pulling it through, but we were fortunate that there weren't any tight holes along the route. I think this is the best solution for what you want to achieve without forking out a good amount of money for a new switch.

 

[timoty]

Well, thank you all for your ideas. Not sure what route I will go yet. I do transfer 1080p blue ray from my NAS so I can't drop to 10/100. And unfortunatley, after thinking about it, I need that gigabit transfer speed in both areas so I can't limit the cable to 10/100 anywhere. Sooooo....it is either the DD-WRT option (which I have yet to explore) or a new cable. Gigabit wireless transfer speeds will be here soon and all this cabling will be a thing of the past.

 

[lukeconft]

Well, thank you all for your ideas. Not sure what route I will go yet. I do transfer 1080p blue ray from my NAS so I can't drop to 10/100. And unfortunatley, after thinking about it, I need that gigabit transfer speed in both areas so I can't limit the cable to 10/100 anywhere. Sooooo....it is either the DD-WRT option (which I have yet to explore) or a new cable. Gigabit wireless transfer speeds will be here soon and all this cabling will be a thing of the past.

If you go down the DD-WRT route, you would only need to buy 1 802.1q compatible switch and make 1 of your routers DD-WRT, although, you may end up making them both DD-WRT if you end up liking it as much as I do. I'm using a HP Procurve 1800-8g as my switch. Gig capability and VLANs as well as LACP.
I can draw you a diagram for that if it would help?

 

[timoty]

If you wouldn't mind that would be helpful. Also, I am not familiar with the acronym LACP.

 

[lukeconft]

Take a look here : http://bit.ly/12jGRwK

This setup is possible, but ideally, a switch at each end would be better, as with this setup, the secure router is being used as a through device for the gaming network. I had a quick look around and it appears the Netgear GS105E should support what you require, but I'm not sure what your budget is like etc.

 

[timoty]

Thanks for the diagram. And thanks for the netgear suggestion. I had no idea that you could purchase a home use VLAN capable router for under 200 bucks. I will return my unopenned Dlink gigabit unmanaged swith and get one of these. Handier even if I do run a second wire....which I am seriously considering at this point.

 

[timoty]

OK....well to sum up this story...several holes in my drywall later.....I just bit the bullet and ran a second AND THIRD AND FOURTH....cable. I may never use the other two...but any future homeowners may when terabit internet comes around =)

Thanks again for all the help. I will be flashing my router to DD-WRT regardless as it certainly looks like an upgrade.