# Howto deny traffic between subnets with router, yet share cable modem access?



## billbengtson (Apr 13, 2010)

Mainly as a means for virus protection for my PC… (from the kids' computers who will eventually become virus infected again), versus protection from being hacked for example…

Ultimately I'm trying to block All traffic between PCs on different subnets on my home network, yet allow all PCs access to the Internet via the same cable modem?

More precisely, I'm trying to figure out if I can install my wife's & my computers on a separate subnet from the subnet that the kids' 2 PCs are on… and then have a router block All traffic between the 2 subnets… yet allowing both subnets to share the same cable modem for Internet access?

At this point I do not own the switch, but I am currently using a Linksys WRT54G router that has been flashed with the DD-WRT micro firmware. My total budget is around $300'ish. Less money is always better though.

My thinking is that I all of the computers will be connected via a layer 2 switch, probably a consumer grade gigabit switch… but I could consider a Used Cisco managed switch, but my budget wouldn't get me gigabit speeds with a used rack mount Cisco IOS switch, where a consumer-grade switch would.

Then each PC will be assigned a Static IP to place it within its respected subnet. The subnets that I'm thinking of using are:
-subnet 1 is for wife's PC & my PC, static IPs
-subnet 2 is for kid 1's PC & kid 2's PC, static IPs
-subnet 3 is for Wired DHCP
-subnet 4 is for the Wireless Access Point DHCP

In-between the switch & my cable modem will be the router. My current Linksys router is using the DD-WRT micro firmware… which I believe that I can configure with routing rules… but I'm not sure yet on how to do this. Also, I might be willing to consider buying a different router, such as a used Cisco enterprise router which I know that I can setup ACL's. But would that be a decent enough firewall for my cable modem? 

As I know it, for PCs on different subnets to talk to each other, they need Layer 3 routing… the Layer 2 switch would not be able to route traffic between the different subnets. 
So I'm thinking & hoping that I can configure a router to allow all PC access to the Internet, but block All traffic from accessing other subnets.

Finally, I'm not sure if blocking the traffic between the subnets would actually be guaranteed to prevent viruses from spreading to another subnet? I'm aware of viruses spreading via email, thumb drives & etc…

Thanks in advance for your feedback.


----------



## billbengtson (Apr 13, 2010)

I guess I feel like there are a couple more pieces of info that I should add.

I know that my current Linksys router has a 4-port switch built in, but the reason that I am wanting to add an actual Switch is that I'm planning on wiring up my house for Data... & that I'll be using something like a 24-port switch for all of the cat5e lines in the walls.

My wife & my PCs will hopefully have gigabit connection between us to share files, & the 2 kid's PCs will also have a gigabit connection between them. But I am worried about my wife's & my PC from catching a virus from the kid's PCs... as my wife & I do photography on the side for clients & I want to try to protect our PCs as much as we can... as the youngest son just got his first virus... as there will be many more to come from the kids I'm sure...

Thanks again.


----------



## ab0mbs (Jul 18, 2009)

I personally am not familiar with DD-WRT but i've heard its good firmware. On a cisco switch the best option would be to designate different portions of the switch to different vlans which would allow them to be in different subnets on the same switch. The problem i see is getting different subnets to connect to the router. I assume you can setup different ports on the router under different subnets (you would have to have 1 CAT5E line for each subnet going into a port on that vlan subnet) although you would have to find a way of blocking them on the router. On the switch you can block them via access control list.


----------



## scottsee (Feb 28, 2007)

I have never used your router, or DD-WRT, but it does support per interface Vlan's which is the solution to your question.. 

Won't cost you any extra $. How's that for cheap..


----------

