Application note: Using two Belkin Wireless Routers

Created 30-JAN-2004 by George J. Carrette.

Two Belkin wireless routers may be used together in order to implement better isolation, especially in your wireless network. In my case I had some devices that would only work with WEP. For the obvious security reasons I did not want to run a wireless access point protected only by WEP on a router that had access to my private LAN. Not only would security be a problem, but the older devices were also slower, 802.11b devices, which would slow down my faster 802.11g capable network.

My configuration:

                        Open Wireless Network
                                  |
                                  |                           WPA Network
[DSL-MODEM]<----->{WAN-PORT}[BELKIN ROUTER 1]                     |
                                  |                               |
                             A*{LAN-PORTS}<------>{WAN-PORT}[BELKIN ROUTER 2]
                                                                  |
                                                             B*{LAN-PORTS}
                                                                  |
                                                              Private Lan

• BELKIN ROUTER 1: Is configured to use a PPOE connection to my ISP. It has a LAN address of 192.168.73.1, with a DHCP range of 100 to 200. It has an open wireless network or a WEP protected network, which is almost the same thing.
• BELKIN ROUTER 2: Is configured to use a Static connection in its Internet Settings. But the ISP is really a LAN port off of BELKIN ROUTER 1. The WAN IP address is 192.168.73.2, and the default GW and DNS are set to 192.168.73.1. It has a LAN address of 192.168.72.1. The wireless network is configured with WPA or it is turned off entirely.

Note: If I want to utilize the "Virtual Servers" feature of the firewall to map an incoming connection from the internet onto a particular ip address and port on some server, then I would connect that server to one of the A* lan ports. This provides much better isolation. Even if someone was able to break into a machine on A* they would still be blocked by the firewall of [BELKIN ROUTER 2] from getting into the Private Lan, B*.

This dual-firewall setup is more in keeping with a true DMZ configuration.

Current prices of these routers are so low when discounts and rebates are taken into consideration that two routers can be purchased for about $100.