| How should I set up two routers to provide untrusted wireless users access to WAN but not expose my internal LAN? |
 | The easiest way is to connect your wireless router (#1) to the WAN, then connect the WAN port of Router #2 to one of Router #1's LAN ports. Make sure the two routers are set to different subnets (base addresses).
Setup Tips:
- Router #2 can be either a wired or wireless router.
- If Router #2 is wireless take the following precautions on Router #2:
- Use a different clear channel (1, 6, or 11)
- Use a different, non-obvious, non-descriptive ESSID
- Enable the highest level WEP you have and don't use an easy-to-guess key like all 1's or 0's
- Enable MAC address association control
- Disable ESSID broadcast or use a "closed network" option if you have it
- Set Router #2 to be a DHCP client (obtain IP address automatically) on its WAN port.
- Your wired LAN clients should all connect to the second router, and you can set them to obtain their IP address information automatically, or use static IP addressing if you wish.
- If you forward any ports on the second router, remember that this will allow any computers on the Router #1 LAN to potentially access the computer that the ports are forwarded to.
- If you need to run Internet accessible servers, you should connect them to Router #1, but lock them down tightly, i.e. don't keep anything else on them, use strong passwords for admin accounts, don't enable any more services than necessary, etc.
|