Network within a network

Question

I will start with giving you a Noob Alert, Sorry we have to learn somewhere.

I just wanted to run an idea past you.

I have setup a home server, this is to host a couple of games for my friends. To get a dedicated IP I have connected my server to a Static IP VPN provider, everything is connecting great and the server is running most of the time only when I break something not relevant to this post.

I am thinking of creating an extra layer of protection for my network, is it possible to create a network within a network, I heard of something called a VLAN but I dont have the hardware to do this.

What I am thinking is using an old netgear router, connect it to my network via the WAN port and set it so it runs on a different IP range.

Would this work and is there anything else I would need to thing about?

Answer 1

The concept of a network within a network within a network doesn't really exist. What you do have is interconnected networks with restrictions between them, and networks subdivided into segments.

VLANS are a mechanism for separating a single physical network into multiple networks in the same switching infrastructure - where traffic between the different networks are for the most part kept separate or forced through a switch.

Daisy chaining routers as you propose will give a higher degree of isolation to the devices behind the innermost network, at the cost of potential "double nat" issues - ie translating "non routed" (properly known as RFC1918 addresses) addresses into a second non routed address. This can create problems with some complex protocols, can be difficult to debug but often works in practice. You need to make sure that the IP ranges of the LAN ports of each router are different, eg change the inner router to use IP addresses is the 10.0.0 range if the outer one is using the more common 192.168 range.

Answer 2

I will answer the base question about security rather than the network question which will not improve security. The reason is that if your server is visible on the Internet then it is attackable, no matter how many routers or networks this connection traverses.

You will get much better protection by running your server in a virtual machine. This way, a successful attacker will at most corrupt the guest VM, but not the host computer. If you keep a copy of the VM, it can in case of infection be deleted and replaced by the healthy copy.

The VM can be visible on the local network, indistinguishable from a physical machine, and you can port-forward to it the game ports just the same as you now do to the host.

Answer 3

You want to put your server inside a DMZ zone.

In computer networks, a DMZ (demilitarized zone), also sometimes known as a perimeter network or a screened subnetwork, is a physical or logical subnet that separates an internal local area network (LAN) from other untrusted networks, usually the internet. External-facing servers, resources and services are located in the DMZ. So, they are accessible from the internet, but the rest of the internal LAN remains unreachable.

How to do it:

There are various ways to design a network with a DMZ. The two basic methods are to use either one or two firewalls. A single firewall with at least three network interfaces can be used to create a network architecture containing a DMZ. The external network is formed by connecting the public internet -- via internet service provider (ISP) connection -- to the firewall on the first network interface, the internal network is formed from the second network interface and the DMZ network itself is connected to the third network interface.

You utilize firewall rules to isolate DMZ network. Exact configuration my vary but in your case, you just need to block all traffic coming from DMZ interface(network) towards your Internal network(network interface). So having a device with firewall capabilities is a must, although if you have a Managed switch laying around you could do it with ACLs too.

---

What I am thinking is using an old netgear router, connect it to my network via the WAN port and set it so it runs on a different IP range.

This idea of yours could do the trick, but only if you put your internal network behind that Netgear router and by doing so "hide" it behind the "IP masquerade" or NAT

IP masquerading is a technique that hides an entire IP address space, usually consisting of private IP addresses, behind a single IP address in another, usually public address space. The hidden addresses are changed into a single (public) IP address as the source address of the outgoing IP packets so they appear as originating not from the hidden host but from the routing device itself. Because of the popularity of this technique to conserve IPv4 address space, the term NAT has become virtually synonymous with IP masquerading.

Network Address Translation (NAT) is a process in which one or more local IP address is translated into one or more Global IP address and vice versa in order to provide Internet access to the local hosts. Also, it does the translation of port numbers i.e. masks the port number of the host with another port number, in the packet that will be routed to the destination. It then makes the corresponding entries of IP address and port number in the NAT table. NAT generally operates on router or firewall.