One IP - two separate LANs for security?

[rmd3003]

I need to create complete isolation between two LANs on home network. Now, how secure this approach is? Let's say if network one is compromised, can malware spread to second one?
LAN1 and LAN2 are on different subnets.

 

[DlStreamnet]

What router?

Can only have same IP across two vlans using PVLAN's

 

[rmd3003]

What router?

Can only have same IP across two vlans using PVLAN's

All routers are regular routers. No VLANs

 

[DlStreamnet]

Sorry, misread the question...think I was reading a different thread altogether lol - sorry.

Yeah that would work fine, you don't need 3 routers though, just 2, and set the second as it's own ip range with the D/G of the main router

 

[/usr/home]

Also don't use WEP. Use WPA2.

 

[Liger88]

Exactly as said above. You could easily get away with two routers though, especially when you consider the cable modem is its own little router. Kind of overkill the way it's setup given I'm sure they're just plain jane consumer routers you wont get much benefit. The routers will block broadcasts from the different networks altogether and being on different networks should mitigate most threats. Doubt you'll ever see anything complex enough that it would prove otherwise.

 

[ThreeDee]

use an old computer and set up a smoothwall box with 3 nics in it .. red/green/purple interfaces .. red goes to modem .. green and purple will be your separate lans that can't see eachother unless you create special rules for them to do so.

 

[Red Squirrel]

You can do that setup but with two outside IPs. You should be able to just pull a second one from your ISP. Maybe ask them about that to make sure it's ok.

Another option is to setup pfsense, smoothwall or other OS of choice as suggested and have a single WAN and two LANs. You can then setup rules for what can and cannot access one LAN or the other. I have this setup on my pfsense box and it's nice. The wireless is on the "public" and everything else is on the private, but there's a few ports I allow through such as my climate control server. If I'm working on someone's PC, I also put them on the public in case they have a virus.

Now that I have a switch that does VLAN's I will probably refine this further in the future.

 

[tangoseal]

Just buy a real prosumer router like Mikrotic for $70.00 and it can do all the stuff you want.

 

[RocketTech]

I'd use pfSense with VLANs, only one NIC necessary and no Rainbow-Brite/My Little Pony interface nomenclature.
Your switch will need to support 802.1Q Trunks, but you wanted a cool new switch anyways, right?

 

[robvas]

It will work the way it's pictured, you'll just have double-NAT

 

[Nicklebon]

1 low end real router
2 switches (can be typical consumer pos type) or 1 real switch
2 AP
Profit