Connecting two subnets with router

Question

I'm trying to share a couple printers on two subnets and I keep running into issues. I'm trying to figure out the best way to achieve this while maintaing a public and private subnet.

On the router inbetween LANs I've disabled DHCP and given it a static IP from the Wireless Router. I've been trying to forward ports for the printers through this router but since it is not acting as a DHCP server nothing seems to be going through.

I am able to connect to the remote management port (8080) from the wireless subnet (192.168.1.0/24) but nothing else.

Please advise and let me know if there is more information I can provide.

I want both LANs to have internet access, but I do not want the Public LAN to be able to access anything on the Private LAN except for the printer.

The OpenBSD machine has two interfaces currently which are used, we may have extra hardware kicking around that could be utlized if necessary.

The Wireless Router is a Cisco DPC3825, and I can log into it.

The router I am attempting to use to connect the LANs is an old LinkSys WRT54G.

Answer 1

The network you have seems to me to be unneccessarily complex and difficult to maintain. For the cost of an extra NIC in the OpenBSD server you can have a system which is much easier to control and maintain - and - I suspect - more secure as there is only 1 possible path onto the Internet for the Wireless router.

What I propose a solution along the following lines: (Excuse the very quick diagram)

The idea here is to have the OpenBSD box handling all the routing for everything.

Disable DHCP on the Wifi router (actually disable everything, turn it into an Access Point), and run DHCP on the OpenBSD server for both the Protected and Guest Interfaces.

Put each Interface on a seperate subnet (for example 192.168.100.0/24 and 192.168.101.0/24), so that in order for the unprotected stuff to communicate with the protected stuff (or the world) it needs to go through the OpenBSD server.

Do firewalling on the OpenBSD router to prevent unwanted communication.

You can do policy routing if, for example, you want the Wifi router to only use one of the 2 modems). Of-course, depending on your Link aggregation router you may have some work to do there - or indeed, you may want to get rid of it altogether and set your OpenBSD box to do the aggregation routing.

I note that I put the printer behind the Wifi Router = unprotected network. This makes the protected network more secure as it means that you don't need to allow connections from the unprotected network into the protected network. The flip side is it makes setting up printers on the protected network a bit harder as they won't be able to scan the subnet. The alternative would be to put the printers in the protected network and allow the unprotected network to access the printer through the firewall.

I note that I've done this using an additional Network card in the OpenBSD server. An alternative solution if your printer is VLAN cpabale would be to keep with 2 nic, and then use VLANS on the switch to designate each network. This makes management easier and requires less hardware - but does make the assumption that VLANS are secure - an assumption which is open to question. If you go this route, and have a fancy printer, you may be able to make the printer accessible through both VLANS so it is easy to install - but this will depend on the printer and may not be practical.

(I greatly prefer the VLAN solution, BTW - Also, while I have done pretty much all of this, I've never used OpenBSD seriously - my solutions are all Linux based)