Quote from WinstonTJ:
daisychain two routers together and put your trading subnet on the FIRST wired-only router with your wireless subnet second.
I used WinstonTJ's setup for a while, but I always considered it a bit security compromised. (I had the family router on the outside. Higher latency on the trading network, but better security.)
The RV082/RV016 is a reasonable choice for non-paranoid people. I have had good reliability from them. The WRT is crap, but it is only for the home network.
From WinstonTJ's setup, my assumption of highest risk are children's computers on the home network. Second highest risk is your web server. You may not have one yet, but you will.
The children's computers have access to the WRT. The WRT has access to the trading physical network. Once hacked the WRT has several attack vectors to the trading network. By obfuscation, the WRT may be isolated from the trading network. Hackers are looking for lowest hanging fruit too so they may not find your trading subnet on the same physical network. (Since WRT has single outbound IP, the hacker would risk locking himself out, but the WRT can be flashed with an open-source OS. From there, he just has to listen.) He might even be able to skip that step by turning-on NETBIOS forwarding.
If the WRT is not compromised, then the children's computer still has access to the RV082. From there, a hacker can open everything up.
The problem with the subnet solution is that it is in software/configuration, and configurations can be changed. The approach that I followed the second time was to have two external IPs, isolate the network hardware down to the two computers that needed dual access. On these two computers, add an extra NIC card and subnetting. No Windows routing enabled. Keep Windows locked down. Use those two computer for work. Use a wireless laptop on the family network for play.
The separate external IP solution won't satisfy the paranoid. The external side of each router can still see each other at 100 Mbps speed. Hacking one could certainly allow a DOS attach on the other. A hacker entering a childs computer is going to go looking for an adult's computer if he wants financial information. If I were really concerned, I would take the two work physically off the home network, but it comes in handy.
The second highest threat is your web server within the trading environment. Maybe you don't have one yet (IIS is a standard Windows feature/role), and you may not have port 80 forwarded.
Once you do, however, modern web servers are too sophisticated in their responsiveness to be sure that it is locked down. For example, I wrote the code behind the web page CorrSearch.aspx with appropriate care for SQL Injection, resource hogging, buffer overflows, ... , but the ASP.NET framework added call backs for
WebResource.axd?d=ESUgtw21gu19XRI39iU6GTmI5bPD2meO8BfUTS_Akbj6BCvbOuHQ7yGOeohPAV2vnVxRBU8WqNekIQN5riHJUnTGau6VSesczEAVxGSSv2s1&t=634268709827848763
I didn't right it. I can't easily verify the version. I can't know if a hacker editing the return URL can do something harmful. I know what it is about, how do I know that everything is really patched-up tight?
That is why one usually uses a N-tier solution where the web servers face the outside router. The Web Services machines which support the Web Servers are separated by a firewall. compromising a Web Server, thus only gets you access to the outside router and one port which only accepts structure requests from an internal subnet. The Web Service infrastructure is designed to handle the normal means attack. The only thing that it can't protect is properly structured bad requests, but that is in your control. Don't include a function "ExecuteThisStringAsAnSQLCommand". (I surprisingly often missed step when going from prototype to production.)
The outside router is then configured to treat the Web Server network just as suspiciously as the outside.
Anyways, network security is a big subject with many people intelligent people working full-time on it. Some kinds of unconventional attacks require solutions beyond the scope of a forum. At some point, however, its just a calculated, business risk.
