I have the following situation:

  1. Router 2 is a given. It is used by several people to go on the internet ('People we don't trust').
  2. We are a tiny company that is supposed to go on the internet through Router 2; we have 1 Ethernet cable coming into our room. However, because we don't want the 'People we don't trust' to access our file server, printer etc I thought we should put another router (router 1) to create a separate network.

My question(s):

  1. Is it the correct solution to use a second router for this? If I understand it correctly, putting a switch is not the correct solution as it will allow the 'people we don't trust' to acces our network. I read about VLANs but I have a hard time understanding if this is sufficiently secure.
  2. If it is the correct solution, how should I configure this router 1 so that we have acces to the internet, but other people do not have acces to our network. Should I do anything particular for security?

Diagram of situation


closed as too broad by Ron Maupin Mar 25 at 13:26

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, your question is really too broad to answer. We need more information, such as the network device models and configurations. Also, If you use a router, you will somehow need to configure router 1 to tell it about the network behind router 2, but your comment says you do not control router 1, and questions about networks you do not directly control are off-topic here. – Ron Maupin Mar 25 at 13:26

Your question is rather broad, so I can only provide a broad answer.

When required, you divide your network into zones of different trust - this is what you've already done. The zones are connected by a router or firewall with an appropriate ruleset. Generally, you'd want to

  • permit connections from our network to anywhere (Internet)
  • deny everything else

Connecting different zones by a switch makes it harder to control the traffic as needed, so almost always a router is used. If you can't configure or trust Router2 (assumably not under your control) you need another router. Not that if you divide your network from the other one you need to supply your own DHCP service as well.

With a decent managed switch you could set up ACLs to deny inbound traffic from the untrusted network into yours. To elaborate on that we'd need much more information about the network than you've provided (network prefixes, gateways, DNS, DHCP servers, ...).

  • Thanks, the router option seems simpler so I'd prefer to go with that. Router 2 is not under my control. It is just a classic home router with an DSL/cable modem in it. It also has a DHCP server that gives Ip addresses to the 'people we don't trust'. So does this mean that Router 1 should receive an IP address on its interface that is connected to Router 2? – Kristof Mar 25 at 11:03
  • @Kristof A router requires IP addresses on all of its interfaces in order to route. You can just use an IP address from the "network you don't trust". If Router 2 doesn't route your new network you need to use source NAT. – Zac67 Mar 25 at 12:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.