<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>So you're saying that my 2 router configuration won't work? If
that is the case what brand besides Cisco makes a 1 WAN to 2 LAN
router? I say besides Cisco because the only one I worked with
many years ago were Cisco 2600 series routers, which I loved at
the time just not the price. <br>
</p>
<p>On disability pay it's sort of off budget. What I was planning on
doing was taking one ASUS router and putting a NetGear 16 port
switch off of that to drive my DMZ LAN then the 2nd ASUS router
would be off of the front LAN to create the back LAN which would
be the private LAN also with a 2nd NetGear 16 port switch. The DMZ
will have 2 game consoles, and 2 media streamers and 2 smart tvs.
But then I ran into articles on that say complete reverse of what
I had planned also using 2 routers. One of the articles endorses
3rd party firmware from Russia, but I'm a little leery of that
these days.<br>
</p>
<br>
<div class="moz-cite-prefix">On 03/25/2017 05:09 PM, Jim Kinney
wrote:<br>
</div>
<blockquote
cite="mid:CAEo=5PyOt=FGDo5uVUfyOnzk4VM7TJodzYbhnW0gk8G2uigJbQ@mail.gmail.com"
type="cite">
<div dir="auto">The DMZ is a zone. One box or many. It is directly
connected to internet and may or may not connect to the inside
LAN. If it does, the firewall and routing is very, very
specific. And, yes, firewall between big bad interwebs and DMZ.
<div dir="auto"><br>
</div>
<div dir="auto">The inside, trusted LAN doesn't connect through
DMZ network to outside. It connects to firewall/router and
your internet demarcation line.</div>
<div dir="auto"><br>
</div>
<div dir="auto">So 3 nic Linux box. Nic 1 goes to internet, 2 is
DMZ and 3 is private lan. Iptables on the box. LAN and DMZ are
separate subnet with the box as their gateway. DMZ often has
internet routable IPs. LAN usually does not and is NAT'ed. DMZ
can be NAT'ed as well. If DMZ is not NAT'ed, nic 1 will need
to in bridge mode.</div>
<div dir="auto"><br>
</div>
<div dir="auto">The terminally paranoid will add a second
firewall box on the wire between nic 3 and the internal LAN.</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mar 25, 2017 4:42 PM, "Scott
Castaline" <<a moz-do-not-send="true"
href="mailto:skotchman@gmail.com">skotchman@gmail.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">So I would
put the DMZ on the front or first LAN and then everything
else on the back or second LAN? And also the DMZ is a single
device and not the LAN itself? What if I have multiple DMZs
on the first LAN can I do that?<br>
<br>
<br>
On 03/25/2017 12:30 AM, Alex Carver wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
On 2017-03-24 21:05, Scott Castaline wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Okay I've had the cable pulled in my house I was able to
unbrick an<br>
older ASUS router which is running ASUSWRT-Merlin which
has the radios<br>
shutoff for the access part of it. Many years ago I
remember setting up<br>
several dual LANs, the first LAN was unsecured and all
of the web facing<br>
gear was on that. Then a second router with LAN to LAN
interfaces which<br>
connected to LAN 1 and LAN 2 was off of this router and
was a secured<br>
network. I thought this what a DMZ was, but on google
searching DMZ<br>
structure I'm finding that the DMZ is a single server by
itself. The<br>
other thing that I'm finding is that the secured LAN is
on LAN 1 and the<br>
DMZ is on LAN 2. That doesn't make sense to me.<br>
<br>
Can anyone enlighten me with what would be the correct
way of doing this?<br>
<br>
<br>
</blockquote>
You can make up a DMZ using a three port router or you can
daisy chain<br>
two routers with the link between them being the DMZ.
Your LAN would<br>
hang off the back router farthest from the WAN.<br>
<br>
Either way you're just setting up a bunch of packet filter
and routing<br>
rules. The advantage of the dual router approach is that
it would<br>
theoretically be harder to break into your LAN because two
routers would<br>
need to be compromised.<br>
<br>
A single router approach needs a router that can handle
all traffic.<br>
The dual router approach only needs enough horsepower on
the front<br>
router to handle the traffic. The back router, in theory,
sees less<br>
traffic.<br>
______________________________<wbr>_________________<br>
Ale mailing list<br>
<a moz-do-not-send="true" href="mailto:Ale@ale.org"
target="_blank">Ale@ale.org</a><br>
<a moz-do-not-send="true"
href="http://mail.ale.org/mailman/listinfo/ale"
rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a moz-do-not-send="true"
href="http://mail.ale.org/mailman/listinfo"
rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo</a><br>
</blockquote>
<br>
-- <br>
Sent to you and NSA, CIA, FBI, SS, DHS and GOD only knows
who the hell else...<br>
<br>
______________________________<wbr>_________________<br>
Ale mailing list<br>
<a moz-do-not-send="true" href="mailto:Ale@ale.org"
target="_blank">Ale@ale.org</a><br>
<a moz-do-not-send="true"
href="http://mail.ale.org/mailman/listinfo/ale"
rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a moz-do-not-send="true"
href="http://mail.ale.org/mailman/listinfo"
rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo</a><br>
</blockquote>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Ale mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ale@ale.org">Ale@ale.org</a>
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Sent to you and NSA, CIA, FBI, SS, DHS and GOD only knows who the hell else...</pre>
</body>
</html>